Slashdot Mirror
Yahoo's Delay in Reporting Hack 'Unacceptable', Say Senators (zdnet.com)
Yahoo won't be able to get away with its mega data breach from 2014 that it only reported this month. Six senior senators have said Yahoo's two-year delay in reporting the largest known data breach in history is unacceptable. The senators have asked Yahoo CEO Marissa Mayer to explain why the massive hack of more than 500 million accounts wasn't reported two years ago when the breach occurred. From a ZDNet report:The senators said they were "disturbed" that a breach of that size wasn't noticed at the time. "That means millions of Americans' data may have been compromised for two years. This is unacceptable. This breach is the latest in a series of data breaches that have impacted the privacy of millions of American consumers in recent years, but it is by far the largest," the letter wrote. Sens. Patrick Leahy, Al Franken, Elizabeth Warren, Richard Blumenthal, Roy Wyden, and Edward Markey signed the letter, dated Tuesday. The senators also requested a briefing to senate staffers on its incident response and how it intends to protect affected users.
Sources say nothing of value was lost, as the breach only impacts people who still use Yahoo.
The Senate has no authority over Yahoo. Why does the Senate care how long it takes to report a data breach?
If they want, they can write a law and grant that authority to an agency.
With respect to the proposed sale of the company, it was out-and-out fraud.
But, in the good old U S of Kleptocracy, crooked CEOs don't get prosecuted, let alone convicted.
It took them 2 years to report the breach because they were using the Yahoo search engine to try and find the appropriate people to report the breach to.
"That's the way to do it" - Punch
It's stupid to expect companies to do what is right and ethical. This is why we have so many laws that mandate businesses do certain things. If they aren't legally required to do it and it won't make them money, they aren't going to do it until it becomes a problem for them.
Anons need not reply. Questions end with a question mark.
They will hold a senate investigation into the matter, which anyone in the right mind should be terrified of. They will start issuing subpoenas to people in charge at Yahoo, and start asking them questions on national t.v., (which will likely be embarrassing and detrimental to Yahoo's stock price and reputation). Provided that nobody tries to cover anything up (Federal prison time for lying under oath to a senate investigation), the company might get off with a reprimand, provided that there aren't any laws that were discovered to have been broken. But Senators aren't going to sign up for this investigation to NOT prosecute people for covering this up, so they will be out for blood. There is a good chance that something will have been done wrong, and some larges fines will be implemented.
I predict that there will be a number of c-level and VP early 'retirements', when yahoo's board of directors boots people for putting them in the spotlight like that. Following the investigation, expect a few new federal hacking disclosure laws to hit the books next year. This will probably not go well for Yahoo, short their stock now.
HA! I just wasted some of your bandwidth with a frivolous sig!
That means millions of Americans' data may have been compromised for two years.
Perhaps you and I have differing ideas of what constitutes "compromised." It seems you don't see it as compromising when the government does it - even without permission or oversight and with constant lies about it. Why is that? It's also the case that our data have been compromised for nearly two decades. Perhaps you should call for the end to the unethical, immoral, and unconstitutional spying instead - which you can actually do something about.
This isn't to absolve Yahoo! of its wrongdoing. It certainly should have been more diligent in disclosure. But to me, the differences are pretty clear. You could never have done business with Yahoo! and while it sucks a lot for the people harmed, you can not do business with Yahoo! in the future as well. Once the data's out there, the harm's pretty much been done. There's not a lot that anybody can do regardless of being notified or not. They can change their passwords and hope the effort is too much to make them interesting.
The NSA, on the other hand... you can't avoid "doing business" with them in the past or in the future, the data's been sucked up for decades (and this is going to start causing some serious shadow problems within the next 15-30 years as the previous generation(s) of lawmakers, law enforcers, and law upholders dies off - information never stopped being power and that means that the NSA has significant leverage on anyone and everyone), and no amount of anything you can personally do except go find a remote forest and forage out of it is going to protect you.
This idea that the government is going to save us from anything by forcing a company to be a bit swifter on the uptake is repugnant.