This post is an update of my previous post covering the Verizon-Yahoo merger. ((Matthew Dolloff, The Verizon-Yahoo Merger, MBELR Online (Jan. 22, 2017), http://mbelr.org/the-verizon-yahoo-merger/.))
The Effect on the Verizon-Yahoo Merger
Amidst the negotiations for Yahoo’s acquisition by Verizon, Yahoo revealed that its customer data had been stolen in a cyber-attack – with Verizon reportedly looking for a $1 billion reduction in the price. ((Steven L. Caponi, The Yahoo Breach: M&A Lessons for Corporate Fiduciaries, 19 Mergers & Acquisitions L. Rep. (BNA) 1781, 1782 (Nov. 28, 2016).)) A recent Yahoo filing revealed that Verizon CEO Lowell McAdam initially suggested a price cut of up to $925 million, and the possibility of dropping the deal, to one of Yahoo’s board members. ((Brian Womack, Verizon Suggested Price Cut of Up to $925 Million for Yahoo Deal, Bloomberg (Mar. 31, 2017), https://www.bloomberg.com/news/articles/2017-03-13/verizon-suggested-price-cut-of-up-to-925-million-for-yahoo-deal.)) The two eventually reached an agreement on a final price of $4.48 billion – $350 million less than the initial offer. ((Seth Fiegerman, Verizon Cuts Yahoo Deal Price by $350 Million, CNN (Feb. 21, 2017), http://money.cnn.com/2017/02/21/technology/yahoo-verizon-deal/.)) The hack not only devalued Yahoo in the deal, but will also continue to cost both companies down the road. There have been numerous class action lawsuits filed against Yahoo, ((Alyssa Newcomb, Yahoo Warns Verizon Could Pull Out of $4.8B Deal, NBC, http://www.nbcnews.com/tech/tech-news/yahoo-warns-verizon-could-pull-out-4-8b-deal-n682126)) and Verizon has agreed to split litigation costs. ((Fiegerman, supra note 4.))
The Department of Justice Case
The weakness in Yahoo’s security was incredibly costly for the company, but this cyber-attack was not ordinary. When the data breaches first came to light, Yahoo claimed that the attacks were state-sponsored. ((Vindu Goel, Yahoo Employees Knew in 2014 About State-Sponsored Hacker Attack, New York Times (Nov. 9, 2016), https://www.nytimes.com/2016/11/10/technology/yahoo-employees-knew-in-2014-about-hacker-attack.html?_r=0.))
Yahoo’s claim was validated on March 15, when the U.S. Department of Justice announced that it would bring charges against four individuals involved in the Yahoo hacking. ((US Charges Russian Spies over Yahoo Breach, BBC, (Mar. 15, 2017), http://www.bbc.com/news/technology-39281063.)) Amongst the four individuals were two Russian intelligence officers. ((Id.)) The Department of Justice alleged that the group targeted Russian and American government officials, in addition to the other accounts. ((Id.)) While two of the suspects have been arrested, the two Russian officers have not. ((Id.))
Yahoo Assistant General Counsel Chris Madsen reported that the “indictment unequivocally shows the attacks on Yahoo were state-sponsored.” ((See Id. (citing Chris Madsen, Russian Hackers and Government Officers Indicted in Connection With Yahoo Security Incidents, Tumblr (Mar. 15, 2017), https://yahoo.tumblr.com/post/158438180334/russian-hackers-and-government-officers-indicted?soc_src=mail&soc_trk=ma).)) A state-sponsored attack would likely be more difficult to repel than a typical hacking attempt. “You’re pitting U.S. corporations against state-sponsored activity, and no matter how good you are as a company, that is an unfair battle,” said Jim Pastore, a member of Debevoise & Plimpton’s Cybersecurity & Data Privacy practice. ((Brian Womack & Jordan Robertson, Yahoo Security Lapses Laid Bare as Russia Blamed for Hack, Bloomberg (Mar. 17, 2017), https://www.bloomberglaw.com/search/results/cdaf51a77cf727707653bfc46dd0fe2d/document/X1A707PK000000.)) Still, the large amount of litigation does substantially devalue the company, ((See Fiegerman, supra note 4.)) so it would be impossible to separate this in price negotiations.
The legal consequences of the Yahoo hack will continue to unfold in the class action lawsuits and the DOJ’s prosecution of the hackers.