On Thursday, Yahoo announced that a data breach in late 2014 resulted in 500 million Yahoo user accounts being stolen. Among the data, which Yahoo is claiming was stolen by a state-sponsored actor, are e-mail addresses, names, dates of birth, and encrypted or unencrypted security questions and answers. The timing is awkward for Yahoo, which just months ago announced a $4.8 billion sale of its core Internet assets—many of which are apparently compromised by the hack—to Verizon. (In a statement, Verizon announced it only learned about the hack this week.) More crucially, the hack is the latest embarrassment to the legacy of C.E.O. Marissa Mayer, whose tenure at the company has been marred by both extravagance and inaction.
When Mayer took the top job at Yahoo, she was inheriting an unenviable post. The chief-executive role at the company’s Sunnyvale headquarters had served as a revolving door of talent long before her tenure began. Carol Bartz was unceremoniously fired from the position after two and a half years at the company, and Scott Thompson was let go in a matter of months for forging details on his résumé. Mayer, who came into Yahoo as its fifth chief executive in five years, was greeted as a savior: employees hung posters of Mayer’s face with the word “HOPE” underneath, in the style of Shepard Fairey’s iconic Barack Obama poster. There was unbridled optimism; Mayer had a vaunted career at Google, helping to develop some of the company’s most successful accomplishments, and helped influence the design of products like Gmail and Google’s Web search. If anyone could take on the 90s relic that was Yahoo and transform it into a modern-day tech company, it was Marissa Mayer.
The less rosy side of the story is that Mayer accepted a job that few would have been able to successfully pull off; she and the Yahoo board members who hired her were perhaps overly ambitious when it came to assessing just how much work their fixer-upper needed. Yahoo had missed the transition to mobile; it was no longer a hotbed of talent; and it’s little-bit-of-everything strategy had been disrupted by competitors who had doubled down on core identities like search (Google), e-commerce (Amazon), social media (Facebook), and traditional media content (the Huffington Post, et al.). Under Mayer’s four-year tenure, the company never quite settled on a turnaround strategy. Instead, Mayer went on an M&A spree, acquiring dozens of companies for $3 billion, including the indulgent $1.1 billion purchase of wunderkind David Karp’s Tumblr, which has since languished and withered. Mayer also made a series of questionable hires, including an expensive pact with ad man Henrique de Castro, who made $109 million for 15 months of work at the company.
Mayer’s spendthrift choices ended with the sale of the company to Verizon this year for $4.8 billion—a fraction of what former Microsoft C.E.O. Steve Ballmer offered for Yahoo less than a decade ago. But now her problems, and her legacy, are arguably far more complicated. Midway through the company’s sale, a data breach involving half of Yahoo’s 1 billion users was confirmed—one final headache for Mayer, who has reportedly been slow to address security issues at the company. One executive says that Yahoo’s former head of information security, Alex Stamos, had tried to get Yahoo to act on previous security problems, but Mayer was not receptive. “Under Marissa’s leadership at Yahoo, we’ve worked hard to ensure that our information infrastructure is more secure than ever,” a Yahoo spokeswoman told Bloomberg. (In a statement on its site, Yahoo has said it is making every effort to protect its users.)
The security breach could set off a series of problems for Yahoo, including class-action lawsuits and a decreased sale price. All told, The New York Times reports, the cost of dealing with the data breach may be more than the $4.8 billion Verizon bid for Yahoo. “We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact,” Verizon said in an statement. "We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities."
More questions for Mayer remain. It took Yahoo two years to either find out about or disclose the data breach, which could be among the largest in history. Why weren’t Yahoo’s users warned sooner? It also remains unclear why bidders weren't told about the data breach during the bidding process for Yahoo’s core Web assets. As *Fortune’*s Dan Primack points out, if Yahoo did not breach its agreements with Verizon, the company had to have learned about the hack after July 23, when it signed the merger agreement with Verizon, and before August 1, when the first report of the hack surfaced, or this hack involving 500 million Yahoo users is a different hack entirely.
In Silicon Valley, optics are everything, and none of this reflects well on Mayer. Failing to turn around a lumbering Internet giant is a forgivable offense, and one could easily see Mayer moving on to a different, consequential job down the line having learned from this experience. This scandal, no matter what Yahoo knew and when the company knew it, could tilt the calculus. Nevertheless, this is still Silicon Valley. Should Verizon move ahead and fire Mayer, she will still walk away from the company with a reported severance package worth $44 million.
