Yahoo Mail

Three billion accounts - every Yahoo account in existence - taken across breaches in 2013 and 2014, still the largest breach by record count in internet history. The part that should land harder than the number is the concealment: the SEC found that information about the 2014 breach was reported to Yahoo's senior management and legal department, that Yahoo failed to properly investigate it, and that the breach was not disclosed to the investing public until more than two years later, in 2016, while Yahoo was in the process of closing the sale of its operating business to Verizon. Yahoo paid $35 million to the SEC for that disclosure failure, $117.5 million to users, $80 million to shareholders and $29 million in a shareholder derivative settlement (paid by insurers on behalf of the former officers and directors, together with Verizon) - roughly $261.5 million total. The users' $117.5 million fund covered a settlement class of as many as 194 million people in the US and Israel, not all 3 billion accounts. Passwords had been hashed with MD5, which was already considered broken.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. en.wikipedia.org/wiki/Yahoo_data_breaches — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.