Some Employees Knew Yahoo Was Compromised Years Before Hack of 500 Million Was Revealed

By Hudson Hongo on at

In September, just two months after US telecoms giant Verizon announced plans to acquire Yahoo, the search and email giant revealed that state-sponsored hackers had stolen the personal information of 500 million users. According to Yahoo, it began seriously investigating the attack this summer, but the company now says at least some employees knew of the breach as early as 2014.

In an SEC report filed Wednesday, Yahoo said that “the Company had identified that a state-sponsored actor had access to the Company’s network in late 2014.” It’s unclear who knew about the initial breach or when Yahoo first discovered the extent of the hack, but the report implies that the answer to both those questions is currently being investigated. From the Financial Times:

One person familiar with the investigation said Yahoo originally did not have a “full picture” of what happened because of the “sophisticated nature of state-sponsored attacks”. When it brought in outside experts to investigate the claim of a separate breach, which turned out to be false, it developed a more complete picture, the person said.

Since announcing the hack, the company has remained optimistic about the planned merger, but there are plenty of reasons to believe that Verizon may either renegotiate or kill the deal: As Yahoo notes in the same report, 23 class action lawsuits related to the hack have been filed against the company since September.

Gizmodo has reached out to Yahoo for comment. This post will be updated if and when they respond. [FT]