Yahoo must pay $85 million and provide free credit monitoring to 200 million people as part of a settlement of what is believed to be the biggest data breach ever.
The onetime internet giant, which is now owned by Verizon, has reached a settlement in a class-action lawsuit over the 2013 and 2014 hacks. The company did not disclose the breach, which affected about 1 billion accounts, until 2016. The hacks exposed user names, email addresses, phone numbers, birthdates, scrambled passwords and security questions and answers.
"We are pleased that we were able to reach a settlement with Yahoo, which would provide relief to impacted users and ensure that Yahoo improves its security practices going forward," said John Yanchunis, lead counsel of Morgan & Morgan in Tampa, Florida, in a statement Tuesday.
As part of the settlement filed late Monday, $50 million would go to Yahoo users, and the company would pay $35 million in legal fees.
Affected Yahoo users are U.S. and Israel residents and small businesses with Yahoo accounts at any time from Jan. 1, 2012 to Dec. 31, 2016. The funds would be distributed to those who had out-of-pocket losses, paid for email services or already have credit-monitoring services, according to the proposed settlement. Those who choose to receive credit monitoring could have it for at least two years.
Judge Lucy Koh is expected to rule on the proposed settlement Nov. 29 in U.S. District Court in San Jose.
Last year, Yahoo admitted that the 2013 hack actually affected all 3 billion user accounts. The U.S. Department of Justice has charged Russian hackers with the 2014 breach.
Oath, the company Verizon formed when it merged Yahoo and AOL, said through a spokesman Tuesday that it does not comment on litigation.
