46 ms·
SEC Penalizes Yahoo $35M for Massive, Undisclosed Cyber Theft
- deft 9y agoHundreds of millions of users had their data stolen. Putting this fine at less than a dollar per user. Is that really what our private information and security is worth? Who cares if they're being fined when it's a slap on the wrist. To all those talking about billion dollar fines on Facebook: fat chance.
- azurezyq 9y agoFB's case is different. I think the term for FB's case is private data abuse rather than leak. Cambridge Analytica took the data through API just like every other app doing at the time, but violated the terms of use. FB is guilty because it designed the wrong way (no excuse) to share the information (still under consent). For example, banks share your personal info around all the time (say promo mails). For Yahoo, that's ... poor technology & management.
- deft 9y agoyou're making the case that Facebook was negligent and Yahoo wasn't. I don't think that's true because Yahoo kept the hack a secret from auditors and users for 3 years.
- utopcell 9y agoConsidering there was a foreign state agent involved in the hack, we should consider the possibility that Yahoo could not disclose the hack even if they wanted to.
- mattnewton 9y agoI mean, the crime here isn’t against users, it’s against investors right? That’s why the SEC involved. I don’t even know who enforces the meager consumer privacy protections we have these days.
- milkytron 9y ago> I don’t even know who enforces the meager consumer privacy protections we have these days. Based on the fact that the ISPs lobbied to be able to sell browsing history... I don't think any government agency truly enforces consumer privacy protection.
- matte_black 9y agoA dollar is generous. The value of any individual user’s data is far simpler: worthless.
- onetimemanytime 9y agoTo be fair that's SEC, they deal with investor issues. Not that FTC will hurt them more given their past penalties but... IMO, the penalty should be xx% of their revenue. Customer data is sacred; unless you can secure it, don't ask for it.
- labster 9y agoMost users will give away their personal data for a discount of less than a dollar, sometimes even for free. So yeah, the market rate for our personal information is very low per person.
- gnode 9y agoAs this is the SEC, making a fine on behalf of investors, it reflects the impact to investors. That being, that unfortunately most users continue to use platforms in spite of serious security and/or privacy concerns. Combined with weak consumer protection, this makes the consequences for the company fairly minor.
- mtgx 9y agoSo about a $1 fine for every 100 accounts exposed [1]. Also the entire sum is less than what Marissa Mayer got every year in salary [2], as we well as a small fraction of what she got as compensation for selling Yahoo to Verizon [3]. [1] http://money.cnn.com/2017/10/03/technology/business/yahoo-breach-3-billion-accounts/index.html http://money.cnn.com/2017/10/03/technology/business/yahoo-br... [2] https://www.nytimes.com/2017/06/03/technology/yahoo-marissa-mayer-compensation.html https://www.nytimes.com/2017/06/03/technology/yahoo-marissa-... [3] http://www.latimes.com/business/technology/la-fi-tn-yahoo-snap-20170425-story.html http://www.latimes.com/business/technology/la-fi-tn-yahoo-sn...
- forkerenok 9y agoDoes this kind of stuff damage CEO's reputation in the job market? I'm trying to grasp what was at stake that made the executive(s) withhold publicizing the breach...
- gkoberger 9y agoNot to get too cynical, but... it shows loyalty. A CEO that presided over a security breach, kept it as quiet as possible, and only cost the company $35MM. Like it or not, his job is to protect the company, not the users. Compared to, say, Zuckerberg or Equifax's public raking over the coals.
- leggomylibro 9y ago>A CEO that presided over a security breach, kept it as quiet as possible, and only cost the company $35MM. Like it or not, his job is to protect the company, not the users. Sorry to be pedantic but it'd be 'her job', in this case - Marissa Mayer was CEO at the time.
- gkoberger 9y agoI wasn't sure which to say. Marissa was CEO at the time of the breach, and Tim Armstrong is CEO now. She testified and took a lot of the blame, whereas the fine happened under Tim Armstrong. I figured I'd go with the latter since that's when the fine came down, but I think both deserve credit (good or bad).
- allannienhuis 9y ago'they' is a useful gender-agnostic singular pronoun when you're not sure. https://en.wikipedia.org/wiki/Singular_they https://en.wikipedia.org/wiki/Singular_they
- DmenshunlAnlsis 9y agoEnglish is not my first language, so forgive my asking, but isn’t that sort of uncomfortable to use? Looking at the examples given, they’re all PA announcements or something similarly detatched. It also seems easy to confuse with the plural. What’s the point of decreasing the clarity and utility of language for the sake of a percent of a percent who might be bothered?
- crystaln 9y agoI wonder if this is related to their recent TOS change that requires arbitration and prohibits class action lawsuits.
- wrs 9y agoThe headline is rather misleading — the SEC penalized Yahoo for not disclosing the breach to investors, not for the breach itself.
- grzm 9y agoThe word undisclosed in the title is doing the work you're asking it to, as far as I can tell. How would you choose to word it differently?
- mattnewton 9y agoIt says “for adjective adjective cyber theft”, which implies the undisclosed is just modifiyig the object they were fined for. GP is not alone in their confusion, top comment right now is talking about how it’s a slap on the wrist _for the breach_ (and not for the lack of disclosure). A better title would be “SEC Penalizes Yahoo for Failure to disclose Massive security breach” Then failure to disclose is the object
- grzm 9y agoMakes sense. Thanks for the alternate read.
- txsh 9y agoNot it isn’t. “Undisclosed” is an adjective. The title says that the SEC penalized Yahoo for a “cyber theft” that was “massive” and “undisclosed.” “SEC Penalizes Yahoo $35M for Non-Disclosure of Massive Cyber Theft” would be better.
- nameisu 9y agolol fuck the end user again
- charleyma 9y agoAgreed, the $35 million penalty was to settle charges that Yahoo "misled investors by failing to disclose one of the world’s largest data breaches". The breach occurred on Dec 14th 2014 and it wasn't disclosed until 2016 during the acquisition by Verizon. Taken from the sec's site: " Instead, the company’s SEC filings stated that it faced only the risk of, and negative effects that might flow from, data breaches. In addition, the SEC’s order found that Yahoo did not share information regarding the breach with its auditors or outside counsel in order to assess the company’s disclosure obligations in its public filings. . Finally, the SEC’s order finds that Yahoo failed to maintain disclosure controls and procedures designed to ensure that reports from Yahoo’s information security team concerning cyber breaches, or the risk of such breaches, were properly and timely assessed for potential disclosure." https://www.sec.gov/news/press-release/2018-71 https://www.sec.gov/news/press-release/2018-71
- saaaaaam 9y agoWhat is this site? Have they any reputation? I ask because they say - somewhat illiterately:- “While those factors may caution the public, many wonder if anyone reads what is often viewed as nothing but legalize”. I assume they mean “legalese”.
- aphextron 9y agoHow do they even define these "breaches" as single discrete events? Can you even imagine the amount of data Yahoo has leaked over the past 20 years?
- MikeGale 9y agoSo we have a management team, many of who could have blown the whistle on this. They act like scum. They suffer no personal penalty under law. Wow we must have a sophisticated, moral civilisation here.
- eksabajt 9y agoIn 2015 I was targeted by scammers who claimed to be from Microsoft and said that I had a virus on my Dell computer. Another graduate student had originally registered the computer with Dell technical support. When the hard drive failed I updated the phone number, but I had overlooked updating the name in the contact info. When the scammers called me they addressed me by the name of the other grad student. I tried to report this breach to Dell at the time, but I didn't get anywhere. Seeing this news reminded me of the incident and I searched to see if Dell had disclosed the breach. I found a few articles from early 2016 where others were reporting similar experiences but Dell was not admitting at that time that they had experienced a breach [1-3]. In May 2016 Dell still claimed that they had "no indication that customer information used in the scams has been obtained through an external attack" [4]. Does anyone know if they ever admitted to the breach? They ought to be sanctioned as well if they failed to disclose. [1] https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/ https://krebsonsecurity.com/2016/02/dell-to-customers-report... [2] https://www.cio.com/article/3020733/security/scammers-target-dell-customers-after-apparent-data-breach.html https://www.cio.com/article/3020733/security/scammers-target... [3] https://arstechnica.com/information-technology/2016/01/latest-tech-support-scam-stokes-concerns-dell-customer-data-was-breached/?comments=1 https://arstechnica.com/information-technology/2016/01/lates... [4] https://blog.dell.com/en-us/dell-phone-tech-support-scams/ https://blog.dell.com/en-us/dell-phone-tech-support-scams/
- eksabajt 9y agoI found a couple Hacker News threads related to this breach [1,2]. Did anyone end up reporting it to the FTC? I just filed a tip with the SEC. Curious to see if they follow up. [1] https://news.ycombinator.com/item?id=10841385 https://news.ycombinator.com/item?id=10841385 [2] https://news.ycombinator.com/item?id=9881674 https://news.ycombinator.com/item?id=9881674
- surds 9y agoSomebody got my information from somewhere - I have no clue, and tried to target me with the Microsoft Support scam. It was hilarious, and I wrote about my own experience[1], but I do wonder how many unsuspecting folks fall prey to it. :( [1] https://www.technorms.com/60343/avoid-phone-scam-windows-microsoft-support https://www.technorms.com/60343/avoid-phone-scam-windows-mic...
- chrischen 9y agoSince it's the SEC, I'm assuming it's some fine for defrauding in the sale process to Verizon. So who's paying the fine? UPDATE: Seems like it's Altaba that's paying the fine.
- neya 9y agoWow, I can't believe Marissa Mayer got away with all this, pocketing a nice lump sum and while still being portrayed as some heroic female icon. I paid a lot for her incompetence - Hackers took control of my bank accounts and I wasn't able to login into my net banking without visiting my nearest branch. I know I wasn't the only one. Fuck Yahoo. Fuck Mayer.
- Dowwie 9y agohow much has Equifax paid in fines, to date?
- jeltz 9y agoI am looking forward to GDPR. At least then companies cannot delay disclosure anymore.
- node-bayarea 9y ago$35M is peanuts.. this is how scam works in the valley.