Summary

  • Yahoo's historical account breaches became a consumer-identity accountability test because account data stayed useful after the intrusions and the public disclosure record arrived years after the underlying compromise.
  • Who had practical control over breach detection, executive escalation, password and security-question protection, user notice timing, acquisition disclosure, regulatory evidence, and proof that remediation matched the scale of account exposure?
  • The accountability issue is that the time between compromise, internal knowledge, public disclosure, and enforceable repair can become part of the harm when account data remains useful to attackers.
  • Users, email account owners, advertisers, acquirers, regulators, investors, banks, and identity-risk teams needed evidence that notice timing, password resets, and governance changes addressed long-tail account risk.
  • The article treats SEC and DOJ materials as official enforcement and prosecution records, company and acquirer statements as public transaction evidence, and privacy/security frameworks as benchmarks for repair rather than proof of Yahoo's private logs.

Why this case belongs in a risk and accountability file

Yahoo made breach disclosure timing a consumer-identity accountability test because the public issue was not only that account data was stolen. The issue was that the public learned about massive historical compromises years after the underlying events, while account data, password hashes, security questions, email addresses, telephone numbers, dates of birth, and session-related mechanisms could remain useful to attackers, fraudsters, and identity-risk teams. The time gap became part of the harm. A breach that is disclosed late is not only a late press release.

It is a period during which users, counterparties, acquirers, and regulators may make decisions without the evidence they need.

The most important official public record is the SEC's 2018 order against Altaba, formerly Yahoo, at https://www.sec.gov/files/litigation/admin/2018/33-10485.pdf and the SEC press release at https://www.sec.gov/news/press-release/2018-71. Those documents are not a complete technical report on every Yahoo system. They are an enforcement record about disclosure controls, public filings, and how information about the 2014 breach was handled before Yahoo disclosed it publicly in 2016. That makes them central to the accountability question: not only what attackers did, but what the institution knew, escalated, investigated, and told users and investors.

The Department of Justice record at https://www.justice.gov/opa/pr/us-charges-russian-fsb-officers-and-their-criminal-conspirators-hacking-yahoo-and-millions places the 2014 compromise into a criminal-prosecution context. The DOJ allegations are not the same as a civil disclosure-control finding, and they do not answer every governance question inside Yahoo. They do show that the public record included alleged state-linked and criminal activity at extraordinary scale. When an account provider of Yahoo's size is compromised, the harm is not limited to one website. Email accounts can be password-reset hubs, archive repositories, advertising identities, contact lists, bank-notification addresses, and public-service access points.

The manifest question is direct: Who had practical control over breach detection, executive escalation, password and security-question protection, user notice timing, acquisition disclosure, regulatory evidence, and proof that remediation matched the scale of account exposure? The answer cannot be reduced to the attackers. Attackers caused the intrusion, but Yahoo controlled account-security architecture, logging, escalation, disclosure controls, user notification, transaction representations, and remediation evidence. The accountability file has to follow each of those controls separately.

A user account breach is not a one-day event

Account breaches have a long tail because account data can be reused long after a database is copied. A payment card can be replaced. A password can be reset. But a user's date of birth, old email address, recovery question, contact graph, and account history can keep value. Email accounts are especially sensitive because they often sit behind other accounts. A compromised email address can support phishing, password reset attacks, impersonation, and targeted intelligence gathering. That is why Yahoo's breach record is different from a narrow website incident.

The 2014 breach disclosed in 2016 and the 2013 breach later described as affecting all Yahoo accounts became accountability tests because scale altered the user burden. A single user cannot know whether a historical security question was exposed, whether an old password hash is still useful, whether a recovery email has been targeted, or whether a forged session mechanism affected their account. The provider has the logs, incident reports, authentication telemetry, and user-notice machinery. If the provider delays disclosure or gives generic repair advice, the user carries uncertainty without evidence.

Public reporting by Wired at https://www.wired.com/2016/09/yahoo-breach-500-million-accounts/ and KrebsOnSecurity at https://krebsonsecurity.com/2016/09/yahoo-says-500-million-accounts-stolen/ captured the initial 2016 public shock around the 500 million account disclosure. Those sources should be treated as chronology and context, not as access to all private forensic facts. Their value is that they show when users and the public began to receive actionable information, and how late that was compared with the 2014 intrusion timeline described in enforcement records.

The long-tail nature of account data changes the disclosure standard. If notice is delayed, the user cannot retroactively protect every linked account that trusted the Yahoo mailbox. A bank cannot retroactively treat an old Yahoo address as suspicious. An advertiser cannot retroactively model user-trust loss. An acquirer cannot negotiate from the same evidence position. Delay therefore becomes part of the incident mechanics. It is not merely a communications problem after the technical event is over.

Detection without escalation is not accountability

Many breach accounts focus on whether the company detected the intrusion. Yahoo's enforcement record shows why that question is not enough. Detection is useful only if it triggers investigation, escalation, user protection, and disclosure decisions. An organization may have security staff who identify serious evidence and still fail accountability if legal, executive, and disclosure systems do not convert that knowledge into action. The SEC order at https://www.sec.gov/files/litigation/admin/2018/33-10485.pdf is important because it treated disclosure controls and procedures as part of the incident record.

The accountability chain should be read in stages. First, security personnel identify evidence of compromise. Second, the evidence reaches people who can assess user harm and disclosure duties. Third, the organization investigates scope and uncertainty. Fourth, users receive practical protection steps. Fifth, investors and transaction counterparties receive material information when required. Sixth, later findings are reconciled with earlier public statements. If any stage fails, the technical breach becomes a governance failure.

This is not a demand for reckless disclosure before facts are known. Security incidents often begin with incomplete evidence. A company may need time to avoid tipping off attackers, preserve logs, coordinate with law enforcement, and determine scope. But uncertainty does not excuse silence indefinitely. An accountable process says what is known, what is not known, which user actions are prudent now, and when the public record will be updated. It also documents who made the decision to wait and what evidence supported that decision.

The NIST Cybersecurity Framework at https://www.nist.gov/cyberframework is useful here because it makes detection, response, and recovery part of one cycle. Detection is not an end state. It feeds response. The CIS Critical Security Controls at https://www.cisecurity.org/controls provide a similar vocabulary around inventory, account management, access control, logging, incident response, and service-provider governance. These frameworks do not prove Yahoo's private facts. They help define why a detected but undisclosed breach can remain an active user-risk problem.

Passwords and security questions are repair entities, not only stolen fields

When account data is exposed, the public often asks whether passwords were hashed. That matters, but it is not the only repair question. A password hash has a cost to crack, and that cost depends on the hashing algorithm, salting, password strength, attacker resources, and time. A security question may be worse than a weak password because it can be reused across services and may not be easily changed. A date of birth or telephone number may support social engineering. An email address may help attackers target the user elsewhere.

Yahoo's breach record included password and security-question questions at enormous scale. An accountable response should separate each repair entity. Password reset is one lane. Invalidating security questions is another. Blocking forged cookies or session mechanisms is another. Notifying users to review other accounts is another. Monitoring suspicious login attempts is another. The public should not accept a single phrase such as "we have taken steps to secure accounts" as a substitute for these lanes.

NIST digital-identity material at https://pages.nist.gov/800-63-3/ and the authenticator guidance at https://csrc.nist.gov/pubs/sp/800/63/b/upd2/final are relevant as control vocabulary. They do not retroactively decide Yahoo's legal obligations in 2013 or 2014. They show why secrets, authenticators, recovery mechanisms, and verifier controls need careful treatment. The MITRE ATT&CK Web Session Cookie page at https://attack.mitre.org/techniques/T1550/004/ also helps explain why session mechanisms can become authentication risk even when a user's password is not typed by the attacker.

Security questions deserve special attention because they are often treated as customer-service conveniences. They are actually durable identity claims. A user may have given the same childhood-school answer to many services. If that answer is exposed, changing the Yahoo password does not remove the answer from the user's life. A provider that exposes security-question data should explain whether questions and answers were encrypted, whether they were invalidated, whether users were required to choose new recovery methods, and whether the company reduced reliance on such questions in the future.

The repair standard is proportionality. A breach affecting hundreds of millions or billions of accounts requires more than one-time notice. It requires durable account-hardening evidence, changes to recovery design, suspicious-session invalidation, reset enforcement, and user education that distinguishes Yahoo account safety from cross-service identity risk.

Forged cookies made the timeline more than a password story

One of the most important details in the Yahoo record is that the incident history was not only about stolen database fields. Public company filings and enforcement records discussed forged cookies or session-related account access as part of Yahoo's security history. A forged cookie issue changes the accountability frame because it can allow account access without a normal password entry. That means a user who changes a password may not understand the full risk unless session tokens, cookies, and account-recovery paths are also invalidated and monitored.

The MITRE page on Web Session Cookie abuse at https://attack.mitre.org/techniques/T1550/004/ gives general terminology for why cookie theft or forgery can bypass ordinary authentication expectations. It does not prove the private details of Yahoo's systems. It helps readers understand why account remediation must include session invalidation and server-side controls, not only user-facing password changes.

This matters for disclosure timing. If an organization knows attackers have a method to access accounts through session mechanisms, delayed notice can leave users with a false sense of security. They may believe that a password change is enough when the repair also depends on server-side invalidation. The provider controls those server-side levers. Users cannot inspect them. Regulators and acquirers therefore need evidence that the provider identified the mechanism, disabled it, invalidated affected sessions, and monitored for residual abuse.

Accountability here is not about publishing exploit details. A provider should not disclose information that helps attackers. It can still say whether session tokens were invalidated, whether affected users were required to reauthenticate, whether suspicious access patterns were reviewed, whether recovery settings were checked, and whether future token-generation controls changed. That type of evidence helps users without revealing a blueprint.

The Yahoo case remains useful because it shows how account breaches can have multiple technical lanes. A stolen account database, weak or aging password protections, security questions, and forged sessions are different risks. If public notice compresses them into one account-breach label, the user cannot know which repair steps matter.

The Verizon transaction showed that cyber facts are deal facts

Yahoo's breach disclosures collided with the sale of Yahoo's operating business to Verizon. Verizon's February 2017 announcement at https://www.verizon.com/about/news/verizon-and-yahoo-amend-terms-definitive-agreement stated that the parties amended their agreement, including a reduction in the cash consideration. Verizon's completion announcement at https://www.verizon.com/about/news/verizon-completes-acquisition-yahoos-operating-business closed the transaction record. These sources matter because they show that breach disclosure timing did not only affect users and regulators. It affected acquisition economics and risk allocation.

The acquisition context is important for two reasons. First, it shows that cyber evidence can become price evidence. If a buyer learns late that a target company had massive undisclosed or newly disclosed breaches, the buyer must reassess liabilities, user trust, remediation costs, regulatory exposure, and integration risk. Second, it shows that disclosure controls have counterparties beyond public investors. A company negotiating a transaction has to know whether its cyber record is complete enough for the buyer's diligence and contractual assumptions.

Reuters reporting at https://www.reuters.com/article/us-yahoo-cyber-verizon-idUSKBN1601EK and public coverage at https://www.nytimes.com/2017/02/21/technology/verizon-yahoo-deal.html provide useful chronology for how the deal changed after the breach disclosures. These are not substitutes for the transaction agreements or private diligence files. They show the public understanding that the breach record had direct economic consequences.

The accountability question is not whether Verizon negotiated well or poorly. It is whether Yahoo's internal security and disclosure systems produced accurate evidence soon enough for a major corporate transaction. If a breach is known internally but not adequately escalated or disclosed, the acquisition price can reflect incomplete risk. If later facts emerge, the cost is allocated through renegotiation, indemnity, litigation, or regulatory action. That allocation is a public accountability signal because it shows that delayed breach evidence can change the value of a business.

The Yahoo case therefore belongs with corporate-governance incidents, not only privacy incidents. A consumer account system became a deal-risk system. The same facts mattered to users, acquirers, investors, regulators, and advertisers, but each audience needed a different evidence level.

Regulatory action turned delay into an enforceable record

The SEC action at https://www.sec.gov/news/press-release/2018-71 is central because it framed the case around the failure to disclose a massive breach to investors in a timely way. The order at https://www.sec.gov/files/litigation/admin/2018/33-10485.pdf is a formal public record, but it should be read carefully. It is not a complete criminal case and not a full security architecture review. It is a disclosure-control record: what Yahoo knew, what was not disclosed, and how public filings described risk.

The FTC record is also relevant. The FTC announcement at https://www.ftc.gov/news-events/news/press-releases/2018/10/ftc-finalizes-settlement-yahoo-alleged-privacy-security-failures describes a settlement over alleged privacy and security failures. That public source matters because account-security repair is a consumer-protection issue as well as a securities issue. Users needed timely notice, accurate claims, and meaningful account-protection steps.

International privacy regulators added another layer. The Office of the Privacy Commissioner of Canada's joint investigation report at https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2019/pipeda-2019-001/ addressed safeguards, accountability, and breach response in a cross-border context. The UK Information Commissioner's Office enforcement page at https://ico.org.uk/action-weve-taken/enforcement/yahoo-uk-services-limited/ is relevant as part of the public privacy-enforcement record. These sources matter because Yahoo accounts were global, while notification duties and privacy expectations varied by jurisdiction.

Regulatory action is not the same as user repair. A fine does not reset a password or restore trust. But enforcement creates a public evidence record that private users often cannot obtain. It can show failures in escalation, safeguards, disclosure controls, or notice practices. It can also force organizational commitments. The accountability question is whether those commitments changed the systems that produced delay: detection, executive escalation, legal review, disclosure controls, authentication design, and user-remediation evidence.

The Yahoo record shows why multi-jurisdictional breaches require clear evidence management. A global account platform cannot treat geography as an afterthought. Users in different countries may have different legal rights, but the technical exposure can be the same account system. Data sovereignty and locality matter because the provider must know where users are, which rules apply, and how to deliver timely notice across jurisdictions.

Public-sector continuity depends on private account providers

Yahoo was not only an advertising and consumer-web company. Its accounts were part of everyday identity infrastructure for many people. A Yahoo email address could be used to receive government notices, school communications, health reminders, banking alerts, court correspondence, job applications, and recovery links for other services. That is why the topic of public-sector continuity belongs in this article. A private mailbox can become a public-service dependency even if no government agency controls it.

When email account data is exposed, the harm may travel through services that trust the mailbox. A user may miss a warning because phishing volume rises. A fraudster may use old personal data to impersonate the user. A recovery process at another service may rely on the email account. A local public agency may have no way to know that the address it uses for a citizen is tied to a compromised platform. This is not Yahoo's sole responsibility, but Yahoo had practical control over the account-security evidence and user notice that other services lacked.

The DOJ record at https://www.justice.gov/opa/pr/us-charges-russian-fsb-officers-and-their-criminal-conspirators-hacking-yahoo-and-millions is relevant here because it describes alleged targeted account access and intelligence-linked conduct, not only generic spam risk. A breach at massive scale can support both broad criminal exploitation and focused targeting. Public-sector users, journalists, activists, employees, and ordinary citizens may experience different risk levels, but the provider's evidence file needs to account for both mass and targeted harm.

Public-sector continuity also changes the standard for recovery. Telling users to change passwords is necessary but incomplete when the mailbox is a dependency for other services. A stronger notice should tell users to check account recovery settings, review forwarding rules, inspect recent activity, reset security questions, update linked accounts, and be alert for targeted phishing. It should explain which risks are confirmed and which are plausible. It should not force users to infer all of that from a headline.

The Yahoo case therefore illustrates how consumer identity and public continuity meet. Private account providers have no general duty to run public services, but once their accounts become de facto identity channels, delayed disclosure can create public-facing harm. Regulators and boards should treat that dependency as part of the risk model.

User notice should be measured by actionability

User notice is not accountable merely because it exists. It must be timely, specific, and actionable enough to change user behavior. In a case involving account credentials, security questions, dates of birth, telephone numbers, email addresses, and possible session mechanisms, a notice should separate data categories and repair steps. It should say whether passwords are being reset, whether security questions are being invalidated, whether sessions are being revoked, whether account activity should be reviewed, whether linked accounts should be checked, and whether future updates are expected.

Reuters' September 2016 coverage at https://www.reuters.com/article/us-yahoo-cyber-idUSKCN11S16P and the New York Times coverage at https://www.nytimes.com/2016/09/23/technology/yahoo-hackers.html show the public moment when users were asked to understand the 2014 breach. Later reporting at https://www.nytimes.com/2017/10/03/technology/yahoo-hack-3-billion-users.html described the expansion of the 2013 breach understanding to all Yahoo accounts. The chronology matters because actionability decreases when the notice arrives long after the exposure. Users can still act, but some risk has already matured.

The settlement site at https://www.yahoodatabreachsettlement.com/ is part of the public redress record. Settlement administration does not prove every technical fact, but it shows that user harm and remediation became a formal claims process. A claims process is different from account repair. A user may receive compensation or services, but that does not answer whether recovery mechanisms, logging, session controls, and security questions were fixed quickly enough. Both lanes matter.

Actionable notice must also preserve uncertainty. If the company does not know whether a certain data type was accessed for every user, it should say so. If evidence changes later, it should update the record. Yahoo's later expansion of breach scope demonstrates why this matters. A notice that later becomes incomplete is not necessarily dishonest, but the company must explain how the understanding changed and what users should do differently.

The accountability measure is whether a reasonable user could act without being a security expert. If the user needs to understand hashed passwords, forged cookies, and recovery-question reuse alone, the notice has shifted too much burden outward.

Investors needed disclosure controls, not only security controls

The Yahoo case is a landmark because the SEC treated cyber disclosure as a securities-control issue. A company can have security controls and still fail if material security information does not reach disclosure decision-makers. Conversely, a disclosure team cannot make accurate public filings if security facts remain trapped in technical channels. The control boundary between security, legal, finance, and executive leadership is therefore part of the breach record.

The SEC press release at https://www.sec.gov/news/press-release/2018-71 emphasized the importance of public companies disclosing material cyber risks and incidents. The order at https://www.sec.gov/files/litigation/admin/2018/33-10485.pdf described failures in Yahoo's disclosure controls and procedures. For readers, the key lesson is that cyber incident response must include a path from technical evidence to materiality assessment. That path should be documented before a crisis, not invented afterward.

Disclosure controls should answer specific questions. Who receives reports of serious security incidents? Who decides whether users must be notified? Who decides whether investors must be told? Who decides whether a transaction counterparty must receive updated information? What evidence does each decision-maker need? How are unknowns recorded? How is later contradictory evidence reconciled with prior filings? If those questions have no owner, delay becomes likely.

This is not only a public-company issue. Private companies, nonprofits, public agencies, and acquisition targets all need some version of disclosure governance. The audience changes, but the problem remains: security facts must reach the people responsible for legal, contractual, user, and operational duties. A breach that is technically detected but institutionally undisclosed is still a failure of accountability.

The Yahoo case should therefore be taught as a disclosure-timeline case. The breach date, detection date, executive-knowledge date, public-notice date, transaction-disclosure date, and regulatory-action date all matter. A company that cannot reconstruct those dates cannot prove that it handled the incident responsibly.

What better evidence would look like

A stronger evidence design for a consumer account breach would keep six ledgers aligned. The first would be a detection ledger: intrusion indicators, affected systems, first-seen dates, confidence levels, and security-owner decisions. The second would be an escalation ledger: when security, legal, executive, board, disclosure, and transaction teams learned material facts. The third would be an account-risk ledger: data categories, password hashing status, security-question status, session-token issues, recovery settings, and account-activity indicators.

The fourth would be a user-remediation ledger: password resets, session invalidation, recovery-question invalidation, activity review prompts, linked-account guidance, and user-support load. The fifth would be a disclosure ledger: public notices, securities filings, acquirer updates, regulator notices, and facts still unknown. The sixth would be a verification ledger: post-remediation monitoring, recurrence checks, third-party assessments, and updates when scope changes.

Yahoo did not need to publish sensitive exploit detail to make such a structure useful. A company can say which categories were reviewed, which user actions were required, which sessions were invalidated, which recovery mechanisms changed, which dates governed disclosure decisions, and which facts remained uncertain. It can provide different levels of detail to users, regulators, acquirers, and investors while maintaining one consistent evidence chain.

The important point is that remediation must match scale. A breach affecting hundreds of millions or billions of accounts cannot be handled as ordinary support messaging. It requires account-system repair, public communication, customer-service capacity, fraud-risk guidance, jurisdictional notice management, and governance evidence. The repair file should be strong enough that users and regulators do not have to infer whether a password reset was the full answer.

The Yahoo case remains a warning because the delay itself became part of the public record. Even if later remediation is substantial, the time before notice cannot be recovered. Users cannot retroactively protect all linked accounts. Acquirers cannot retroactively bargain with full information. Investors cannot retroactively read risk factors that should have been incident disclosures. The best repair is therefore early evidence flow: from detection to escalation, from escalation to decision, and from decision to affected people.

The evidence boundary matters as much as the scale

The Yahoo breaches are often summarized by account counts. That shorthand is understandable because the numbers were extraordinary. It is also incomplete. Scale tells readers that the event was large, but it does not tell them what each affected person should do, what the company knew at each point, which control failed, or which later repair proved durable. A billion-account headline can obscure the smaller but more actionable evidence lanes: password hashing, security-question handling, forged-cookie controls, account-activity review, notification timing, and disclosure governance.

An accountable public record has to say what each source can prove. The SEC record proves a disclosure-control case and the agency's findings about what Yahoo failed to disclose to investors. DOJ materials prove that prosecutors brought charges and described alleged conduct by named actors. Verizon announcements prove public transaction amendments and completion. FTC and privacy-regulator records prove consumer-protection and privacy-enforcement positions. News reports prove public chronology and market context.

None of those sources gives readers the full internal security ticket history, complete board minutes, or every user-by-user remediation outcome.

That boundary is not a reason to avoid judgment. It is the basis for fair judgment. The public record is strong enough to say that delayed disclosure, weak escalation, and incomplete public evidence became part of the harm. It is not strong enough to reconstruct every private account session or to assign every later fraud attempt to Yahoo. The distinction matters because account-breach accountability can otherwise swing between two errors: treating the event as unknowable because private logs are missing, or treating public fragments as if they prove every downstream consequence.

The right standard is practical proof. Could Yahoo show when it knew material facts? Could it show who had authority to notify users? Could it show which account secrets were invalidated? Could it show whether users were required to reauthenticate? Could it show whether security questions were reset or retired? Could it show how the transaction counterparty was updated? Could it show which regulators received what information and when? Those questions do not require public disclosure of sensitive exploit detail. They require an evidence chain that users, regulators, acquirers, and investors can trust.

The case therefore remains relevant long after the Yahoo brand changed ownership. Modern account providers still hold recovery addresses, phone numbers, old passwords, backup questions, contact graphs, and session systems. If the evidence boundary is vague, the cost of uncertainty moves to users and counterparties. If the boundary is clear, people can act on confirmed facts while understanding what remains unresolved.

The disclosure-timeline lesson also applies to customer-support evidence. When a provider announces a large account breach, the support organization becomes part of the control system. It receives the questions that reveal whether public guidance is usable: users asking whether to change linked accounts, whether old recovery questions still matter, whether account activity logs can be trusted, whether a password reset is mandatory, and whether a notice applies to them. A mature breach record should capture those support signals and feed them back into remediation. If users misunderstand the notice, the notice is not complete.

If support cannot answer the difference between confirmed compromise and precautionary action, the organization has not translated technical evidence into user evidence. That feedback loop is especially important at Yahoo scale because even a small ambiguity becomes millions of user decisions.

Reader evidence file

The article uses the following public sources as a reading file for Yahoo 2013 and 2014 account breaches, delayed disclosure, account-security remediation, acquisition-price adjustment, enforcement record, and consumer-identity accountability. Each source is treated with boundaries: SEC and regulator materials provide official enforcement records, DOJ materials provide criminal-prosecution allegations, company and acquirer pages provide transaction evidence, news sources provide public chronology, and standards sources provide control vocabulary.

This evidence file is deliberately wider than a single breach notice because Yahoo's account-breach record involves technical compromise, user identity risk, delayed notice, transaction economics, securities disclosure, privacy enforcement, and long-tail account remediation. The public record has to support people who need practical action, managers who need a repair plan, acquirers who need deal evidence, and readers who need to know which claims remain uncertain.

Board review questions

A board review should ask whether account-breach evidence moves from security teams to disclosure decision-makers quickly enough. The review should identify the dates when security, legal, executive, board, investor-disclosure, and transaction teams learned material facts.

The review should ask whether account remediation matches the data categories exposed. Password resets, security-question invalidation, session revocation, recovery-setting review, linked-account guidance, and suspicious-activity monitoring should be separated rather than compressed into a generic account-security statement.

The review should ask whether global notice obligations are mapped before an incident. A global account provider should know which users, jurisdictions, regulators, and transaction counterparties need information when account data is exposed, and it should preserve evidence explaining the timing of each notice.

For this specific case, the board should answer the manifest question directly: Who had practical control over breach detection, executive escalation, password and security-question protection, user notice timing, acquisition disclosure, regulatory evidence, and proof that remediation matched the scale of account exposure? The answer should include dated evidence, named owners, affected audiences, jurisdictional boundaries, and the facts that remained unproven when the public record was made.