Yahoo said in its annual filing that 32 million user accounts were accessed over the past two years by unauthorised third parties using forged cookies. The company said the guilty party was the "same state-sponsored actor believed to be responsible for the 2014 breach", in which at least 500 million accounts were affected. Yahoo added that the cookies have been invalidated and so cannot be used to access user accounts, Reuters reported.
The filing also said that CEO Yahoo Marissa Mayer will forgo her cash bonus for 2016 following the security incidents. Mayer will also not pick up any annual equity award for 2017.
Yahoo was the victim of a number of hackings, affecting 500 million users, as announced in September 2016, and 1 billion users in 2013, as revealed in December 2016. The hack into the accounts of the 500 million users was disclosed two months after Verizon announced a USD 4.8 billion takeover bid for Yahoo. Following re-negotiations, the takeover price has been reduced to USD 4.48 billion.
