As any investigator can tell you, it's not just what you knew, but when you knew it.
On Wednesday, Yahoo admitted that not long after a hack in 2014 some of its employees were aware a state-sponsored hacker had breached its network. The revelation is sure to cast a larger shadow over Verizon's $4.8 billion deal to acquire the company.
Yahoo said in September that an investigation in August had uncovered the theft of personal information associated with at least a half billion Yahoo accounts, the biggest data breach in history. The company said at the time that it discovered the massive intrusion after a hacker claimed in August to have snatched 200 million Yahoo usernames and passwords in an earlier hack. But a Yahoo filing with the US Securities and Exchange Commission on Wednesday revealed that at least some people within the company were aware of the intrusion in 2014.
"An Independent Committee of the Board, advised by independent counsel and a forensic expert, is investigating, among other things, the scope of knowledge within the Company in 2014 and thereafter regarding this access," Yahoo said in its filing. It wasn't until the August probe, however, that the company got confirmation of the extent of the breach, a source with knowledge of the investigation said. The timing here is a critical concern.
The massive hack was allegedly uncovered a month after Verizon announced plans to acquire Yahoo for $4.83 billion and merge it with AOL. The hacking revelations led to questions that could affect the acquisition, with the wireless carrier's general counsel telling reporters in October that Verizon was leaning toward declaring the data breach a "material event." That could mean Verizon wouldn't have offered as much money -- or made a bid for Yahoo at all -- had it known about the hack earlier.
Yahoo acknowledged that possibility in its filing, noting that Verizon "may seek to terminate the Stock Purchase Agreement or renegotiate the terms of the Sale transaction on that basis." Yahoo declined to comment beyond its filing, citing its ongoing investigation. Verizon also declined to comment.
