Yahoo this week is expected to confirm that hackers stole information on at least 200 million users, tech news site Recode reported, in what would amount to one of the biggest data breaches on record.
The disclosure would come as Verizon Communications is in the midst of acquiring Yahoo for $4.83 billion (plus an estimated $1.1 billion to settle Yahoo employee restricted stock holdings at closing).
The huge data breach will likely spawn a law enforcement investigation and could lead to lawsuits, according to Recode, which cited anonymous sources. The concern for Yahoo investors is that the incident could affect the value of Verizon’s deal for the internet company.
Yahoo has not responded to a request for comment.
In August, Vice’s Motherboard reported that a hacker named Peace was advertising the sale of 200 million Yahoo user accounts — which included usernames, hashed passwords (which can be deciphered), and dates of birth — on a black-market online forum for about $1,860. The Yahoo data was likely stolen in 2012, according to the report.
A Yahoo rep said at the time that the company was “aware of a claim” and that it was investigating the allegations. The scope of the breach is even worse than the 200 million user accounts previously reported, according to Recode.
Peace is the nom de guerre of a Russian cybercriminal who has offered to sell info on millions of users supposedly stolen from LinkedIn, Myspace (now owned by Time Inc.), Twitter and Yahoo’s Tumblr.
Yahoo, after failing to turn around its core search and advertising business under the leadership of CEO Marissa Mayer, bowed to investor pressure to sell itself and commenced an auction earlier this year. Verizon emerged as the winning bidder in July, and the telco plans to merge Yahoo’s web operations with AOL, which it acquired last year for $4.4 billion.