News reports today indicate that Verizon is pushing ahead with its purchase of Yahoo’s core internet business, despite Yahoo’s massive data breaches. Yahoo suffered a breach of 500 million user accounts in 2014, on the heels of a one billion account compromise in 2013 (names, telephone numbers, birth dates, passwords, and security questions), reputedly the largest data breach in history.
Speculation swirled for months about whether Verizon would simply walk away from the deal, originally set at $4.83 billion, or would proceed with a drastically reduced acquisition price. And the result, as of today’s announcement? Full speed ahead, after lowering the purchase price by $350 million.
Verizon will gain personal data on Yahoo’s over one billion users, which will no doubt boost its digital media and targeted advertising revenues, and the deal will help Verizon expand beyond the crowded market for wireless services. So, the value of user information is not in doubt. But what about the value of privacy?
$350 million is a lot of money. And apparently Verizon and Yahoo will share certain costs related to governmental investigations and breach litigation, with Yahoo remaining on the line for SEC and shareholder litigation fallout. But still, the results of simple division are stark – $350 million against up to 1.5 billion affected persons … yielding 23 cents.
This is not fundamentally about the cost of a data breach. Breaches are expensive, in hard costs, litigation exposure, and reputational damage. Ponemon Study statistics are useful for breaches below 100,000 affected persons, though the “cost per record” approach can become tenuous through cost dilution in mega-breaches such as Target, Anthem, and Yahoo.
Instead, this is about individuals’ privacy, and our expectations for who’s ultimately responsible for it. If we surrender our responsibility for being vigilant about sharing and safeguarding our personal information, assuming someone else will take care of that for us, we likely won’t be pleased with the results.
Just my 23 cents.