You might want to check your inbox. Yahoo will be paying some residents of the United States and Israel who had Yahoo Mail accounts between 2012 and 2016 as a part of a $117,500,000 class-action settlement.
In at least two massive data breaches, hackers compromised more than three billion private Yahoo accounts, including every single existing Yahoo account in 2013. If yours was one of those accounts, you may be able receive up to $358 in compensation.
But that depends on whether you currently subscribe to an identity-protection service, whether you spent time and money cleaning up an incident of identity theft resulting from the Yahoo data breaches, whether you had a paid Yahoo account, whether you resided in Israel during the qualification period and, most importantly, how many other people choose to participate in the settlement.
Yahoo is welcoming users to join the settlement until July 20, 2020. Here’s how to know if you qualify.
How to see if you qualify for Yahoo's settlement
If you are a U.S. or Israeli resident and had a Yahoo account between Jan. 1, 2012 and Dec. 31, 2016, Yahoo notified you about the breaches via email in 2016 or 2017. You had a Yahoo account if you used Yahoo Mail or had an account with Flickr, Tumblr, Yahoo Fantasy Sports or several other Yahoo-owned online services.
Residents of the United States or Israel who received such an email can inquire with the settlement administrator. Fill out the contact form to confirm that you’re eligible for payment.
MORE: What To Do After a Data Breach
How to file a claim for Yahoo's settlement
After knowing whether you’re eligible, you can fill out a claim form on this website.There are different form options for general-account holders, paid users, small-business users and Israeli users. Instructional videos are available for each in English, Spanish, Hebrew, Arabic and Russian. (The latter two languages are widely spoken in Israel.)
For many people, filling out the claim form will be generally straightforward. You’ll need to submit some personal information, as well as provide the name and activation dates of any identity-protection service you currently have, and whether you had a paid Yahoo account during the qualification period.
But for the maximum potential payout of $358, you'll have to submit a lot of paperwork.
Getting the full $358 won't be easy
Here's the catch. As with the Equifax data-breach settlement, the default method of Yahoo compensation is a period of credit monitoring and identity protection -- in this case, two years of such protection, provided by an unnamed company.
An exception applies to Israeli residents, who are not being offered credit monitoring and can ask for the cash directly instead.
In order to get cash instead of credit monitoring if you're a U.S. resident, you need to state that you already have such an identity-protection service, and give the name of the identity-protection provider as well as the date on which the service began and when it will end.
You do not need to have paid for the existing identity-protection service. For example, if you have been given an identity-protection subscription as compensation for a different company's data breach, that qualifies.
But if so, then you will get a maximum of only $100, provided there is enough money left in the compensation pot to go around. This is what most Israeli claim applicants will also get.
If you are a U.S. resident and you did pay for an identity-protection service, then the cost of the service may be covered by the "documentation of harm" section of the claim form.
Did a Yahoo data breach harm you? Prove it
To get the additional $258 (again, provided there's enough money left), you will need to both have had a paid Yahoo account during the five-year qualification period AND document the harm done to you. This applies to both U.S. and Israeli residents.
You will be entitled to refunds of 25% of any Yahoo subscription fees you paid, but you will need to fill out the paid-account claim form instead of the general-account one.
The biggest potential cash compensation comes from the "documentation of harm" part, which is the same on both the general-account and paid-account claim forms, but you'll have to work for it.
You will have to show that you incurred loss of personal expense or time as a result of cleaning up an identity-protection mess caused by one of the Yahoo data breaches.
You will need to document all that in the forms of receipts, bank statements, IRS letters, tax returns, phone bills, credit-card statements and so on -- and upload electronic versions of each document along with your online claim form.
So unless you have a lot of paperwork showing that you did spend a lot of time and money on a case of identity theft, you're probably better off going for the $100 -- if you already have identity protection or you are or were a resident of Israel.
Otherwise, you get only the identity protection that Yahoo provides, which is better than nothing, though perhaps not much more.
