Why Verizon Decided to Still Buy Yahoo After Big Data Breaches

Verizon Communications Inc. outbid several suitors to buy Yahoo Inc.'s struggling internet business last year. But the phone giant had to scramble to keep the deal from unraveling after Yahoo disclosed two massive data breaches.

The companies have agreed to revise the $4.83 billion deal, cutting as much as $350 million off the price and evenly splitting costs from the breaches, according to people familiar with the matter.

In late January, more than a month after Yahoo had disclosed its second breach, Verizon Chief Executive Lowell McAdam sat with two of his top lieutenants in the company's Basking Ridge, N.J., offices and weighed his options, according to people familiar with the matter.

Walk away from the deal, keep studying the impact of the breaches -- potentially pushing the deal's closure to the second half of the year -- or close the transaction now and move on.

There were still some things Verizon didn't know. User engagement with Yahoo had only declined slightly after the second breach, disclosed in December, but password resets were still under way, meaning more defections could occur, these people said.

A recent meeting between technical staff of the two companies revealed that some of Yahoo's systems were compromised and might be difficult to integrate with Verizon's AOL unit, the people added.

But Mr. McAdam still felt owning Yahoo made sense -- and further delay would prevent Verizon from getting going on its ambitious plans to take on Alphabet Inc.'s Google and Facebook Inc. in digital advertising. Verizon is looking for sources of growth as its core cellphone business matures and faces tough competition from rivals.

Mr. McAdam decided to proceed with the deal -- but Verizon would need a discount because of the uncertainty, the people said.

The next day, Mr. McAdam spoke with Yahoo director Thomas McInerney, who was amenable to the idea, the people said. Yahoo also wanted to move on. Selling Yahoo's internet business was a "gating item" for the remaining businesses' ability to do other, more lucrative things, such as selling stakes in Alibaba Group Holding Ltd. and Yahoo Japan Inc., another person familiar with the matter said.

Mr. McAdam and Mr. McInerney met in New York the following week and crafted the outlines of an agreement that the companies could announce as soon as Tuesday. In addition to a 50-50 split of future liabilities that may arise from the hacks, Yahoo would knock as much as $350 million off the original $4.83 billion price tag, according to people familiar with the matter.

It took about two weeks to hammer out the final sticking points. Yahoo shareholders still must vote to approve the transaction, which the companies hope will close in mid-April.

An investigation under way at the federal Securities and Exchange Commission about what Yahoo knew about the data breaches and when, and whether it properly informed investors, could slow that timeline. Before Yahoo can schedule a shareholder vote on the deal, it needs the SEC to approve its proxy statement.

As part of the revised agreement, Verizon will give up its right to sue over the idea that Yahoo had covered up the hacks, one of the people said. The entity selling Yahoo will retain liability for the SEC investigation and any shareholder lawsuits related to the deal itself. Verizon will split costs and liabilities related to any lawsuits from consumers or partners.

There are already several class actions that have arisen as a result of the disclosures. Earlier this month, two influential U.S. senators criticized Yahoo for dragging its feet when responding to questions about the hacks.

Tuesday's agreement ends the drawn-out finale for the once-mighty internet pioneer. At the height of the dot-com boom in early 2000, Yahoo's market capitalization was more than $125 billion. After years of strategic U-turns, a drawn-out auction of its core internet business and disclosure of the two largest known hacks, Yahoo's business is now worth just $4.48 billion

The first hack was revealed in September and occurred in 2014. It affected 500 million user accounts. Then, in December, Yahoo disclosed a hack that occurred in 2013 and impacted more than one billion user accounts. The stolen data included names, email addresses, dates of birth, telephone numbers and encrypted passwords, Yahoo has said.

In October, Verizon signaled it could consider the breaches material events that could allow it to change the deal terms.

Since then, Yahoo CEO Marissa Mayer and Verizon executives Marni Walden and Craig Silliman have held regular calls to discuss Yahoo's investigation, one of the people said. Tim Armstrong, who runs AOL, primarily stayed focused on the pending integration, the person added.

Verizon plans to fold Yahoo's digital advertising technology and portfolio of websites like Yahoo News, Sports and Finance into AOL, which Verizon acquired in 2015. Verizon plans to keep the Yahoo brand. The entity selling Yahoo will be renamed Altaba Inc. Ms. Mayer will step down from the board but it is unclear what role she will play after the transaction closes.

Verizon has a long way to go before it is truly relevant in digital advertising. In 2016, Yahoo and AOL combined controlled about 2% of global digital advertising revenue, compared with Google's 32% and Facebook's 13%, according to eMarketer.

--Deepa Seetharaman and Dana Cimilluca contributed to this article.

Write to Ryan Knutson at ryan.knutson@wsj.com