Breaching

In late 2014, information from at least 500 million Yahoo accounts was stolen, making it one of the largest data breaches in history. Names, email addresses, telephone numbers, dates of birth and encrypted security questions and answers may have been breached.

According to Mercury News, it takes an average of 191 days to identify a data breach and 58 days to contain it. However it took Yahoo nearly two years to identify the breach. Yahoo announced the data breach on Thursday, but it is rumored the company knew about the breach as early as August.

A lawsuit was filed in U.S. District Court in San Diego on Thursday and a class-action lawsuit was filed in U.S. District Court in San Jose on Friday. The lawsuits cite Yahoo’s negligence with users’ data, a longer than usual period of time to identify a data breach, and the period of time Yahoo knew about the breach prior to disclosing it.

The lawsuits cite 500,000 possible class-action participants seeking a jury trial and damages, which have not yet been specified. Yahoo did not comment on the lawsuits, saying the company does not discuss ongoing litigation.

Yahoo made a deal this July to sell its core Internet business to Verizon for $4.8 billion and this data breach could affect the deal, which is expected to close in the first quarter of next year. Yahoo’s transitioning ownership also creates the question of who will take responsibility for the breach.