Breach Repercussions: Yahoo Reports Verizon Deal DelaySearch Giant Posts Better-Than-Expected Financial Results, But Time Is Running Out
Yahoo's executives expect the company's sale to Verizon to be delayed as the search giant continues to investigate two massive data breaches.
See Also: Threat Horizons Report
Despite the breaches, Yahoo reported better-than-expected 2016 fourth-quarter and full-year financial results and signaled that the Verizon deal is proceeding. Both pieces of news will likely calm investors.
"With our 2016 and Q4 financial results [being] ahead of plan, and the continued stability in our user engagement trends, the opportunities ahead with Verizon look bright," Marissa Mayer, CEO of Yahoo, says in a statement.
Yahoo reported a full-year revenue increase of 15.4 percent, reaching $1.47 billion, above analysts' estimates of $1.38 billion, according to a consensus estimate from Thomson Reuters. Quarterly gross mobile revenue increased by 10 percent, to $495 million.
Yahoo's report that fourth quarter financial results were better than expected was a repeat of its previous, third-quarter 2016 financial announcement. In November 2016, Yahoo announced a rise in third-quarter profit - exceeding analysts' expectations - as well as increased page-view counts and email usage, all after the first of two its two mega-breach notifications last year (see Yahoo Profits Rise Despite Record-Shattering Breach).
But analysts caution that Yahoo's business continues to decline, and that it needs to conclude its Verizon deal as quickly as possible. Notably, its quarterly gross search revenue declined by 6 percent to $821 million.
In addition, Yahoo's full-year EBITDA - earnings before interest, tax, depreciation and amortization, which is a more accurate measure of a company's operational performance than looking at net income - fell by 9 percent from 2015, hitting $873 million, according to its latest 8-k filing.
Breach Investigation Continues
Yahoo says that to date, it's spent $10 million investigating and remediating the two data breaches, and that it continues to invest in better information security processes, procedures and tools.
"In addition to integration planning, our top priority continues to be enhancing security for our users," Mayer says. "With security protocols and password changes in place, approximately 90 percent of our daily active users have already taken or do not need to take remedial action to protect their accounts, and we're aggressively continuing to drive this number up."
A source familiar with Yahoo's operations says that 90-percent figure covers daily active users across all of Yahoo's properties, including email and search users.
But that means 10 percent of Yahoo's user base remains vulnerable to attackers, because users haven't followed basic security guidance relating to resetting passwords or adopting stronger security measures (see Why Are We *Still* So Stupid About Passwords?). For example, only 10 million users have adopted Yahoo Account Key, which allows users to authenticate using a smartphone app.
Verizon Awaits Breach Investigation Results
Verizon in July 2016 reached a deal to acquire Yahoo for $4.8 billion.
Subsequently, on Sept. 22, 2016, Yahoo reported that a late-2014 breach resulted in the theft of information relating to 500 million or more users, which it failed to detect. Yahoo said that while it had detected at the time that an attacker had gained unauthorized access to its network, it failed to spot the related data exfiltration.
On Dec. 14, 2016, meanwhile, Yahoo warned that it had discovered a second breach that it suspected had compromised 1 billion user accounts, which appeared to date from August 2013. Yahoo says it has no idea how its network was breached or the data stolen.
Breach investigations are continuing, and Yahoo's Jan. 23 form 8-k filing detailing its fourth quarter and full-year 2016 financial results to the Securities and Exchange Commission reports that the deal will likely be delayed until the second quarter of this year.
"Yahoo has continued to work with Verizon on integration planning for the sale of its core business. In terms of timing, Yahoo had previously stated that it expected to close the transaction in Q1," according to the filing. "However, given work required to meet closing conditions, the transaction is now expected to close in Q2 of 2017. The company is working expeditiously to close the transaction as soon as practicable in Q2."
Yahoo didn't detail what those closing conditions might be, but Verizon has previously said it awaits the close of Yahoo's breach investigation to see if the security incidents have adversely effected Yahoo's value or the size of its user base.
Verizon is due to issue its own financial results Jan. 24. It's not clear yet if Verizon will seek to renegotiate the terms of its deal with the search giant.
SEC Probes Breach Notification Delay
Yahoo's results announcement follows a Jan. 22 report in The Wall Street Journal that the SEC has launched an investigation into Yahoo's breaches to see if the search giant violated civil securities laws, given the company's delay between spotting two breaches and notifying customers.
The SEC declined to comment on that report to Information Security Media Group. Yahoo referred ISMG to its 10-k filing from November 2016, which reported that it "is cooperating with federal, state and foreign governmental officials and agencies seeking information and/or documents about the security incident and related matters, including the SEC, among other agencies.
The SEC's investigation is more likely to focus on the delay between Yahoo discovering its late-2014 and its Sept. 22, 2016, breach notification to investors. While Yahoo blamed the 2014 breach on a "state-sponsored actor", security firm InfoArmor instead ascribed the attack to a cybercrime gang - with no nation-state ties - that it's been tracking.
Yahoo Floats On - For Now
So far, Verizon has continued to signal its interest in the Yahoo deal, via which it would acquire some patents, plus multiple Yahoo properties, including its email service; advertising tools; news, finance and sports sites; and real estate site, all of which would retain the Yahoo brand, the Los Angeles Times has reported.
Verizon acquired AOL in June 2015 - for $4.4 billion - and would reportedly integrate the Yahoo properties into its AOL portal. Doing so would enable it to better battle Google and Facebook for a bigger share of online advertising revenue.
What was left of Yahoo, meanwhile, would become a holding company called Altaba, with Mayer as CEO, according to SEC filings.
The Verizon-Yahoo deal has yet to be approved by regulators.
Users Hang On
Commenting on Yahoo's latest earnings results, market researcher eMarketer says Yahoo's data breaches appear to have triggered few if any user defections. But the research firm predicts that Yahoo will continue to lose search market share to Google and Facebook.
Youssef Squali, an analyst at investment firm Cantor Fitzgerald, likewise notes that Yahoo's search revenue is in decline, and that depending on how the latest display revenue results get crunched, they could also be shown to be in decline.
"You have to remember, this business is still a melting ice cube," Squali tells Reuters.