The data breach which was one of the major challenges that led to drastic decline of Yahoo users in the last few years before its acquisition by Altaba in 2017.
Last year while under new ownership the company acknowledged that another data breach in 2013 affected all three billion of its users.
The Information Commissioner’s Office (ICO) said that 515,121 accounts belonging to British users were compromised in the attack.
Because the data breach took place in 2014, the ICO said that it would be using the Data Protection Act 1998 which sets a maximum fine of £500,000, although the new EU-wide GDPR law allows companies to be fined up to 4% of their global turnover.
The ICO added that the company failed to take appropriate measures to ensure that users’ data was properly secured.
Yahoo’s former chief executive, Marissa Meyer, did not reveal the breach after it took place in 2014 – something which companies would be obliged to do under the GDPR. The compromised personal data included names, email addresses, telephone numbers, dates of birth, hashed passwords, and encrypted or unencrypted security questions and answers.
The ICO’s deputy commissioner of operations, James Dipple-Johnstone, said: “People expect that organisations will keep their personal data safe from malicious intruders who seek to exploit it.
“The failings our investigation identified are not what we expect from a company that had ample opportunity to implement appropriate measures, and potentially stop UK citizens’ data being compromised.”
Mr Dipple-Johnstone added: “Cyber attacks will happen, that’s just a fact, and we fully accept that they are a criminal act. “But as the intruders become more sophisticated and more determined, organisations need to make it as difficult as possible for them to get in.”
This is the second big fine Yahoo will be getting after it was fined $35m by the security and exchange commission in the US.
No comments:
Post a Comment