> series: anatomy_of_a_breach —— part: 093 —— target: yahoo —— accounts: 500,000,000 —— delay: 2_years —— acquisition_impact: -$350M<span class="cursor-blink">_</span>_
On 22 September 2016, Yahoo disclosed that data associated with at least 500 million user accounts had been stolen in a cyber attack that it attributed to a 'state-sponsored actor.' The breach had occurred in late 2014 — meaning Yahoo had either not detected it for two years or had detected it and delayed disclosure. The stolen data included names, email addresses, telephone numbers, dates of birth, hashed passwords (using bcrypt for some, MD5 for others), and in some cases, encrypted or unencrypted security questions and answers.
The timing was catastrophic for Yahoo's business: the disclosure came while Verizon was negotiating a $4.83 billion acquisition of Yahoo's core internet assets. The breach disclosure — and the even larger one that would follow in December — ultimately resulted in Verizon reducing its offer by $350 million. The Yahoo breaches became the defining case study for cyber due diligence in mergers and acquisitions, proving that undisclosed breaches can have a direct, quantifiable impact on corporate valuation.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Yahoo breach established three principles that apply to every organisation: first, delayed disclosure causes more damage than prompt disclosure (the two-year gap amplified the impact on the Verizon deal). Second, breaches have quantifiable financial consequences that extend beyond remediation costs to corporate valuation. Third, M&A due diligence must include comprehensive cyber security assessment — our penetration testing is regularly commissioned for this purpose.
Cyber Essentials certification demonstrates security investment to potential acquirers and partners. SOC in a Box enables prompt breach detection and disclosure. Our infrastructure and application testing identifies the vulnerabilities that acquirers will discover during due diligence. And UK Cyber Defence provides the incident response capability that limits breach impact on business operations and corporate value.
Our <a href="/penetration-testing">penetration testing</a> is commissioned for M&A due diligence. <a href="/cyber-essentials">Cyber Essentials</a> demonstrates security posture. <a href="https://www.socinabox.co.uk">SOC in a Box</a> enables prompt detection.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call