Verizon, which is finalizing its $4.8 billion purchase of Yahoo, said late Thursday it was notified of the massive data breach at Yahoo only in the last two days.
Verizon said it would evaluate what it will do next. In an emailed statement, the company acknowledged that it now has only "limited information and understanding of the impact" of the hack.
Yahoo earlier in the day blamed the attack on a "state-sponsored actor"without further elaboration and said its ongoing investigation indicates that information from at least 500 million user accounts was stolen.
Yahoo didn't comment immediately on how the hack and its aftermath might affect its sale to Verizon.
Analysts said Verizon most likely won't move to break its planned Yahoo deal, which is still subject to regulatory review. But Verizon might want to lower the price it is paying because it wasn't notified of the hack sooner and doesn't yet know the full liability Yahoo and Verizon would face from victims of the hack.
"Within the last two days, we were notified of Yahoo's security incident," said spokesman Bob Varettoni. "We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact. We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities. Until then, we are not in position to further comment."
Roger Entner, an analyst at Recon Analytics and a recognized security expert, said Verizon should still buy Yahoo and "maybe get an adjustment on the price." But Entner said that Yahoo's hack was "not something that is preventable."
"If a nation state wants to break into your data, they will," he added. "It's only a question of when, not if. Security is only a question of time."
Patrick Moorhead, an analyst at Moor Insights & Strategy, said acquisition contracts always include clauses that affect the final price of a deal. "There are mitigation clauses that can increase or decrease the final price," he said.
"It sounds like Yahoo kept Verizon in the dark along with the rest of us," said Jack Gold, an analyst at J. Gold Associates. "If I were Verizon, I'd be particularly anxious. If they acquire Yahoo as planned, they will be assuming all liabilities for any damages that the data breach caused."
Gold add that Yahoo obviously has "no idea" yet what the liabilities could total. With that in mind, the carrier may decide to delay the acquisition until the full ramifications are known.
"That would be the cautious and sensible thing to do," he added.
U.S. Sen. Mark Warner, D-Va., said he was troubled that the Yahoo breach occurred in 2014 “and yet the public is only learning details of it today.” He called for a federal law to create a uniform data breach notification standard.
This story, "Verizon learned of Yahoo's massive data breach just two days ago" was originally published by Computerworld.