Yahoo chief executive Marissa Mayer will lose her annual bonus and the company’s top lawyer has been removed over their mishandling of security breaches that exposed the personal information of more than 1 billion users, reports The Guardian.
Mayer’s cash bonus is worth about $2m a year and her personal cost from the security flaws increased when the board also accepted her offer to relinquish an annual stock award worth millions of dollars.
Mayer, whose management team was found by an internal review to have reacted too slowly to one breach in 2014, said on Wednesday she wanted the board to distribute her bonus to Yahoo’s entire workforce of 8,500 employees. The board did not say if it would do so.
Yahoo’s general counsel, Ronald Bell, resigned without severance pay for his department’s lackadaisical response to the security lapses.
Although Yahoo’s security team uncovered evidence that a hacker backed by an unnamed foreign government had pried into user accounts in 2014, executives “failed to act sufficiently” on that knowledge, according to the results of an internal investigation disclosed Wednesday. At that time, Yahoo only notified 26 people that their accounts had been breached.
The report did not identify the negligent executives, but it chastised the company’s legal department for not looking more deeply into the 2014 breach. Because of that, the incident “was not properly investigated and analyzed at the time”, the report concluded.
Yahoo did not disclose the 2014 breach until last September when it began notifying at least 500 million users that their email addresses, birth dates, answers to security questions, and other personal information may have been stolen. Three months later, Yahoo revealed it had uncovered a separate hack in 2013 affecting about 1 billion accounts, including some that were also hit in 2014.
The breaches, the two biggest in internet history, have already exacted a major toll.
Yahoo already lowered the sales price of its email and other digital services to Verizon Communications from $4.83bn to $4.48bn to account for the potential backlash from the breaches. That deal was reached last July, two months before Verizon and the rest of the world learned about Yahoo’s lax security.
More than 40 lawsuits also have been filed seeking damages for the breaches. If Yahoo’s $5bn sale to Verizon is completed as expected later this year, a successor company called Altaba will be responsible for paying those legal claims.
Yahoo’s handling and disclosure of the breaches is also under investigation by the Securities and Exchange Commission and the Federal Trade Commission.
In a blog post on Yahoo’s Tumblr service , Mayer said she did not learn about the scope of the breaches until September and then tried to set things right. “However, I am the CEO of the company and since this incident happened during my tenure, I have agreed to forgo my annual bonus and my annual equity grant,” Mayer wrote.
