The massive hacking attacks that Yahoo suffered during the past few years have been good news for at least one group of people: Yahoo’s lawyers.
Yahoo said on Tuesday that it paid $16 million related to the security incidents during the first three months of the year.
$5 million of that sum was for the forensic investigation, while $11 million was “associated with nonrecurring legal costs,” Yahoo said in its 10Q filing with the SEC on Tuesday.
The funny thing about Yahoo’s nonrecurring legal costs is that they seem to have recurred.
Yahoo also paid $16 million for the security incidents in the year ended 2016, with $11 million going to…nonrecurring legal costs.
The hacking attacks, which occurred in 2014 and affected more than one billion user accounts, were among the largest ever suffered by a corporation. Yahoo determined that a state-sponsored actor had accessed certain user accounts, making off with user names, dates of birth, email addresses and other information. But Yahoo did not publicly reveal the security breaches until the fall of 2016, leading to more than 40 investor lawsuits and the resignation of the company’s General Counsel.
Given the magnitude of the hacking attacks, it’s not too surprising that Yahoo has racked up hefty legal fees. It’s possible that the similarity in the back-to-back legal expenses owes to a deal that Yahoo may have struck with its lawyers, rather than letting itself get charged by the billable hour.
Still, Yahoo warned on Tuesday that it expects to continue spending money on legal, investigation, remediation and other expenses because of the hacks for the “foreseeable future.”
A Yahoo representative was not immediately available for comment.