Yahoo to pay $117.5M in latest settlement of massive breach

SAN FRANCISCO — Nearly 200 million people who had sensitive information snatched from their Yahoo accounts will receive two years of free credit-monitoring services and other potential restitution in a legal settlement valued at $117.5 million.

The deal revises an earlier agreement struck last October, only to be rejected by U.S. District Court Judge Lucy Koh in San Jose, Calif. The value of that settlement had been pegged at $50 million, but Koh questioned the calculations.

A more detailed breakdown used in the revised settlement drove up the estimated cost. The money will be paid by Yahoo’s current owner, Verizon, and Altaba, a holdover from Yahoo’s past that still owns a stake in Chinese internet company Alibaba Group worth billions of dollars.

If approved, the settlement will become part of the financial fallout from digital burglaries that stole personal information from about 3 billion Yahoo accounts in 2013 and 2014 — believed to be the biggest data breach ever.

And now the $117.5 million settlement could become the largest amount ever doled out for a data breach, a recurring problem in an increasingly digitally driven world. It eclipses a $115 million settlement that Koh approved last year to cover 79 million people who had personal information stolen in a 2015 breach at health insurer Anthem Inc.

Yahoo didn’t begin to disclose the extent of its security breakdown until 2016 amid an FBI investigation that eventually linked some of the hacking to Russia. The revelations brought a mortifying end to the reign of Yahoo CEO Marissa Mayer, eventually prompting the company to reduce its selling price to Verizon by $350 million.

Verizon has since written off much of the nearly $4.5 billion price for the Yahoo acquisition in sign of the eroding value of that business.

Lawyers representing the Yahoo accountholders estimate about 194 million people in the U.S. and Israel will be eligible to make claims.