Yahoo chief executive Marissa Mayer lost an annual bonus and the company counsel his job after an investigation showed the company mishandled an epic hack, the tech firm said Wednesday.
“I am the CEO of the company and since this incident happened during my tenure, I have agreed to forgo my annual bonus and my annual equity grant this year,” Mayer said in a statement made available along with a regulatory filing on the matter. She added that she has asked that her bonus “be redistributed to our company’s hardworking employees.”
The investigation findings also resulted in Yahoo general counsel Ronald Bell’s resignation on Wednesday with no severance payments, according to the filing to the Securities and Exchange Commission.An independent committee determined that Yahoo’s security team knew about the 2014 hack of user accounts when it happened, the company said in the filing.
Late that year, senior executives and some legal staff were made aware that “a state-sponsored actor had accessed certain user accounts” by exploiting an account management tool.Yahoo took some action, notifying 26 specifically targeted users and consulting with police, according to the company.
“While significant additional security measures were implemented in response to those incidents, it appears certain senior executives did not properly comprehend or investigate,” Yahoo said in the filing. “And therefore failed to act sufficiently upon the full extent of knowledge known internally by the company’s information security team.” Mayer became Yahoo chief in 2012.
Verizon still dialed in
Last week, a price cut kept Verizon on track to complete the purchase of Yahoo’s internet business and share the costs from a pair of epic hacks that had threatened to derail the deal. Yahoo slashed the price of its core internet business by $350 million. Under the revised terms of the delayed deal, Verizon’s purchase of Yahoo assets will total $4.48 billion.
The deal with Verizon is expected to close by July, ending Yahoo’s run of more than 20 years as an independent company. Yahoo is selling its main operating business as a way to separate it from its more valuable stake in the Chinese internet giant Alibaba, which will become a new entity, to be renamed Altaba, Inc., and act as an investment company.
32 million accounts compromised
Yahoo disclosed two massive data breaches last year, and said on Wednesday that about 32 million user accounts were accessed by intruders in the last two years using forged cookies. The company said some of the latest intrusions can be connected to the “same state-sponsored actor believed to be responsible for the 2014 breach”, in which at least 500 million accounts were affected.
“Based on the investigation, we believe an unauthorized third party accessed the company’s proprietary code to learn how to forge certain cookies,” Yahoo said in its latest annual filing. These cookies have been invalidated so they cannot be used to access user accounts, the company said.
Yahoo had announced in September that hackers in 2014 stole personal data from more than 500 million of its user accounts. And in December, it admitted to another cyberattack from 2013 that affected more than a billion users, making it the largest breach in history. Yahoo still faces probes and lawsuits related to the cyberattacks.
US law requires companies that fall victim to such hacks to disclose them as soon as they are deemed to affect stock prices. The hacks have been a major embarrassment for a former internet leader that has failed to keep up with Google, Facebook and other rising tech stars.
Mayer will quit the company’s board after its merger with Verizon, according to an SEC filing, although she is expected to remain with the core Yahoo business.