Verizon's Yahoo unit has proposed a USD 117.5 million settlement to close the class action lawsuit over the 2013 Yahoo data breach, according to news.webhosting.info. The deal was filed after Yahoo's initial settlement offer was rejected in January 2019.
The 2013 breach compromised more than three billion Yahoo accounts, exposing names, email addresses, phone numbers and dates of birth. A separate 2014 hack also exposed hashed passwords, encrypted security questions and answers.
Who should care
| Stakeholder | Why it matters |
|---|---|
| Yahoo/Verizon | Closes a years-long legal overhang; signals commitment to security posture |
| Affected users | May receive direct compensation and monitoring services, though per-account payout will be modest |
| Small hosts and resellers | Reminder that breach costs extend years beyond the incident; documentation is defensive |
| Plaintiffs' attorneys | Settlement funds include USD 30 million for legal costs—standard but notable slice |
| Future breach victims | Creates precedent for how courts value mass account exposures |
What the money buys
The USD 117.5 million is split into four buckets, per the proposal. USD 55 million covers direct costs to victims. USD 24 million funds credit and security monitoring services for affected users. USD 30 million covers legal costs. USD 8.5 million is allocated to other expenses.
The structure matters. Most of the money goes to victims and to monitoring, not to lawyers. That is the part of a settlement that actually changes user experience.
Our analysis
Yahoo's settlement is large in dollar terms and modest in per-victim terms. USD 117.5 million divided across more than three billion accounts yields roughly four cents per account. That is what bulk personal data is worth in a class action.
The bigger story is corporate. Yahoo was acquired by Verizon during the litigation, which shifted the bill to a new owner. Every company that stores customer data now has to price in not just technical remediation but the multi-year legal tail that follows. Settlement rejection is also part of the picture—when an initial offer fails, the next one gets shaped by what the court signaled.
Market analysts note that while it is difficult to predict whether this proposal will pass, Yahoo has taken concrete steps to compensate for the breach. The outcome will shape how Verizon approaches cybersecurity investments going forward.
For resellers and small hosts, the lesson is procedural. Document everything, retain logs beyond what feels necessary, and assume any breach will end up in litigation. Companies that survive breach lawsuits cleanly are the ones that can show what happened and when it happened.
What to watch next
Watch whether the court accepts the proposal. Watch for any impact on Verizon's broader security strategy, including its ProtectWise acquisition for endpoint security. Watch for copycat lawsuits, because the precedent will be cited by every future breach plaintiff seeking to quantify damages across billions of exposed accounts.
Frequently asked questions
How much is Yahoo offering?
USD 117.5 million in total, per news.webhosting.info.
How is the money split?
USD 55M direct expenses, USD 24M monitoring services, USD 30M legal costs, and USD 8.5M for other expenses, per the proposal.
How many accounts were affected?
More than three billion accounts were compromised in the 2013 breach, with a separate 2014 hack also exposing hashed passwords and security question data.
Why a new offer?
Yahoo's initial settlement offer was rejected in January 2019, prompting this revised proposal.
What does this mean for small hosts and resellers?
It highlights that breach costs extend years beyond the incident. Maintaining thorough documentation and log retention can significantly affect how a case resolves.