Yahoo's data breaches exposed 3 billion accounts — every Yahoo account that existed. If you used Yahoo Mail, Yahoo Finance, Flickr, Tumblr (under Yahoo), or any related service in that window, you qualify. Free credit monitoring + cash claims are still being processed.
Between 2012 and 2016, Yahoo's databases were compromised in two of the largest breaches in internet history. Every Yahoo account in existence at the time — about 3 billion — had email addresses, passwords, security questions, and birth dates exposed. The settlement provides credit monitoring (1+ years), reimbursement up to $25,000 for documented losses, and small cash payments.
Yahoo disclosed in 2016 and 2017 that two of the largest breaches in internet history occurred between 2012 and 2016, compromising essentially every Yahoo account: names, email addresses, passwords, security questions, and birth dates of about 3 billion accounts. The disclosures led Verizon to renegotiate its acquisition price for Yahoo's core business.
A $117.5 million class action settlement received final approval in 2019-2020. It paid free credit monitoring through AllClear ID, reimbursement of documented out-of-pocket losses up to $25,000, time-spent reimbursement at $25/hour, and a small cash alternative. The claim filing window closed July 20, 2020; this matter remains primarily a historical record for breach-affected users.
What was breached, what was paid, and where the matter stands now:
The settlement claim window closed in July 2020. The eligibility check above confirms whether you were in the class and what historical record may still be useful.
All claim windows closed in 2020. The breakdown of what the $117.5M settlement paid:
| Diagnosis or claim type | Projected payout range | What drives the tier |
|---|---|---|
| Documented identity-theft loss reimbursement | Up to $25,000 | Window closed July 2020. Out-of-pocket costs from identity theft or fraud tied to the breach, with documentation. |
| Time-spent reimbursement | $25 per hour (up to 15 hours) | Window closed July 2020. Time spent dealing with breach-related identity issues. |
| Free credit monitoring (AllClear ID) | 2 years | Enrollment closed. Active enrollees received coverage for the program's duration. |
| Cash alternative payment | Small pro-rated amount | Window closed July 2020. Originally up to $358.80 floor, sharply reduced because of high claim volume. |
| Paid-user account credit | 25% of certain subscription fees | Window closed July 2020. For paid Yahoo Premium subscribers during the breach years. |
All windows closed in 2020. The figures above reflect what was paid to claimants who filed before the deadline.
If you had a Yahoo, Yahoo Mail, Flickr, or Tumblr (under Yahoo) account between 2012 and 2016, your email address, password (hashed), security questions, and birth date were exposed. Even if you no longer use the account, the data is in circulation.
Background context, no action.If you reuse passwords from your Yahoo era, change them. Enable two-factor authentication on accounts that still use that email. Security-question answers from that era should be considered compromised.
30 to 60 minutes for a thorough password reset across reused accounts.Sign up for free credit-bureau alerts. Consider a credit freeze (free in all 50 states) if you have not already.
Free, 15 to 30 minutes per credit bureau.If you experience new identity theft you believe stems from breach-related fraud, save the records. While the Yahoo claim window is closed, state-law consumer-protection statutes may apply.
Ongoing.All claim windows for the $117.5M settlement closed in 2020. The settlement itself is closed; ongoing identity-theft risk continues.
The Yahoo settlement is closed. The eligibility check above confirms breach inclusion (helpful for any state-law follow-on analysis) and routes you to identity-theft monitoring resources.
claimscout is not the settlement administrator and is not a law firm. The Yahoo settlement is closed; what remains is risk management for exposed data.
claimscout is not affiliated with Yahoo, Verizon, the settlement administrator, the FTC, or any state attorney general's office. We provide informational matching only.
If you ever signed up for Yahoo Mail or Flickr, you're almost certainly in the class. The 2013 breach was every single Yahoo account in existence.
No. The claim filing deadline was July 20, 2020. New claims are no longer accepted under the $117.5M settlement.
If you had any Yahoo, Yahoo Mail, Flickr, or Tumblr account between 2012 and 2016, your account was almost certainly in the breach. Yahoo confirmed in 2017 that all 3 billion accounts were affected.
Names, email addresses, telephone numbers, dates of birth, hashed passwords, and encrypted or unencrypted security questions and answers. Some bank account and payment-card data was also exposed in certain account sets.
The data was exposed regardless of whether you continued using the account. If you reused the password or security-question answers elsewhere, the risk extends to those other accounts.
The DOJ indicted four individuals in March 2017, including two Russian FSB officers, for the 2014 breach. One co-conspirator was later sentenced in U.S. court.
Treat any password or security-question answer you used in your Yahoo era as compromised. Reset them on accounts where you reused them. Activate two-factor authentication where possible.
Yes, especially if you reused passwords or security questions. Stolen credentials are still actively traded; account-takeover attacks against accounts that share your old Yahoo credentials remain a live risk.
No. The original administrator (at yahoodatabreachsettlement.com) closed claims in 2020. claimscout is an informational matching service.
Nothing. We get paid by the law firms or affiliate fees from the court-appointed administrator. You pay zero up front and zero out of any payout you receive.
Only if you check the consent box. We give you the choice. If you do not consent, your claim is captured and we route it to the administrator directly without sharing your phone number.
Yes, always. If we route your claim to a law firm, you can choose to file directly with the same firm or pick a different one. We exist because most people throw the notice letter away. We make it not happen.
No. We are not a law firm and do not provide legal advice. We are a platform that captures your claim, qualifies it, and routes it to the court-appointed administrator or a law firm of your choice.