In the fall of 2016 Yahoo disclosed several major security breaches involving more than 1.5 billion user accounts. The results of these disclosures delayed the purchase by Verizon and reduced the Yahoo purchase price by at least $300 million. In June 2017 Yahoo shareholders agreed to the final sale to Verizon, nearly a year after the purchase was announced. What responsibility do firms have for the protection of customer data provided in the operation of their firm? Should Verizon have backed out of the deal with Yahoo given the scale and duration of the security issues brought to light in the fall of 2016?