Incident & Breach Response , Managed Detection & Response (MDR) , Security Operations
Despite Breaches, Yahoo CEO Gets Golden Parachute
Marissa Mayer Stands to Get $23 Million Once Acquisition by Verizon Completed(Editor's Note: See related story: Russian Spies, Two Others, Indicted in Yahoo Hack.)
See Also: Effective Communication Is Key to Successful Cybersecurity
Search giant Yahoo suffered two massive data breaches during the tenure of CEO Marissa Mayer. But when the company wraps up the sale of its primary businesses to Verizon for $4.48 billion in cash, Mayer is set to exit with an extra $23 million in compensation, minus her title as head of Yahoo or CEO of the investment company Altaba being formed by what's left.
Those details are included in a March 13 proxy filing setting out a draft of what Yahoo plans to send to shareholders in advance of a special meeting - yet to be scheduled - for approving the acquisition.
The filing also reveals the behind-the-scenes wrangling that led to the deal, with Verizon demanding nearly a $1 billion reduction in the purchase price after the search giant disclosed or revealed the extent of its massive breaches. Verizon and Yahoo ultimately agreed to a $350 million reduction.
Meanwhile, Mayer, 41, will receive a golden parachute of cash, stock and benefits worth $23 million if she's terminated without cause or else for "good reason" within one year of the deal closing, according to the filing. If Mayer was offered - and took - a job with Verizon, she would not be eligible for that payment.
The $23 million figure - $3 million in cash - is lower than the $55 million and $44 million golden parachutes for Mayer that were specified in previous filings, reportedly because stock options that comprised some of that compensation have already vested.
Lisa Utzschneider, Yahoo's chief revenue officer, stands to receive a $16.5 million severance package, and Ken Goldman, the chief financial officer, a $9.5 million severance, once the deal closes.
News of the deal follows the results of an independent investigation commissioned by Yahoo's board of directors, which slammed the company's legal and senior management teams for failing to properly investigate a 2014 breach that the company suffered. Following the results of that investigation, Yahoo's board announced that Mayer would not receive a $2 million bonus and would forego at least $12 million in equity awards.
The investigation triggered the March 1 resignation of Ronald S. Bell, Yahoo's lead attorney. According to Yahoo's filing, he will receive no golden parachute.
What Verizon Is Buying
As a result of the acquisition, Verizon will gain numerous patents, plus multiple Yahoo properties - its email service, advertising tools, real estate site, plus news, finance and sports sites - all of which will reportedly retain the Yahoo brand name.
The remnants of Yahoo that Verizon is not acquiring will be renamed Altaba. That new company will trade under the ticker symbol "AABA" and be led by Thomas J. McInerney, 52, the current chairman of Yahoo's Strategic Review Committee. He's been a Yahoo board member since April 2012 and formerly worked at Ticketmaster and internet firm InterActiveCorp. McInerney will receive an annual base salary of $2 million, or double Mayer's base pay, according to Yahoo's filing. He's also eligible for an annual bonus of up to $2 million and "long-term deferred compensation" of up to $24 million.
Arthur Chong, 63, who's served as an outside legal adviser to Yahoo since October 2016, became the company's general counsel and secretary on March 10, and will continue in that role for Altaba, earning $1 million annually, being eligible for an annual $1 million bonus as well as long-term deferred compensation of up to $12 million.
Altaba will manage Yahoo's 15 percent stake in Chinese e-commerce giant Alibaba, which is worth $40 billion; its 35.5 percent stake in Yahoo Japan, worth $9.6 billion; as well as some non-core patents not included in the Verizon deal.
It's unclear if Mayer will have a role with Altaba. According to Yahoo's filing, she will not sit on Altaba's board.
Breaches Imperiled Deal
The fact that Verizon's acquisition of Yahoo is proceeding is good news for the struggling search giant - which has been desperately seeking an exit strategy - as well as for its investors.
On July 25, 2016, Verizon offered to purchase Yahoo for $4.83 billion. Subsequently, however, the search giant discovered that it had suffered a 2013 breach that compromised 1 billion accounts, and found that a 2014 breach that it had detected was much worse than it had discovered, and had compromised 500 million users' accounts. Yahoo disclosed its revised 2014 breach assessment on Sept. 22, 2016, and announced the 2013 breach on Dec. 14, 2016. As a result of the 2014 attack, investigators say cookies for 32 million user accounts also appear to have been stolen or used by attackers to access those accounts.
The breaches and related investigations led to a delay in the deal with Verizon. By October 2016, Verizon executives were reportedly demanding a $1 billion discount in the purchase price, although they publicly denied those reports, saying they were waiting to hear the results of Yahoo's breach investigation to see if it had resulted in a decline in Yahoo's value or number of users.
The Securities and Exchange Commission is reportedly investigating whether the company notified investors in a timely manner.
Yahoo does not have cybersecurity liability insurance. According to its SEC filings, the company last year spent $5 million on ongoing digital forensic investigations and remediation costs related to its breaches, plus $11 million in legal fees.
Verizon Received Concessions
On Feb. 1, McInerney and a representative from the law firm Cravath - representing the strategic review committee of Yahoo's board in connection with the transaction - told Lowell C. McAdam, Verizon's chairman and CEO, that wrapping up the search giant's data breach investigation would likely require at least three more months, according to Yahoo's filing.
McInerney asked McAdam how much of a discount Verizon was seeking for Yahoo, and "McAdam noted that Verizon was still formulating a view but that a purchase price reduction as high as $925 million could be appropriate," according to Yahoo's filing.
Rather than wait for Yahoo's breach investigation to end before concluding the sale, Verizon and Yahoo agreed to a $350 million reduction in the purchase price. Verizon will also require Yahoo - as in Altaba - to absorb all costs stemming from shareholder lawsuits and Securities and Exchange Commission investigations. Verizon will split the cost of breach-related class-action lawsuits with Altaba. At least 43 consumer class-action lawsuits had been filed against Yahoo in U.S. federal and state courts and in foreign courts, according to Yahoo's SEC filings.
Verizon, which acquired AOL in June 2015 for $4.4 billion, will reportedly integrate the Yahoo properties into its AOL portal to help it better battle Google and Facebook for a bigger share of global online advertising revenue.