Dive Brief:

• Cybersecurity researchers say common hackers were likely responsible for the 2014 theft of 500 million Yahoo users’ personal data, not "state-sponsored" actors as the company has claimed.
• Information security firm InfoArmor also says Yahoo may have under-reported the number Yahoo accounts compromised. That number may be closer to one billion, the firm said. 
• The firm believes Yahoo was actually hacked by a group of professional black hats known as "Group E" rather than state-sponsored actors. The organization found evidence that the Yahoo database was twice sold to cybercriminals for spam campaigns, and once to a state-sponsored actor, though the infiltrators were not "state-sponsored actors."

Dive Insight:

The fallout of the breach will likely continue as more information regarding the massive breach comes to lights. The company, which was once the largest email provider in the U.S., has been on a downward spiral for a number of years as it struggled to innovate and expand its market appeal.

Though other organizations have struggled with data breaches, Yahoo is facing harsh criticism for how it handled disclosing the leak. A report from The New York Times revealed that the company was slow to invest in cybersecurity defenses, current and former employees said. Yahoo CEO Marissa Mayer declined to give the company's security team additional resources and was not proactive about network defense, according to the report.

With the Verizon's acquisition underway, this is the last thing the Yahoo needs as the recent revelations have the potential to disrupt the deal. 

The company will likely continue to face scrutiny as more information about the breach comes to light. Already, Yahoo is facing multiple lawsuits and questions from six U.S. senators. Security experts say the breach could put corporate information at risk since many people use Yahoo email for work.