American University Law Review Volume 66 Issue 5 Article 3 2017 Corporate Directors' and Officers' Cybersecurity Standard of Care: The Yahoo Data Breach Lawrence J. Trautman Western Carolina University Peter C. Ormerod Western Carolina University Follow this and additional works at: https://digitalcommons.wcl.american.edu/aulr Part of the Business Organizations Law Commons, Internet Law Commons, and the Privacy Law Commons Recommended Citation Trautman, Lawrence J. and Ormerod, Peter C. (2017) "Corporate Directors' and Officers' Cybersecurity Standard of Care: The Yahoo Data Breach," American University Law Review: Vol. 66 : Iss. 5 , Article 3. Available at: https://digitalcommons.wcl.american.edu/aulr/vol66/iss5/3 This Article is brought to you for free and open access by the Washington College of Law Journals & Law Reviews at Digital Commons @ American University Washington College of Law. It has been accepted for inclusion in American University Law Review by an authorized editor of Digital Commons @ American University Washington College of Law. For more information, please contact
[email protected]. Corporate Directors' and Officers' Cybersecurity Standard of Care: The Yahoo Data Breach Abstract On September 22, 2016, Yahoo! Inc. ("Yahoo") announced that a data breach and theft of information from over 500 million user accounts had taken place during 2014, marking the largest data breach ever at the time. The information stolen likely included names, birthdays, telephone numbers, email addresses, hashed passwords, and, in some cases, encrypted or unencrypted security questions and answers. Yahoo further disclosed its belief that the stolen data "did not include unprotected passwords, payment card data, or bank account information." Just two months before Yahoo disclosed its 2014 data breach, it announced a proposed sale of the company's core business to Verizon Communications.