US officials are planning to issue indictments related to the hacking attacks against Yahoo, according to a person briefed on the matter.
The country’s department of justice is accusing four people of participating in massive online security breaches that compromised hundreds of millions of user accounts, said the person, who asked not to be identified because it was a sensitive legal matter.
The hacks came to light last year and threatened to derail the sale of Yahoo’s Web operations to Verizon Communications.
The US is arresting one of the people in Canada as soon as Tuesday, the person said. Three of the people are currently in Russia, this person said. Representatives of California-based Yahoo and the justice department declined to comment.
The indictments come after revelations of the security breach prompted Verizon to insist on a price reduction for its planned deal, first announced in July, to acquire Yahoo’s key Internet assets including its finance, sports and other websites. Ultimately, it was trimmed by US$350m to $4,5bn.
Yahoo was afflicted by two major breaches in recent years.
The company said in December that cyber thieves in 2013 siphoned information including users’ e-mail addresses, scrambled account passwords and dates of birth. The stolen data could allow criminals to go after more sensitive personal information elsewhere online. The announcement followed news in September of a 2014 Yahoo breach that affected about 500m customer accounts.
The company hasn’t been able to identify the intrusion associated with the 2013 breach, according to a filing this month. Yahoo also has said it believes the thief in the 2014 hack was a “state-sponsored actor”, yet about the time it was revealed two people familiar with the matter said a link to a nation state wasn’t iron-clad.
The hacks recently led to management changes at Yahoo. General counsel Ronald Bell left the Web portal after an investigation found the company’s legal team had enough information about the security breaches to warrant further inquiry, but didn’t sufficiently pursue it.
CEO Marissa Mayer didn’t receive a cash bonus last year amid the investigations. A committee found no intent to suppress information about the hacks, but said key executives should have done more when the issues was discovered.
The breaches have resulted in millions of dollars in legal and investigative costs, according to company filings, and spurred more than 40 lawsuits. Yahoo also continues to work with the US Securities and Exchange Commission, Federal Trade Commission, the Manhattan US Attorney’s Office and two state attorneys general on related inquiries. — (c) 2017 Bloomberg LP