10 Years After Yahoo Breach, What's Changed? (Not Much)

**Executive Summary:** This report recounts Yahoo's large-scale breaches (2013–2016), including an acknowledged 500 million‑account breach and later evidence of a 3 billion‑account compromise, highlighting nation-state and criminal access via phishing and cookie‑forging tools, weak encryption practices, password reuse, and failures in governance and disclosure that led to regulatory action and enduring industry lessons.