Appendix A

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 1 of 122
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3869236

This chart lists all statements alleged to be false or misleading in Plaintiffs’ Second Amended Complaint (the “SA

All information in this chart comes from either the SAC or the contents of documents cited in the SAC that are juAll emphasis and alternations in the statement text in this chart appear in the SAC. The last column, “Category(ies),” lists the category or categories assigned to the statement in Yahoo! Inc. and M

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

1 

Not Identified 4/30/2013 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 244 

Yahoo! takes your privacy seriously . . . We limit access to pewho we believe reasonably need to come into contact with th

in order to do their jobs. We have physical, electronic, and pr

regulations to protect personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

2 

Yahoo; Marissa Mayer 5/7/2013 

Risk Factor Section of Yahoo’s First Quarter 2013 Form 10-Q SAC ¶ 246 

If our security measures are breached, our products and servic

users and customers may curtail or stop using our products anlegal and financial exposure. Our products and services involve the storage and transmissio

personal and proprietary information in our facilities and on o

systems. Security breaches expose us to a risk of loss of this i

increased costs for security measures, loss of revenue, damagOur user data and corporate systems and security measures ha

due to the actions of outside parties (including cyber attacks), of these, or otherwise, allowing an unauthorized party to obtacustomers’ data. Additionally, outside parties may attempt to customers to disclose sensitive information in order to gain ac

data. Any breach or unauthorized access could result in significant remediation and other costs, damage to our reputation and a lproducts, services and networks that could potentially have an 

techniques used to obtain unauthorized access, disable or deg

frequently or may be designed to remain dormant until a preduntil launched against a target, we may be unable to anticipatpreventative measures. If an actual or perceived breach of our effectiveness of our security measures could be harmed and w

3 

Yahoo; Marissa Mayer 8/8/2013 

Risk Factor Section of Yahoo’s Second Quarter 2013 Form 10-Q SAC ¶ 249 (Same as Statement #2) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

41 Ron Bell 9/6/2013 

Yahoo’s Website SAC ¶ 252 At Yahoo, we take the privacy of our users seriously. 

5 

Jeffrey Bonforte (SVP Commc’n Products) 10/14/2013 

Yahoo’s Website 

SAC ¶ 254-

255 

At Yahoo, we take the security of our users very seriously. In 

we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets 

that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

6 

Yahoo; Marissa Mayer 11/12/2013 

Risk Factor Section of Yahoo’s Third Quarter 2013 Form 10-Q SAC ¶ 257 (Same as Statement # 2) 

1 A complete copy of the referenced statement is attached as Exhibit 1 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website SAC ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure b

Layer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we 

We appreciate, and certainly do not take for granted, the trust 

8 

Marissa Mayer 11/18/2013 

Tumblr Post / Twitter Post SAC ¶ 262 Yahoo’s commitment to securing and encrypting (...) users’ d

9 

Jeffrey Bonforte 1/7/2014 

Yahoo’s Website SAC ¶ 264 

Yahoo is fully committed to keeping our users safe and securwe are now automatically encrypting all connections between Yahoo Mail - whether it’s on the web, mobile web, mobile apencrypted by default and protected with 2,048 bit certificates. 

attachments, contacts, as well as Calendar and Messenger in MSecurity is a key focus for us and we’ll continue to enhance o

can provide a safe and secure experience for our users. 

10 

Marissa Mayer 1/28/2014 

Yahoo’s Fourth Quarter 2013 Earnings Call SAC ¶ 266 

in the beginning of January, Yahoo! Mail turned on SSL secuprotocol applies to ads as well, effectively making us the largdisplay advertising. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

11 

Yahoo; Marissa Mayer 2/28/2014 

Risk Factor Section of Yahoo’s Fiscal Year 2013 Form 10-K SAC ¶ 268 

If our security measures are breached, our products and servic

users and customers may curtail or stop using our products anlegal and financial exposure. Our products and services involve the storage and transmissioand proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatio

costs for security measures, loss of revenue, damage to our rebreaches or unauthorized access have resulted in and may in tsignificant legal and financial exposure, increased remediatio

and a loss of confidence in the security of our products, servic

effect on our business. We take steps to prevent unauthorized because the techniques used to obtain unauthorized access, dichange frequently or may be designed to remain dormant untianticipate these techniques or implement adequate preventativ

of our security occurs, the market perception of the effectivenharmed and we could lose users and customers. 

122 Ron Bell 3/14/2014 

Silicon Valley Business Journal SAC ¶ 271 

I have a real sense, and everyone in the legal department thinkWe have to stand up for them, because if we don’t, nobody el

2 A complete copy of the referenced article is attached as Exhibit 2 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

13 

Alex Stamos 4/2/2014 

Yahoo’s Website SAC ¶ 274 

When I joined Yahoo four weeks ago, we were in the middle their data through the deployment of encryption technologies Tumblr. So today, we’re updating you on our progress: Traffic moving between Yahoo data centers is fully encrypted In January, we made Yahoo Mail more secure by making bromonth, we enabled encryption of mail between our servers anSMTPTLS standard. The Yahoo Homepage and all search queries that run on the Yalso have HTTPS encryption enabled by default. We implemented the latest in security best-practices, includinSecrecy and a 2048-bit RSA key for many of our global propMagazines. We are currently working to bring all Yahoo sites 

14 

Alex Stamos 4/2/2014 

Yahoo’s Website SAC ¶ 275 

Hundreds of Yahoos have been working around the clock ovesecure experience for our users and we want to do even more 

entire platform for all users at all time, by default. One of our biggest areas of focus in the coming months is to wpartners across all of Yahoo’s hundreds of global properties tour network is secure. Our broader mission is to not only makthe overall web ecosystem. In addition to moving all of our properties to encryption by de

security measures such as HSTS, Perfect Forward Secrecy an

months. This isn’t a project where we’ll ever check a box and and their data is an ongoing and critical effort. We will contintechnology to combat attacks and surveillance that violate our 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

153

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website SAC ¶ 277 

The world has changed. So while email is an essential tool fo

focus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

16 

Marissa Mayer 4/15/2014 

Yahoo’s First Quarter 2014 Earnings Call SAC ¶ 279 

Alex Stamos joined Yahoo! as VP of Information Security. Aexperience to Yahoo! and will be on the front line of continui

as possible. He will be furthering our significant security effoas a preferred option across our offerings. 

3 A complete copy of the referenced article is attached as Exhibit 3 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

17 

Yahoo; Marissa Mayer 5/8/2014 

Risk Factor Section of Yahoo’s First Quarter 2014 Form 10-Q SAC ¶ 281 (Same as Statement # 11) 

18 

Alex Stamos 5/15/2014 

Yahoo’s Website SAC ¶ 284 

The Senate Homeland Security and Government Affairs Permhosted a hearing earlier today to examine consumer security aindustry. I testified along with representatives from Google anYahoo’s dedication to protecting our users and you can dow

down to “Panel One”). This hearing gave us the opportunity to discuss the user-first build and maintain user trust by providing secure product ex

globe. Because we never take the relationship we’ve cultivatpeople each month trust us to provide them with Internet serI outlined specific ways we protect our users, including: our 

pipeline; our leadership in the fight on email spam; the bug 

efforts to fully encrypt 100 percent of our network traffic.Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to help protect thsecurity as a partnership - we want to educate our users to be provide intuitive, user-friendly tools and security resources to 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

19 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations SAC ¶ 285 

One reason I joined Yahoo is that from the top down, the comand maintaining trust through secure products is a critical focshould be secure for all of our users across the globe. Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to protect their i

partnership; we want to educate our users to be mindful of theintuitive, user-friendly tools and security resources to help the

Malware is an important issue that is a top priority for Yahooadvertising is one part of the equation, it’s important to addre

at each phase of its lifecycle. It is also important to address seI outline in my testimony below several specific ways Yahoo users, including: focusing on security in the advertising pipeliemail spam; operating a bug bounty program; and working to network traffic. 

20 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations SAC ¶ 286 

We successfully block the vast majority of malicious or decepattack our network, and we always strive to defeat those who This means we regularly improve our systems, including contand testing systems to better emulate different user behaviorsad network is inspected using this system, both when they are Yahoo also strives to keep deceptive advertisements from eveprohibit advertisements that look like operating system messaor try to trick users into downloading and installing malicious deceptive advertising once required extensive human interven

inconsistent enforcement. Although no system is perfect, we n

image recognition algorithms to catch deceptive advertisemenThis lets us train our systems about the characteristics of dece

so we detect and respond to them immediately. We are also thstandard. The SafeFrame mechanism allows ads to properly duser’s private information to the advertiser or network. Thankenhances user privacy and security not only in the thriving mYahoo, but around the Internet. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

21 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations SAC ¶ 287 

While preventing the placement of malicious advertisements battle. We also fight the rest of the malware lifecycle by impremail and by reducing financial incentives to spread malware

malicious actors make money, and Yahoo is leading the fight 

example, one way spammers act is through “email spoofing”. 

require that a sender use an accurate “From:” line in an email

messages a day that feign to be from friends, family members 

much more likely to bypass spam filters, as they appear to be 

can also be used to trick users into giving up usernames and p

“phishing”. Yahoo is helping the Internet industry tackle these issues. YahIdentified Mail or DKIM, a mechanism that lets mail recipienemail. Yahoo freely contributed the intellectual property behi

protects billions of emails between thousands of domains. Bu

a coalition of Internet companies, financial institutions and anMessage Authentication, Reporting and Conformance or DM

domains a way to tell the rest of the Internet what security me

and what actions the sender would like to be taken on spoofed 

In April of this year, Yahoo became the first major email provpolicy. In essence, we asked the rest of the Internet to drop myahoo.com users. Since Yahoo made this change another maj

hope that every major email provider will follow our lead and 

against spoofed email. DMARC has reduced spam purported 90%. If used broadly, it would target spammers’ financial inc

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

11 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

224

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations SAC ¶ 288 

Yahoo invests heavily to ensure the security of our users and 

January, we made encrypted browsing the default for Yahoo Mand international traffic moving between Yahoo’s data center

4 A complete copy of the referenced written testimony is attached as Exhibit 4 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

12 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

235 Ron Bell 6/5/2014 

Yahoo’s Website SAC ¶ 290 

Here’s a look at how we’ve had our users’ back when it come

Encryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Messwork with our thousands of partners to make sure that data ru

24 

Alex Stamos 7/25/2014 

Yahoo’s Website SAC ¶ 292 

The security of our users is a huge focus for us at Yahoo. Weour platform, encouraging our partners to ensure that any data improving the security of the overall web ecosystem. 

25 

Yahoo; Marissa Mayer 8/7/2014 

Risk Factor Section of Yahoo’s Second Quarter 2014 Form 10-Q SAC ¶ 294 (Same as Statement No. 11) 

5 A complete copy of the referenced article is attached as Exhibit 5 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

13 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

266

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference SAC ¶ 297 

Yahoo pointed out how the Company combats security bugs:  Detailed descriptions and mitigation instructions  Accurate prioritization  Consistent follow-up and real-time reporting  Executive visibility  Convincing company that you are a madman 

27 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference SAC ¶ 298 

something that works really well for [Yahoo] is that the leadedashboard to see how many bugs are handing over them and o

287 Ron Bell 9/11/2014 

Yahoo’s Website SAC ¶ 300 Users come first at Yahoo . . . We are also committed to prote

6 A complete copy of the referenced presentation is attached as Exhibit 6 to the Lobdell Declaration. 7 A complete copy of the referenced article is attached as Exhibit 7 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

14 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

29 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 302 

Yahoo! takes your privacy seriously . . . We limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

30 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 303 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you’ve requ

under the following circumstances: We provide the information to trusted partners who work on b

agreements. These companies may use your personal informa

about offers from Yahoo and our marketing partners. Howeveindependent right to share this information. We have a parent’s permission to share the information if the We respond to subpoenas, court orders, or legal process (such enforcement requests), or to establish or exercise our legal rigWe believe it is necessary to share information in order to inv

illegal activities, suspected fraud, situations involving potenti

person, violations of Yahoo’s terms of use, or as otherwise reWe transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

15 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

31 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 304 

Updated to include data collection practices-Data Storage and 

In addition to the other purposes for which we collect informato search) (such as ad views, ad clicks, page views and page corder to power innovative product development, provide pers

able our security systems to detect and defend against fraudulQ: What is Yahoo’s updated user log data retention policy? A: Yahoo’s new policy will be able to de-identify search log limited exceptions to meet legal obligations. For other, non-seretained for a longer period in order to power innovative prod

experiences, and better enable our security systems to detect a

32 

Alex Stamos 10/6/2014 

Yahoo’s Website SAC ¶ 306 

[the company] remains committed to providing the most secuworldwide. 

33 

Yahoo; Marissa Mayer 11/7/2014 

Risk Factor Section of Yahoo’s Third Quarter 2014 Form 10-Q SAC ¶ 308 (Same as Statement # 11) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

16 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website SAC ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

35 

Yahoo; Marissa Mayer 2/27/2015 

Risk Factor Section of Yahoo’s Fiscal Year 2014 Form 10-K SAC ¶ 313 

If our security measures are breached, our products and ser

users and customers may curtail or stop using our products 

legal and financial exposure. Our products and services involve the storage and transmissio

and proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatio

costs for security measures, loss of revenue, damage to our reparties may attempt to fraudulently induce employees, users, information to gain access to our data or our users’ or customapplications we procure from third parties may contain defect

that could unexpectedly compromise network and data securi

have resulted in and may in the future result in a combination increased remediation and other costs, damage to our reputatiour products, services and networks that could have an advers

prevent unauthorized access to our corporate systems, howev

unauthorized access, disable or degrade service, or sabotage sdesigned to remain dormant until a triggering event, we may implement adequate preventative measures. If an actual or pemarket perception of the effectiveness of our security measurand customers. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

17 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

36 

Marissa Mayer 3/6/2015 

Panel at World Economic Forum SAC ¶ 316 

Q: Given Snowden and also the counterterrorism problem at tmore questioning about your storage of say emails, in other won what we might call the trust index...? Mayer: . . . [T]he first thing that happened when [] we heard a

the way that we store data, we changed the way that we comm

connections on all of the, Yahoo’s major properties https, we the data centers to basically get a more secure environment fowhat they wanted. So we changed all of those things in responQ: And what was the impact on trust? Mayer: We didn’t have a measurement necessarily before, bupeople’s trust and their confidence in the service has rebound

that we’re using more secure protocols to communicate and to * * * I would just make the observation that protection and trust rea

privacy, but there is a tension between those two. * * * Mayer: ...whether or not they’re coming through the official data and so we can do what we can do in order to protect our methods and the like . . . . 

37 

Alex Stamos 3/15/2015 

Yahoo’s Website SAC ¶ 318 

At Yahoo, we’re committed to protecting our users’ security. updates on our latest security innovation: an end-to-end (e2e) Just a few years ago, e2e encryption was not widely discussedare much more conscious of the need to stay secure online. Thencryption, ranging from the straightforward (sharing tax formlife-threatening (emailing in a country that does not respect frthe spectrum, we’ve heard you loud and clear: We’re building user experience and overall digital ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

18 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

38 

Not Identified8 3/26/2015 

Yahoo’s Website SAC ¶ 320 

Our Users First Approach in Action Protecting Users . . . We’ve encrypted many of our most important products and se

governments or other actors. This includes: Encryption of the traffic moving between Yahoo data centersMaking browsing over HTTPS the default on Yahoo Mail and Implementing the latest in security best-practices, including s

and a 2048-bit RSA key for many of our global properties sucMagazines; and We’ve also rolled out an end-to-end (e2e) encryption extensio

We are committed to the security of this solution and oppose other cryptographic system. We are committed to notifying users when we strongly suspesponsored attack. 

39 Ron Bell9 3/26/2015 

Yahoo’s Website SAC ¶ 322 

At Yahoo, users always come first . . . As we note in our transparency report, we’ve encrypted many 

to protect against unauthorized access by governments or othend (e2e) encryption extension for Yahoo Mail, now availabl

8 A complete copy of the referenced article is attached as Exhibit 8 to the Lobdell Declaration. 9 A complete copy of the referenced article is attached as Exhibit 9 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

19 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

40 

Sean Zadig (Senior Manager, Yahoo ECrime Investg’ns 5/4/2015 

Yahoo’s Website SAC ¶ 324 

Good governance and Users First: We adhere to the laws of thof Service, and our Privacy Policy. We encrypt our products 

41 

Yahoo; Marissa Mayer 5/7/2015 

Risk Factor Section of Yahoo’s First Quarter 2015 Form 10-Q SAC ¶ 326 (Same as Statement #35) 

42 

Marissa Mayer 7/22/2015 

Yahoo’s First Quarter 2014 Earnings Call SAC ¶ 329 we continue to protect our mail users with new investments in 

43 

Yahoo; Marissa Mayer 8/7/2015 

Risk Factor Section of Yahoo’s Second Quarter 2015 Form 10-Q SAC ¶ 331 (Same as Statement #35) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

20 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

4410

Daryl Low (Tech Yahoo, Architect) 9/17/2015 

Yahoo’s Website SAC ¶ 334 

At Yahoo, we’re committed to protecting our users’ security, HTTPS across the board . . . Since we first began deploying encryption technologies acros

of our partners across all of Yahoo’s hundreds of global properunning on our network is secure. This continues to be an areposition to move the needle by encouraging our broad array o

45 

Marissa Mayer 10/20/2015 

October 20, 2015 earnings call transcript SAC ¶ 336 

Just last week, we launched the new Yahoo! Mail mobile appIn addition to focusing on back end improvements to improve 

the design, making Mail more beautiful and intuitive. We inteasier for users to access their other e-mail accounts directly fleading step towards a password-free future with the announcpushes notifications to your phone to provide a fast, convenieaccounts without having to memorize a password. This also musers’ accounts going forward. 

46 

Not Identified 10/26/2015 Press Release 

SAC ¶ 338-

339 

Yahoo! Inc. (NASDAQ:YHOO) announced today that Bob LInformation Security Officer (CISO) . . . Yahoo is committed maintaining their users’ trust. Yahoo offers users encrypted pplugin on GitHub for Yahoo Mail, offers two-factor authentic

Key, which allows users a fast and secure way to access their *** “ Lord will lead Yahoo’s security team -- known as the Paran

of the Company’s more than one billion users around the worLord will work closely across all of the Company’s teams and that Yahoo continues to provide the highest level of security p

10 A complete copy of the referenced article is attached as Exhibit 10 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

21 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

47 

Marissa Mayer 10/26/2015 Twitter SAC ¶ 340 Tweet linking to 10/26/2015 press release (Statement No. 46) 

48 

Yahoo; Marissa Mayer 11/5/2015 

Risk Factor Section of Yahoo’s Third Quarter 2015 Form 10-Q SAC ¶ 342 (Same as Statement # 35) 

49 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 345 

As always, Yahoo is committed to gaining your trust. Yahoo access to personal information about you to employees who wcontact with that information to provide product or services to We have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

22 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

50 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 346 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you’ve requ

under the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yocommunicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent’s permission to share the information if 

Children’s Privacy & Family Accounts for more informat

under 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo’s terms of use, or as o

We transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

23 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

51 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 347 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...). On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don’t have to remember passwords anymore. (...). Secure Storage. We deploy industry standard physical, technwith relevant regulations to protect your personal informationVendors and Partners. To protect the security and privacy of information to partners and vendors who work on our behalf 

These companies do not have any independent right to use or Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

24 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

52 

Yahoo; Marissa Mayer 2/29/2016 

Risk Factor Section of Yahoo’s Fiscal Year 2014 Form 10-K SAC ¶ 349 

If our security measures are breached, our products and ser

users and customers may curtail or stop using our products 

legal and financial exposure. Our products and services involve the storage and transmissio

and proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatio

costs for security measures, loss of revenue, damage to our reparties may attempt to fraudulently induce employees, users, information to gain access to our data or our users’ or customapplications we procure from third parties may contain defect

that could unexpectedly compromise network and data securiour distribution partners, service providers and vendors, and ainformation provided by us or by our users through applicatioparties fail to adopt or adhere to adequate data security practi

networks, our data or our users’ data may be improperly acce

unauthorized access have resulted in and may in the future refinancial exposure, increased remediation and other costs, damconfidence in the security of our products, services and netwo

business. We take steps to prevent unauthorized access to our techniques used to obtain unauthorized access, disable or degfrequently or may be designed to remain dormant until a triggthese techniques or implement adequate preventative measure

security occurs, the market perception of the effectiveness of we could lose users and customers. 

53 Ron Bell11 3/3/2016 

Yahoo’s Website SAC ¶ 352 

 [m]ore than 1 billion users entrust their personal information relationships over more than 20 years in the business. . . the sparamount importance to them and to [the] company. 

11 A complete copy of the referenced article is attached as Exhibit 11 to the Lobdell Declaration. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

25 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

54 

Binu Ramakrishnan (Security Engineer, Yahoo Mail) 3/22/2016 

Yahoo’s Website SAC ¶ 354 

At Yahoo, our users send and receive billions of emails everyuse, personalized, and secure for our hundreds of millions of efforts to protect our users’ data, our security team recently coquality of SMTP STARTTLS deployments. We found that wwidespread, the growth has slowed in recent years. Providers settings compared to others, and we believe there is an imporSTARTTLS deployments to protect messages – and therefore

55 

Yahoo; Marissa Mayer 5/10/2016 

Risk Factor Section of Yahoo’s First Quarter 2016 Form 10-Q SAC ¶ 356 (Same as Statement #51) 

5612

Yahoo; Marissa Mayer 7/25/2016 

Stock Purchase Agreement between Yahoo and Verizon SAC ¶ 359 

[A]ny incidents of, or third party claims alleging, (i) Security unauthorized use of any of Seller’s or the Business Subsidiariloss, theft, unauthorized access or acquisition, modification, dPersonal Data in Seller’s or the Business Subsidiaries’ possesSeller or the Business Subsidiaries (or provided to Seller or th

in seller’s or the Business Subsidiaries’ possession, in each ca

expected to have a Business Material Adverse Effect. Neither notified in writing, or to the Knowledge of Seller, been requirAuthority to notify in writing, any Person of any Security Bre

Seller nor the Business Subsidiaries have received any notice investigations by a Governmental Authority), or alleged violapossessed by Seller or the Business Subsidiaries, in each case Business Material Adverse Effect. 

12 A complete copy of Yahoo’s July 25, 2016 Form 8-K filing that included a copy of the Stock Purchase Agreement is attached as Exhibit 12 to 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

26 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

57 

Yahoo; Marissa Mayer 8/8/2016 

Risk Factor Section of Yahoo’s Second Quarter 2016 Form 10-Q SAC ¶ 361 (Same as Statement #51) 

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

27 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

59 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 365 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you’ve requ

under the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yocommunicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent’s permission to share the information if 

Children’s Privacy & Family Accounts for more informat

under 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo’s terms of use, or as o

We transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

28 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

60 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website SAC ¶ 366 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...) On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don’t have to remember passwords anymore. (...) Secure Storage. We deploy industry standard physical, technwith relevant regulations to protect your personal informationVendors and Partners. To protect the security and privacy of information to partners and vendors who work on our behalf These companies do not have any independent right to use or Access to Information. We limit access to personal informati

reasonably believe need to come into contact with that inform

or in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. (...) Please note that no data transmission over the Internet or infoguaranteed to be 100% secure. We continue to evaluate and imtechnology and practices. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Chart of Statements Alleged to be False or Misleading in the Second A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

29 

sf-3869236

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

6113

Yahoo; Marissa Mayer 9/9/2016 

Stock Purchase Agreement, as attached to Proxy Statement SAC ¶ 368 

[T]here have not been any incidents of, or third party claims aaccess or unauthorized use of any of Seller’s or the Business or (ii) loss, theft, unauthorized access or acquisition, modifica

of any Personal Data in Seller’s or the Business Subsidiaries’ 

by Seller or the Business Subsidiaries (or provided to Seller ocustomers) in Seller’s or the Business Subsidiaries’ possessioreasonably be expected to have a Business Material Adverse Subsidiaries have notified in writing, or to the Knowledge of 

Governmental Authority to notify in writing, any Person of anSeller, neither Seller nor the Business Subsidiaries have recei

(including investigations by a Governmental Authority), or alPersonal Data possessed by Seller or the Business Subsidiarieexpected to have a Business Material Adverse Effect. 

62 Yahoo 9/22/2016 Press Release 

SAC ¶¶ 

185, 371 

A recent investigation by Yahoo! Inc. has confirmed that a costolen from the company’s network in late 2014 by what it beinformation may have included names, email addresses, telep

passwords (the vast majority with bcrypt) and, in some cases, 

and answers. The ongoing investigation suggests that stolen ipasswords, payment card data, or bank account information; p

information are not stored in the system that the investigation ongoing investigation, Yahoo believes that information assoc

was stolen and the investigation has found no evidence that thYahoo’s network. Yahoo is working closely with law enforce

13 A true and correct copy of excerpts from Yahoo’s September 9, 2016 Preliminary Proxy Statement is attached as Exhibit 13 to the Lobdell De

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 31 of 122
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

1 

Not Identified 4/30/2013 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 2446 

Yahoo! takes your privacy seriously . . . We limit access to pewho we believe reasonably need to come into contact with thin order to do their jobs. We have physical, electronic, and prregulations to protect personal information about you. 

4 Ron Bell 9/6/2013 

Yahoo’s Website ¶ 252 At Yahoo, we take the privacy of our users seriously. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

5 

Jeffrey Bonforte (SVP Commc'n Products) 10/14/2013 

Yahoo’s Website ¶¶ 254-557 

At Yahoo, we take the security of our users very seriously. In 

we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets 

that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure bLayer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we We appreciate, and certainly do not take for granted, the trust 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

8 

Marissa Mayer 11/18/2013 

Tumblr Post / Twitter Post ¶ 262 Yahoo’s commitment to securing and encrypting (...) users’ d

9 

Jeffrey Bonforte 1/7/2014 

Yahoo’s Website ¶ 264 

Yahoo is fully committed to keeping our users safe and secur

we are now automatically encrypting all connections between 

Yahoo Mail - whether it’s on the web, mobile web, mobile apencrypted by default and protected with 2,048 bit certificates. 

attachments, contacts, as well as Calendar and Messenger in MSecurity is a key focus for us and we’ll continue to enhance o

can provide a safe and secure experience for our users. 

13 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 274 

When I joined Yahoo four weeks ago, we were in the middle their data through the deployment of encryption technologies Tumblr. So today, we’re updating you on our progress: Traffic moving between Yahoo data centers is fully encrypted 

In January, we made Yahoo Mail more secure by making bromonth, we enabled encryption of mail between our servers anSMTPTLS standard. The Yahoo Homepage and all search queries that run on the Y

also have HTTPS encryption enabled by default. We implemented the latest in security best-practices, includin

Secrecy and a 2048-bit RSA key for many of our global propMagazines. We are currently working to bring all Yahoo sites 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

14 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 275 

Hundreds of Yahoos have been working around the clock ove

secure experience for our users and we want to do even more 

entire platform for all users at all time, by default. One of our biggest areas of focus in the coming months is to wpartners across all of Yahoo’s hundreds of global properties tour network is secure. Our broader mission is to not only makthe overall web ecosystem. In addition to moving all of our properties to encryption by de

security measures such as HSTS, Perfect Forward Secrecy anmonths. This isn’t a project where we’ll ever check a box and 

and their data is an ongoing and critical effort. We will contintechnology to combat attacks and surveillance that violate our 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 277 

The world has changed. So while email is an essential tool fofocus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

16 

Marissa Mayer 4/15/2014 

Yahoo’s First Quarter 2014 Earnings Call ¶ 279 

Alex Stamos joined Yahoo! as VP of Information Security. A

experience to Yahoo! and will be on the front line of continui

as possible. He will be furthering our significant security effoas a preferred option across our offerings. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

18 

Alex Stamos 5/15/2014 

Yahoo’s Website ¶ 284 

The Senate Homeland Security and Government Affairs Permhosted a hearing earlier today to examine consumer security a

industry. I testified along with representatives from Google anYahoo’s dedication to protecting our users and you can dow

down to “Panel One”). This hearing gave us the opportunity to discuss the user-first build and maintain user trust by providing secure product exglobe. Because we never take the relationship we’ve cultivatpeople each month trust us to provide them with Internet ser

I outlined specific ways we protect our users, including: our 

pipeline; our leadership in the fight on email spam; the bug efforts to fully encrypt 100 percent of our network traffic.Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to help protect th

security as a partnership - we want to educate our users to be 

provide intuitive, user-friendly tools and security resources to 

19 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 285 

One reason I joined Yahoo is that from the top down, the comand maintaining trust through secure products is a critical focshould be secure for all of our users across the globe. Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to protect their ipartnership; we want to educate our users to be mindful of theintuitive, user-friendly tools and security resources to help theMalware is an important issue that is a top priority for Yahooadvertising is one part of the equation, it’s important to addreat each phase of its lifecycle. It is also important to address seI outline in my testimony below several specific ways Yahoo users, including: focusing on security in the advertising pipeliemail spam; operating a bug bounty program; and working to network traffic. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

20 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 286 

We successfully block the vast majority of malicious or decepattack our network, and we always strive to defeat those who This means we regularly improve our systems, including contand testing systems to better emulate different user behaviorsad network is inspected using this system, both when they are 

Yahoo also strives to keep deceptive advertisements from eveprohibit advertisements that look like operating system messaor try to trick users into downloading and installing malicious deceptive advertising once required extensive human interven

inconsistent enforcement. Although no system is perfect, we n

image recognition algorithms to catch deceptive advertisemenThis lets us train our systems about the characteristics of dece

so we detect and respond to them immediately. We are also thstandard. The SafeFrame mechanism allows ads to properly duser’s private information to the advertiser or network. Thankenhances user privacy and security not only in the thriving mYahoo, but around the Internet. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

21 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 287 

While preventing the placement of malicious advertisements battle. We also fight the rest of the malware lifecycle by impr

email and by reducing financial incentives to spread malware

malicious actors make money, and Yahoo is leading the fight example, one way spammers act is through “email spoofing”. require that a sender use an accurate “From:” line in an emailmessages a day that feign to be from friends, family members much more likely to bypass spam filters, as they appear to be 

can also be used to trick users into giving up usernames and p

“phishing”. Yahoo is helping the Internet industry tackle these issues. YahIdentified Mail or DKIM, a mechanism that lets mail recipienemail. Yahoo freely contributed the intellectual property behiprotects billions of emails between thousands of domains. Bua coalition of Internet companies, financial institutions and anMessage Authentication, Reporting and Conformance or DM

domains a way to tell the rest of the Internet what security me

and what actions the sender would like to be taken on spoofed 

In April of this year, Yahoo became the first major email prov

policy. In essence, we asked the rest of the Internet to drop myahoo.com users. Since Yahoo made this change another majhope that every major email provider will follow our lead and 

against spoofed email. DMARC has reduced spam purported 

90%. If used broadly, it would target spammers’ financial inc

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

22 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 288 

Yahoo invests heavily to ensure the security of our users and January, we made encrypted browsing the default for Yahoo Mand international traffic moving between Yahoo’s data center

23 Ron Bell 6/5/2014 

Yahoo’s Website ¶ 290 

Here’s a look at how we’ve had our users’ back when it come

Encryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Messwork with our thousands of partners to make sure that data ru

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

24 

Alex Stamos 7/25/2014 

Yahoo’s Website ¶ 292 

The security of our users is a huge focus for us at Yahoo. Weour platform, encouraging our partners to ensure that any data improving the security of the overall web ecosystem. 

26 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 297 

Yahoo pointed out how the Company combats security bugs:  Detailed descriptions and mitigation instructions 

 Accurate prioritization  Consistent follow-up and real-time reporting  Executive visibility  Convincing company that you are a madman 

27 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 298 

something that works really well for [Yahoo] is that the leadedashboard to see how many bugs are handing over them and o

28 Ron Bell 9/11/2014 

Yahoo’s Website ¶ 300 Users come first at Yahoo . . . We are also committed to prote

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

11 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

29 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 302 

Yahoo! takes your privacy seriously . . . We limit access to personal information about you to employ

into contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

30 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 303 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances: We provide the information to trusted partners who work on bagreements. These companies may use your personal informa

about offers from Yahoo and our marketing partners. Howeveindependent right to share this information. We have a parent’s permission to share the information if the We respond to subpoenas, court orders, or legal process (such enforcement requests), or to establish or exercise our legal rigWe believe it is necessary to share information in order to invillegal activities, suspected fraud, situations involving potentiperson, violations of Yahoo's terms of use, or as otherwise reqWe transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfeprivacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

12 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

31 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 304 

Updated to include data collection practices-Data Storage and In addition to the other purposes for which we collect informato search) (such as ad views, ad clicks, page views and page corder to power innovative product development, provide persable our security systems to detect and defend against fraudulQ: What is Yahoo’s updated user log data retention policy? A: Yahoo’s new policy will be able to de-identify search log 

limited exceptions to meet legal obligations. For other, non-se

retained for a longer period in order to power innovative prod

experiences, and better enable our security systems to detect a

32 

Alex Stamos 10/6/2014 

Yahoo’s Website ¶ 306 

[the company] remains committed to providing the most secuworldwide. 

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

13 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

36 

Marissa Mayer 3/6/2015 

Panel at World Economic Forum ¶ 316 

Q: Given Snowden and also the counterterrorism problem at tmore questioning about your storage of say emails, in other w

on what we might call the trust index...? Mayer: . . . [T]he first thing that happened when [] we heard a

the way that we store data, we changed the way that we comm

connections on all of the, Yahoo’s major properties https, we 

the data centers to basically get a more secure environment fowhat they wanted. So we changed all of those things in respon

Q: And what was the impact on trust? Mayer: We didn’t have a measurement necessarily before, bupeople’s trust and their confidence in the service has rebound

that we’re using more secure protocols to communicate and to * * * I would just make the observation that protection and trust reaprivacy, but there is a tension between those two. * * * Mayer: ...whether or not they’re coming through the official data and so we can do what we can do in order to protect our 

methods and the like . . . . 

37 

Alex Stamos 3/15/2015 

Yahoo’s Website ¶ 318 

At Yahoo, we’re committed to protecting our users’ security. updates on our latest security innovation: an end-to-end (e2e) Just a few years ago, e2e encryption was not widely discussedare much more conscious of the need to stay secure online. Th

encryption, ranging from the straightforward (sharing tax form

life-threatening (emailing in a country that does not respect frthe spectrum, we’ve heard you loud and clear: We’re building 

user experience and overall digital ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

14 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

38 

Not Identified 3/26/2015 

Yahoo’s Website ¶ 320 

Our Users First Approach in Action Protecting Users . . . We’ve encrypted many of our most important products and segovernments or other actors. This includes: Encryption of the traffic moving between Yahoo data centersMaking browsing over HTTPS the default on Yahoo Mail and Implementing the latest in security best-practices, including s

and a 2048-bit RSA key for many of our global properties sucMagazines; and We’ve also rolled out an end-to-end (e2e) encryption extensio

We are committed to the security of this solution and oppose other cryptographic system. We are committed to notifying users when we strongly suspesponsored attack. 

39 Ron Bell 3/26/2015 

Yahoo’s Website ¶ 322 

At Yahoo, users always come first . . . As we note in our transparency report, we’ve encrypted many to protect against unauthorized access by governments or othend (e2e) encryption extension for Yahoo Mail, now availabl

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

15 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

40 

Sean Zadig (Senior Manager, Yahoo ECrime Investg’ns 5/4/2015 

Yahoo’s Website ¶ 324 

Good governance and Users First: We adhere to the laws of thof Service, and our Privacy Policy. We encrypt our products 

42 

Marissa Mayer 7/22/2015 

Yahoo’s First Quarter 2014 Earnings Call ¶ 329 we continue to protect our mail users with new investments in 

44 

Daryl Low (Tech Yahoo, Architect) 9/17/2015 

Yahoo’s Website ¶ 334 

At Yahoo, we’re committed to protecting our users’ security, HTTPS across the board . . . Since we first began deploying encryption technologies acros

of our partners across all of Yahoo’s hundreds of global properunning on our network is secure. This continues to be an areposition to move the needle by encouraging our broad array o

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

16 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

46 

Not Identified 10/26/2015 Press Release ¶¶ 338-39 

Yahoo! Inc. (NASDAQ:YHOO) announced today that Bob LInformation Security Officer (CISO) . . . Yahoo is committed maintaining their users’ trust. Yahoo offers users encrypted p

plugin on GitHub for Yahoo Mail, offers two-factor authentic

Key, which allows users a fast and secure way to access their *** “ Lord will lead Yahoo's security team -- known as the Parano

of the Company’s more than one billion users around the worwill work closely across all of the Company's teams and colla

Yahoo continues to provide the highest level of security possi

47 

Marissa Mayer 10/26/2015 Twitter ¶ 340 Tweet linking to 10/26/2015 press release (Statement No. 45) 

49 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 345 

As always, Yahoo is committed to gaining your trust. Yahoo 

access to personal information about you to employees who w

contact with that information to provide product or services to We have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

17 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

50 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 346 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yo

communicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

18 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

51 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 347 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...). On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...). Secure Storage. We deploy industry standard physical, techn

with relevant regulations to protect your personal information

Vendors and Partners. To protect the security and privacy of 

information to partners and vendors who work on our behalf These companies do not have any independent right to use or 

Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. 

53 Ron Bell 3/3/2016 

Yahoo’s Website ¶ 352 

 [m]ore than 1 billion users entrust their personal information relationships over more than 20 years in the business. . . the sparamount importance to them and to [the] company. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

19 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

54 

Binu Ramakrishnan (Security Engineer, Yahoo Mail) 3/22/2016 

Yahoo’s Website ¶ 354 

At Yahoo, our users send and receive billions of emails every

use, personalized, and secure for our hundreds of millions of efforts to protect our users’ data, our security team recently co

quality of SMTP STARTTLS deployments. We found that w

widespread, the growth has slowed in recent years. Providers settings compared to others, and we believe there is an imporSTARTTLS deployments to protect messages – and therefore

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

20 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

59 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 365 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yo

communicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab A - Statement of policy and commitment in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

21 

sf-3873981

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

60 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 366 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...) On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...) Secure Storage. We deploy industry standard physical, techn

with relevant regulations to protect your personal information

Vendors and Partners. To protect the security and privacy of 

information to partners and vendors who work on our behalf These companies do not have any independent right to use or 

Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. (...) Please note that no data transmission over the Internet or infoguaranteed to be 100% secure. We continue to evaluate and imtechnology and practices. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 53 of 122
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

5 

Jeffrey Bonforte (SVP Commc'n Products) 10/14/2013 

Yahoo’s Website ¶¶ 254-55 

At Yahoo, we take the security of our users very seriously. In 

we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets 

that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure bLayer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we We appreciate, and certainly do not take for granted, the trust 

10 

Marissa Mayer 1/28/2014 

Yahoo’s Fourth Quarter 2013 Earnings Call ¶ 266 

in the beginning of January, Yahoo! Mail turned on SSL secu

protocol applies to ads as well, effectively making us the largdisplay advertising. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

13 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 274 

When I joined Yahoo four weeks ago, we were in the middle their data through the deployment of encryption technologies Tumblr. So today, we’re updating you on our progress: Traffic moving between Yahoo data centers is fully encrypted 

In January, we made Yahoo Mail more secure by making bromonth, we enabled encryption of mail between our servers anSMTPTLS standard. The Yahoo Homepage and all search queries that run on the Y

also have HTTPS encryption enabled by default. We implemented the latest in security best-practices, includin

Secrecy and a 2048-bit RSA key for many of our global propMagazines. We are currently working to bring all Yahoo sites 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 277 

The world has changed. So while email is an essential tool fofocus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

16 

Marissa Mayer 4/15/2014 

Yahoo’s First Quarter 2014 Earnings Call ¶ 279 

Alex Stamos joined Yahoo! as VP of Information Security. A

experience to Yahoo! and will be on the front line of continui

as possible. He will be furthering our significant security effoas a preferred option across our offerings. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

20 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 286 

We successfully block the vast majority of malicious or decepattack our network, and we always strive to defeat those who This means we regularly improve our systems, including contand testing systems to better emulate different user behaviorsad network is inspected using this system, both when they are 

Yahoo also strives to keep deceptive advertisements from eveprohibit advertisements that look like operating system messaor try to trick users into downloading and installing malicious deceptive advertising once required extensive human interven

inconsistent enforcement. Although no system is perfect, we n

image recognition algorithms to catch deceptive advertisemenThis lets us train our systems about the characteristics of dece

so we detect and respond to them immediately. We are also thstandard. The SafeFrame mechanism allows ads to properly duser’s private information to the advertiser or network. Thankenhances user privacy and security not only in the thriving mYahoo, but around the Internet. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

21 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 287 

While preventing the placement of malicious advertisements battle. We also fight the rest of the malware lifecycle by impr

email and by reducing financial incentives to spread malware

malicious actors make money, and Yahoo is leading the fight example, one way spammers act is through “email spoofing”. require that a sender use an accurate “From:” line in an emailmessages a day that feign to be from friends, family members much more likely to bypass spam filters, as they appear to be 

can also be used to trick users into giving up usernames and p

“phishing”. Yahoo is helping the Internet industry tackle these issues. YahIdentified Mail or DKIM, a mechanism that lets mail recipienemail. Yahoo freely contributed the intellectual property behiprotects billions of emails between thousands of domains. Bua coalition of Internet companies, financial institutions and anMessage Authentication, Reporting and Conformance or DM

domains a way to tell the rest of the Internet what security me

and what actions the sender would like to be taken on spoofed 

In April of this year, Yahoo became the first major email prov

policy. In essence, we asked the rest of the Internet to drop myahoo.com users. Since Yahoo made this change another majhope that every major email provider will follow our lead and 

against spoofed email. DMARC has reduced spam purported 

90%. If used broadly, it would target spammers’ financial inc

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

23 Ron Bell 6/5/2014 

Yahoo’s Website ¶ 290 

Here’s a look at how we’ve had our users’ back when it come

Encryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Messwork with our thousands of partners to make sure that data ru

26\

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 297 

Yahoo pointed out how the Company combats security bugs:  Detailed descriptions and mitigation instructions  Accurate prioritization  Consistent follow-up and real-time reporting  Executive visibility  Convincing company that you are a madman 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

27 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 298 

something that works really well for [Yahoo] is that the leadedashboard to see how many bugs are handing over them and o

30 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 303 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances: We provide the information to trusted partners who work on bagreements. These companies may use your personal informa

about offers from Yahoo and our marketing partners. Howeveindependent right to share this information. We have a parent’s permission to share the information if the We respond to subpoenas, court orders, or legal process (such enforcement requests), or to establish or exercise our legal rigWe believe it is necessary to share information in order to invillegal activities, suspected fraud, situations involving potentiperson, violations of Yahoo's terms of use, or as otherwise reqWe transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfeprivacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

31 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 304 

Updated to include data collection practices-Data Storage and In addition to the other purposes for which we collect informato search) (such as ad views, ad clicks, page views and page corder to power innovative product development, provide persable our security systems to detect and defend against fraudulQ: What is Yahoo’s updated user log data retention policy? A: Yahoo’s new policy will be able to de-identify search log 

limited exceptions to meet legal obligations. For other, non-se

retained for a longer period in order to power innovative prod

experiences, and better enable our security systems to detect a

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

36 

Marissa Mayer 3/6/2015 

Panel at World Economic Forum ¶ 316 

Q: Given Snowden and also the counterterrorism problem at tmore questioning about your storage of say emails, in other w

on what we might call the trust index...? Mayer: . . . [T]he first thing that happened when [] we heard a

the way that we store data, we changed the way that we comm

connections on all of the, Yahoo’s major properties https, we 

the data centers to basically get a more secure environment fowhat they wanted. So we changed all of those things in respon

Q: And what was the impact on trust? Mayer: We didn’t have a measurement necessarily before, bupeople’s trust and their confidence in the service has rebound

that we’re using more secure protocols to communicate and to * * * I would just make the observation that protection and trust reaprivacy, but there is a tension between those two. * * * Mayer: ...whether or not they’re coming through the official data and so we can do what we can do in order to protect our 

methods and the like . . . . 

37 

Alex Stamos 3/15/2015 

Yahoo’s Website ¶ 318 

At Yahoo, we’re committed to protecting our users’ security. updates on our latest security innovation: an end-to-end (e2e) Just a few years ago, e2e encryption was not widely discussedare much more conscious of the need to stay secure online. Th

encryption, ranging from the straightforward (sharing tax form

life-threatening (emailing in a country that does not respect frthe spectrum, we’ve heard you loud and clear: We’re building 

user experience and overall digital ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

11 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

39 Ron Bell 3/26/2015 

Yahoo’s Website ¶ 322 

At Yahoo, users always come first . . . As we note in our transparency report, we’ve encrypted many to protect against unauthorized access by governments or othend (e2e) encryption extension for Yahoo Mail, now availabl

42 

Marissa Mayer 7/22/2015 

Yahoo’s First Quarter 2014 Earnings Call ¶ 329 we continue to protect our mail users with new investments in 

44 

Daryl Low (Tech Yahoo, Architect) 9/17/2015 

Yahoo’s Website ¶ 334 

At Yahoo, we’re committed to protecting our users’ security, HTTPS across the board . . . Since we first began deploying encryption technologies acros

of our partners across all of Yahoo’s hundreds of global properunning on our network is secure. This continues to be an areposition to move the needle by encouraging our broad array o

45 

Marissa Mayer 10/20/2015 

October 20, 2015 earnings call transcript SAC ¶ 336 

Just last week, we launched the new Yahoo! Mail mobile app

In addition to focusing on back end improvements to improve 

the design, making Mail more beautiful and intuitive. We inteasier for users to access their other e-mail accounts directly f

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

12 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

leading step towards a password-free future with the announc

pushes notifications to your phone to provide a fast, convenieaccounts without having to memorize a password. This also musers’ accounts going forward. 

50 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 346 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yo

communicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or 

Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

13 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

51 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 347 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...). On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...). Secure Storage. We deploy industry standard physical, techn

with relevant regulations to protect your personal information

Vendors and Partners. To protect the security and privacy of 

information to partners and vendors who work on our behalf These companies do not have any independent right to use or 

Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

14 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

54 

Binu Ramakrishnan (Security Engineer, Yahoo Mail) 3/22/2016 

Yahoo’s Website ¶ 354 

At Yahoo, our users send and receive billions of emails every

use, personalized, and secure for our hundreds of millions of efforts to protect our users’ data, our security team recently co

quality of SMTP STARTTLS deployments. We found that w

widespread, the growth has slowed in recent years. Providers settings compared to others, and we believe there is an imporSTARTTLS deployments to protect messages – and therefore

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

15 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

59 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 365 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yo

communicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab B – Statement about cybersecurity topic unrelated to the Security Incidents allege

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

16 

sf-3873984

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

60 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 366 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...) On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...) Secure Storage. We deploy industry standard physical, techn

with relevant regulations to protect your personal information

Vendors and Partners. To protect the security and privacy of 

information to partners and vendors who work on our behalf These companies do not have any independent right to use or 

Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. (...) Please note that no data transmission over the Internet or infoguaranteed to be 100% secure. We continue to evaluate and imtechnology and practices. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 70 of 122
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

2 

Yahoo; Marissa Mayer 5/7/2013 

Risk Factor Section of Yahoo’s First Quarter 2013 Form 10-Q ¶ 246 

If our security measures are breached, our products and servicusers and customers may curtail or stop using our products anlegal and financial exposure. Our products and services involve the storage and transmissiopersonal and proprietary information in our facilities and on osystems. Security breaches expose us to a risk of loss of this i

increased costs for security measures, loss of revenue, damagOur user data and corporate systems and security measures ha

due to the actions of outside parties (including cyber attacks), of these, or otherwise, allowing an unauthorized party to obtacustomers’ data. Additionally, outside parties may attempt to customers to disclose sensitive information in order to gain acdata. Any breach or unauthorized access could result in significant remediation and other costs, damage to our reputation and a l

products, services and networks that could potentially have an 

techniques used to obtain unauthorized access, disable or degfrequently or may be designed to remain dormant until a preduntil launched against a target, we may be unable to anticipatpreventative measures. If an actual or perceived breach of our effectiveness of our security measures could be harmed and w

3 

Yahoo; Marissa Mayer 8/8/2013 

Risk Factor Section of Yahoo’s Second Quarter 2013 Form 10-Q ¶ 249 (Same as Statement #2) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

6 

Yahoo; Marissa Mayer 11/12/2013 

Risk Factor Section of Yahoo’s Third Quarter 2013 Form 10-Q ¶ 257 (Same as Statement # 2) 

11 

Yahoo; Marissa Mayer 2/28/2014 

Risk Factor Section of Yahoo’s Fiscal Year 2013 Form 10-K ¶ 268 

If our security measures are breached, our products and servicusers and customers may curtail or stop using our products anlegal and financial exposure. Our products and services involve the storage and transmissioand proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatiocosts for security measures, loss of revenue, damage to our rebreaches or unauthorized access have resulted in and may in tsignificant legal and financial exposure, increased remediatioand a loss of confidence in the security of our products, servic

effect on our business. We take steps to prevent unauthorized because the techniques used to obtain unauthorized access, dichange frequently or may be designed to remain dormant untianticipate these techniques or implement adequate preventativ

of our security occurs, the market perception of the effectivenharmed and we could lose users and customers. 

17 

Yahoo; Marissa Mayer 5/8/2014 

Risk Factor Section of Yahoo’s First Quarter 2014 Form 10-Q ¶ 281 (Same as Statement # 11) 

25 

Yahoo; Marissa Mayer 8/7/2014 

Risk Factor Section of Yahoo’s Second Quarter 2014 Form 10-Q ¶ 294 (Same as Statement No. 11) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

33 

Yahoo; Marissa Mayer 11/7/2014 

Risk Factor Section of Yahoo’s Third Quarter 2014 Form 10-Q ¶ 308 (Same as Statement # 11) 

35 

Yahoo; Marissa Mayer 2/27/2015 

Risk Factor Section of Yahoo’s Fiscal Year 2014 Form 10-K ¶ 313 

If our security measures are breached, our products and servicusers and customers may curtail or stop using our products anlegal and financial exposure. Our products and services involve the storage and transmissioand proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatiocosts for security measures, loss of revenue, damage to our reparties may attempt to fraudulently induce employees, users, 

information to gain access to our data or our users’ or customapplications we procure from third parties may contain defect

that could unexpectedly compromise network and data securihave resulted in and may in the future result in a combination increased remediation and other costs, damage to our reputati

our products, services and networks that could have an advers

prevent unauthorized access to our corporate systems, howev

unauthorized access, disable or degrade service, or sabotage sdesigned to remain dormant until a triggering event, we may implement adequate preventative measures. If an actual or pemarket perception of the effectiveness of our security measur

and customers. 

41 

Yahoo; Marissa Mayer 5/7/2015 

Risk Factor Section of Yahoo’s First Quarter 2015 Form 10-Q ¶ 326 (Same as Statement #35) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

43 

Yahoo; Marissa Mayer 8/7/2015 

Risk Factor Section of Yahoo’s Second Quarter 2015 Form 10-Q ¶ 331 (Same as Statement #35) 

48 

Yahoo; Marissa Mayer 11/5/2015 

Risk Factor Section of Yahoo’s Third Quarter 2015 Form 10-Q ¶ 342 (Same as Statement # 35) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

52 

Yahoo; Marissa Mayer 2/29/2016 

Risk Factor Section of Yahoo’s Fiscal Year 2014 Form 10-K ¶ 349 

If our security measures are breached, our products and ser

users and customers may curtail or stop using our products 

legal and financial exposure. Our products and services involve the storage and transmissio

and proprietary information in our facilities and on our equipmSecurity breaches expose us to a risk of loss of this informatio

costs for security measures, loss of revenue, damage to our reparties may attempt to fraudulently induce employees, users, information to gain access to our data or our users’ or customapplications we procure from third parties may contain defect

that could unexpectedly compromise network and data securiour distribution partners, service providers and vendors, and ainformation provided by us or by our users through applicatioparties fail to adopt or adhere to adequate data security practi

networks, our data or our users’ data may be improperly acce

unauthorized access have resulted in and may in the future refinancial exposure, increased remediation and other costs, damconfidence in the security of our products, services and netwo

business. We take steps to prevent unauthorized access to our techniques used to obtain unauthorized access, disable or degfrequently or may be designed to remain dormant until a triggthese techniques or implement adequate preventative measure

security occurs, the market perception of the effectiveness of we could lose users and customers. 

55 

Yahoo; Marissa Mayer 5/10/2016 

Risk Factor Section of Yahoo’s First Quarter 2016 Form 10-Q ¶ 356 (Same as Statement #51) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab C – Statement about cybersecurity risks in Second Amende

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873985

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

57 

Yahoo; Marissa Mayer 8/8/2016 

Risk Factor Section of Yahoo’s Second Quarter 2016 Form 10-Q ¶ 361 (Same as Statement #51) 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab D

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 77 of 122
Tab D – Stock Purchase Agreement representations in Second Ame

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873986

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

56 

Yahoo; Marissa Mayer 7/25/2016 

Stock Purchase Agreement between Yahoo and Verizon ¶ 359 

[A]ny incidents of, or third party claims alleging, (i) Security 

unauthorized use of any of Seller's or the Business Subsidiariloss, theft, unauthorized access or acquisition, modification, dPersonal Data in Seller's or the Business Subsidiaries' possess

Seller or the Business Subsidiaries (or provided to Seller or thin seller's or the Business Subsidiaries' possession, in each caexpected to have a Business Material Adverse Effect. Neither notified in writing, or to the Knowledge of Seller, been requirAuthority to notify in writing, any Person of any Security Bre

Seller nor the Business Subsidiaries have received any notice investigations by a Governmental Authority), or alleged viola

possessed by Seller or the Business Subsidiaries, in each case Business Material Adverse Effect. 

61 

Yahoo; Marissa Mayer 9/9/2016 

Stock Purchase Agreement, as attached to Proxy Statement ¶ 368 

[T]here have not been any incidents of, or third party claims aaccess or unauthorized use of any of Seller’s or the Business or (ii) loss, theft, unauthorized access or acquisition, modifica

of any Personal Data in Seller’s or the Business Subsidiaries’ 

by Seller or the Business Subsidiaries (or provided to Seller ocustomers) in Seller’s or the Business Subsidiaries’ possessioreasonably be expected to have a Business Material Adverse Subsidiaries have notified in writing, or to the Knowledge of 

Governmental Authority to notify in writing, any Person of anSeller, neither Seller nor the Business Subsidiaries have recei

(including investigations by a Governmental Authority), or alPersonal Data possessed by Seller or the Business Subsidiarieexpected to have a Business Material Adverse Effect. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 79 of 122
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

1 

Not Identified 4/30/2013 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 244 

Yahoo! takes your privacy seriously . . . We limit access to pewho we believe reasonably need to come into contact with thin order to do their jobs. We have physical, electronic, and prregulations to protect personal information about you. 

4 Ron Bell 9/6/2013 

Yahoo’s Website ¶ 252 At Yahoo, we take the privacy of our users seriously. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

5 

Jeffrey Bonforte (SVP Commc'n Products) 10/14/2013 

Yahoo’s Website ¶¶ 254-55 

At Yahoo, we take the security of our users very seriously. In 

we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets 

that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure bLayer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we We appreciate, and certainly do not take for granted, the trust 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

8 

Marissa Mayer 11/18/2013 

Tumblr Post / Twitter Post ¶ 262 Yahoo’s commitment to securing and encrypting (...) users’ d

9 

Jeffrey Bonforte 1/7/2014 

Yahoo’s Website ¶ 264 

Yahoo is fully committed to keeping our users safe and secur

we are now automatically encrypting all connections between 

Yahoo Mail - whether it’s on the web, mobile web, mobile apencrypted by default and protected with 2,048 bit certificates. 

attachments, contacts, as well as Calendar and Messenger in MSecurity is a key focus for us and we’ll continue to enhance o

can provide a safe and secure experience for our users. 

10 

Marissa Mayer 1/28/2014 

Yahoo’s Fourth Quarter 2013 Earnings Call ¶ 266 

in the beginning of January, Yahoo! Mail turned on SSL secu

protocol applies to ads as well, effectively making us the largdisplay advertising. 

14 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 275 

Hundreds of Yahoos have been working around the clock ove

secure experience for our users and we want to do even more 

entire platform for all users at all time, by default. One of our biggest areas of focus in the coming months is to wpartners across all of Yahoo’s hundreds of global properties tour network is secure. Our broader mission is to not only makthe overall web ecosystem. In addition to moving all of our properties to encryption by de

security measures such as HSTS, Perfect Forward Secrecy anmonths. This isn’t a project where we’ll ever check a box and 

and their data is an ongoing and critical effort. We will contintechnology to combat attacks and surveillance that violate our 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 277 

The world has changed. So while email is an essential tool fofocus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

18 

Alex Stamos 5/15/2014 

Yahoo’s Website ¶ 284 

The Senate Homeland Security and Government Affairs Permhosted a hearing earlier today to examine consumer security a

industry. I testified along with representatives from Google anYahoo’s dedication to protecting our users and you can dow

down to “Panel One”). This hearing gave us the opportunity to discuss the user-first build and maintain user trust by providing secure product exglobe. Because we never take the relationship we’ve cultivatpeople each month trust us to provide them with Internet ser

I outlined specific ways we protect our users, including: our 

pipeline; our leadership in the fight on email spam; the bug efforts to fully encrypt 100 percent of our network traffic.Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to help protect th

security as a partnership - we want to educate our users to be 

provide intuitive, user-friendly tools and security resources to 

19 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 285 

One reason I joined Yahoo is that from the top down, the comand maintaining trust through secure products is a critical focshould be secure for all of our users across the globe. Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to protect their ipartnership; we want to educate our users to be mindful of theintuitive, user-friendly tools and security resources to help theMalware is an important issue that is a top priority for Yahooadvertising is one part of the equation, it’s important to addreat each phase of its lifecycle. It is also important to address seI outline in my testimony below several specific ways Yahoo users, including: focusing on security in the advertising pipeliemail spam; operating a bug bounty program; and working to network traffic. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

22 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 288 

Yahoo invests heavily to ensure the security of our users and January, we made encrypted browsing the default for Yahoo Mand international traffic moving between Yahoo’s data center

23 Ron Bell 6/5/2014 

Yahoo’s Website ¶ 290 

Here’s a look at how we’ve had our users’ back when it come

Encryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Messwork with our thousands of partners to make sure that data ru

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

28 Ron Bell 9/11/2014 

Yahoo’s Website ¶ 300 Users come first at Yahoo . . . We are also committed to prote

29 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 302 

Yahoo! takes your privacy seriously . . . We limit access to personal information about you to employ

into contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

37 

Alex Stamos 3/15/2015 

Yahoo’s Website ¶ 318 

At Yahoo, we’re committed to protecting our users’ security. updates on our latest security innovation: an end-to-end (e2e) Just a few years ago, e2e encryption was not widely discussedare much more conscious of the need to stay secure online. Th

encryption, ranging from the straightforward (sharing tax form

life-threatening (emailing in a country that does not respect frthe spectrum, we’ve heard you loud and clear: We’re building 

user experience and overall digital ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

38 

Not Identified 3/26/2015 

Yahoo’s Website ¶ 320 

Our Users First Approach in Action Protecting Users . . . We’ve encrypted many of our most important products and segovernments or other actors. This includes: Encryption of the traffic moving between Yahoo data centersMaking browsing over HTTPS the default on Yahoo Mail and Implementing the latest in security best-practices, including s

and a 2048-bit RSA key for many of our global properties sucMagazines; and We’ve also rolled out an end-to-end (e2e) encryption extensio

We are committed to the security of this solution and oppose other cryptographic system. We are committed to notifying users when we strongly suspesponsored attack. 

42 

Marissa Mayer 7/22/2015 

Yahoo’s First Quarter 2014 Earnings Call ¶ 329 we continue to protect our mail users with new investments in 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

44 

Daryl Low (Tech Yahoo, Architect) 9/17/2015 

Yahoo’s Website ¶ 334 

At Yahoo, we’re committed to protecting our users’ security, HTTPS across the board . . . Since we first began deploying encryption technologies acros

of our partners across all of Yahoo’s hundreds of global properunning on our network is secure. This continues to be an areposition to move the needle by encouraging our broad array o

45 

Marissa Mayer 10/20/2015 

October 20, 2015 earnings call transcript SAC ¶ 336 

Just last week, we launched the new Yahoo! Mail mobile app

In addition to focusing on back end improvements to improve 

the design, making Mail more beautiful and intuitive. We inteasier for users to access their other e-mail accounts directly fleading step towards a password-free future with the announcpushes notifications to your phone to provide a fast, convenieaccounts without having to memorize a password. This also musers’ accounts going forward. 

46 

Not Identified 10/26/2015 Press Release ¶¶ 338-39 

Yahoo! Inc. (NASDAQ:YHOO) announced today that Bob LInformation Security Officer (CISO) . . . Yahoo is committed maintaining their users’ trust. Yahoo offers users encrypted p

plugin on GitHub for Yahoo Mail, offers two-factor authentic

Key, which allows users a fast and secure way to access their *** “ Lord will lead Yahoo's security team -- known as the Parano

of the Company’s more than one billion users around the worwill work closely across all of the Company's teams and colla

Yahoo continues to provide the highest level of security possi

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab E – Corporate optimism alleged in Second Amended Cr

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3873987

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

47 

Marissa Mayer 10/26/2015 Twitter ¶ 340 Tweet linking to 10/26/2015 press release (Statement No. 45) 

49 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 345 

As always, Yahoo is committed to gaining your trust. Yahoo 

access to personal information about you to employees who w

contact with that information to provide product or services to We have physical, electronic, and procedural safeguards that personal information about you. 

53 Ron Bell 3/3/2016 

Yahoo’s Website ¶ 352 

 [m]ore than 1 billion users entrust their personal information relationships over more than 20 years in the business. . . the sparamount importance to them and to [the] company. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab F

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 90 of 122
Tab F – Vague allegations in Second Amended Class A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873988

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

4 Ron Bell 9/6/2013 

Yahoo’s Website ¶ 252 At Yahoo, we take the privacy of our users seriously. 

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure bLayer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we We appreciate, and certainly do not take for granted, the trust 

12 Ron Bell 3/14/2014 

Silicon Valley Business Journal ¶ 271 

I have a real sense, and everyone in the legal department thinkWe have to stand up for them, because if we don’t, nobody el

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab F – Vague allegations in Second Amended Class A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873988

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 277 

The world has changed. So while email is an essential tool fofocus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

24 

Alex Stamos 7/25/2014 

Yahoo’s Website ¶ 292 

The security of our users is a huge focus for us at Yahoo. Weour platform, encouraging our partners to ensure that any data improving the security of the overall web ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab F – Vague allegations in Second Amended Class A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873988

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

28 Ron Bell 9/11/2014 

Yahoo’s Website ¶ 300 Users come first at Yahoo . . . We are also committed to prote

32 

Alex Stamos 10/6/2014 

Yahoo’s Website ¶ 306 

[the company] remains committed to providing the most secuworldwide. 

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab F – Vague allegations in Second Amended Class A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873988

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

36 

Marissa Mayer 3/6/2015 

Panel at World Economic Forum ¶ 316 

Q: Given Snowden and also the counterterrorism problem at tmore questioning about your storage of say emails, in other w

on what we might call the trust index...? Mayer: . . . [T]he first thing that happened when [] we heard a

the way that we store data, we changed the way that we comm

connections on all of the, Yahoo’s major properties https, we 

the data centers to basically get a more secure environment fowhat they wanted. So we changed all of those things in respon

Q: And what was the impact on trust? Mayer: We didn’t have a measurement necessarily before, bupeople’s trust and their confidence in the service has rebound

that we’re using more secure protocols to communicate and to * * * I would just make the observation that protection and trust reaprivacy, but there is a tension between those two. * * * Mayer: ...whether or not they’re coming through the official data and so we can do what we can do in order to protect our 

methods and the like . . . . 

39 Ron Bell 3/26/2015 

Yahoo’s Website ¶ 322 

At Yahoo, users always come first . . . As we note in our transparency report, we’ve encrypted many to protect against unauthorized access by governments or othend (e2e) encryption extension for Yahoo Mail, now availabl

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab F – Vague allegations in Second Amended Class A

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873988

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

40 

Sean Zadig (Senior Manager, Yahoo ECrime Investg’ns 5/4/2015 

Yahoo’s Website ¶ 324 

Good governance and Users First: We adhere to the laws of thof Service, and our Privacy Policy. We encrypt our products 

53 Ron Bell 3/3/2016 

Yahoo’s Website ¶ 352 

 [m]ore than 1 billion users entrust their personal information relationships over more than 20 years in the business. . . the sparamount importance to them and to [the] company. 

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 96 of 122
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

5 

Jeffrey Bonforte (SVP Commc'n Products) 10/14/2013 

Yahoo’s Website ¶¶ 254-55 

At Yahoo, we take the security of our users very seriously. In 

we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets 

that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

7 

Marissa Mayer 11/18/2013 

Yahoo’s Website ¶ 260 

We’ve worked hard over the years to earn our users’ trust and There is nothing more important to us than protecting our useannounced that we will make Yahoo Mail even more secure bLayer) encryption with a 2048-bit key across our network by Today we are announcing that we will extend that effort acromeans we will: o Encrypt all information that moves between our data centero Offer users an option to encrypt all data flow to/from Yahoo o Work closely with our international Mail partners to ensure https-enabled. As we have said before, we will continue to evaluate how we We appreciate, and certainly do not take for granted, the trust 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

9 

Jeffrey Bonforte 1/7/2014 

Yahoo’s Website ¶ 264 

Yahoo is fully committed to keeping our users safe and secur

we are now automatically encrypting all connections between 

Yahoo Mail - whether it’s on the web, mobile web, mobile apencrypted by default and protected with 2,048 bit certificates. 

attachments, contacts, as well as Calendar and Messenger in MSecurity is a key focus for us and we’ll continue to enhance o

can provide a safe and secure experience for our users. 

12 Ron Bell 3/14/2014 

Silicon Valley Business Journal ¶ 271 

I have a real sense, and everyone in the legal department thinkWe have to stand up for them, because if we don’t, nobody el

14 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 275 

Hundreds of Yahoos have been working around the clock ove

secure experience for our users and we want to do even more 

entire platform for all users at all time, by default. One of our biggest areas of focus in the coming months is to wpartners across all of Yahoo’s hundreds of global properties tour network is secure. Our broader mission is to not only makthe overall web ecosystem. In addition to moving all of our properties to encryption by de

security measures such as HSTS, Perfect Forward Secrecy anmonths. This isn’t a project where we’ll ever check a box and 

and their data is an ongoing and critical effort. We will contintechnology to combat attacks and surveillance that violate our 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 189277 

The world has changed. So while email is an essential tool fofocus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the indu

emails to be sent more securely and formed an organization, iLinkedIn, and Facebook, to work out a solution. The organizaDMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be proOn Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

16 

Marissa Mayer 4/15/2014 

Yahoo’s First Quarter 2014 Earnings Call ¶ 279 

Alex Stamos joined Yahoo! as VP of Information Security. A

experience to Yahoo! and will be on the front line of continui

as possible. He will be furthering our significant security effoas a preferred option across our offerings. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

18 

Alex Stamos 5/15/2014 

Yahoo’s Website ¶ 284 

The Senate Homeland Security and Government Affairs Permhosted a hearing earlier today to examine consumer security a

industry. I testified along with representatives from Google anYahoo’s dedication to protecting our users and you can dow

down to “Panel One”). This hearing gave us the opportunity to discuss the user-first build and maintain user trust by providing secure product exglobe. Because we never take the relationship we’ve cultivatpeople each month trust us to provide them with Internet ser

I outlined specific ways we protect our users, including: our 

pipeline; our leadership in the fight on email spam; the bug efforts to fully encrypt 100 percent of our network traffic.Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to help protect th

security as a partnership - we want to educate our users to be 

provide intuitive, user-friendly tools and security resources to 

19 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 285 

One reason I joined Yahoo is that from the top down, the comand maintaining trust through secure products is a critical focshould be secure for all of our users across the globe. Achieving security online is not an end state; it’s a constantly At Yahoo, we know that our users rely on us to protect their ipartnership; we want to educate our users to be mindful of theintuitive, user-friendly tools and security resources to help theMalware is an important issue that is a top priority for Yahooadvertising is one part of the equation, it’s important to addreat each phase of its lifecycle. It is also important to address seI outline in my testimony below several specific ways Yahoo users, including: focusing on security in the advertising pipeliemail spam; operating a bug bounty program; and working to network traffic. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

20 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 286 

We successfully block the vast majority of malicious or decepattack our network, and we always strive to defeat those who This means we regularly improve our systems, including contand testing systems to better emulate different user behaviorsad network is inspected using this system, both when they are 

Yahoo also strives to keep deceptive advertisements from eveprohibit advertisements that look like operating system messaor try to trick users into downloading and installing malicious deceptive advertising once required extensive human interven

inconsistent enforcement. Although no system is perfect, we n

image recognition algorithms to catch deceptive advertisemenThis lets us train our systems about the characteristics of dece

so we detect and respond to them immediately. We are also thstandard. The SafeFrame mechanism allows ads to properly duser’s private information to the advertiser or network. Thankenhances user privacy and security not only in the thriving mYahoo, but around the Internet. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

21 

Alex Stamos 5/15/2014 

Written Testimony Before the Senate Homeland Security and Government Affairs Permanent Subcommittee on Investigations ¶ 287 

While preventing the placement of malicious advertisements battle. We also fight the rest of the malware lifecycle by impr

email and by reducing financial incentives to spread malware

malicious actors make money, and Yahoo is leading the fight example, one way spammers act is through “email spoofing”. require that a sender use an accurate “From:” line in an emailmessages a day that feign to be from friends, family members much more likely to bypass spam filters, as they appear to be 

can also be used to trick users into giving up usernames and p

“phishing”. Yahoo is helping the Internet industry tackle these issues. YahIdentified Mail or DKIM, a mechanism that lets mail recipienemail. Yahoo freely contributed the intellectual property behiprotects billions of emails between thousands of domains. Bua coalition of Internet companies, financial institutions and anMessage Authentication, Reporting and Conformance or DM

domains a way to tell the rest of the Internet what security me

and what actions the sender would like to be taken on spoofed 

In April of this year, Yahoo became the first major email prov

policy. In essence, we asked the rest of the Internet to drop myahoo.com users. Since Yahoo made this change another majhope that every major email provider will follow our lead and 

against spoofed email. DMARC has reduced spam purported 

90%. If used broadly, it would target spammers’ financial inc

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

23 Ron Bell 6/5/2014 

Yahoo’s Website ¶ 290 

Here’s a look at how we’ve had our users’ back when it come

Encryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Messwork with our thousands of partners to make sure that data ru

26 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 297 

Yahoo pointed out how the Company combats security bugs:  Detailed descriptions and mitigation instructions 

 Accurate prioritization  Consistent follow-up and real-time reporting  Executive visibility  Convincing company that you are a madman 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

31 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 304 

Updated to include data collection practices-Data Storage and In addition to the other purposes for which we collect informato search) (such as ad views, ad clicks, page views and page corder to power innovative product development, provide persable our security systems to detect and defend against fraudulQ: What is Yahoo’s updated user log data retention policy? A: Yahoo’s new policy will be able to de-identify search log 

limited exceptions to meet legal obligations. For other, non-se

retained for a longer period in order to power innovative prod

experiences, and better enable our security systems to detect a

32 

Alex Stamos 10/6/2014 

Yahoo’s Website ¶ 306 

[the company] remains committed to providing the most secuworldwide. 

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

46 

Not Identified 10/26/2015 Press Release ¶¶ 338-39 

Yahoo! Inc. (NASDAQ:YHOO) announced today that Bob LInformation Security Officer (CISO) . . . Yahoo is committed maintaining their users’ trust. Yahoo offers users encrypted p

plugin on GitHub for Yahoo Mail, offers two-factor authentic

Key, which allows users a fast and secure way to access their *** “ Lord will lead Yahoo's security team -- known as the Parano

of the Company’s more than one billion users around the worwill work closely across all of the Company's teams and colla

Yahoo continues to provide the highest level of security possi

47 

Marissa Mayer 10/26/2015 Twitter ¶ 340 Tweet linking to 10/26/2015 press release (Statement No. 45) 

49 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 345 

As always, Yahoo is committed to gaining your trust. Yahoo 

access to personal information about you to employees who w

contact with that information to provide product or services to We have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab G – Aspirational allegations in Second Amended Clas

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3873989

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

54 

Binu Ramakrishnan (Security Engineer, Yahoo Mail) 3/22/2016 

Yahoo’s Website ¶ 354 

At Yahoo, our users send and receive billions of emails every

use, personalized, and secure for our hundreds of millions of efforts to protect our users’ data, our security team recently co

quality of SMTP STARTTLS deployments. We found that w

widespread, the growth has slowed in recent years. Providers settings compared to others, and we believe there is an imporSTARTTLS deployments to protect messages – and therefore

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 Page 107 of 122
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

1 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

1 

Not Identified 4/30/2013 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 244 

Yahoo! takes your privacy seriously . . . We limit access to pewho we believe reasonably need to come into contact with thin order to do their jobs. We have physical, electronic, and prregulations to protect personal information about you. 

4 Ron Bell 9/6/2013 

Yahoo’s Website ¶ 252 At Yahoo, we take the privacy of our users seriously. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

2 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

5 

Jeffrey Bonforte (SVP Commc'n Products) 10/14/2013 

Yahoo’s Website ¶¶ 254-55 

At Yahoo, we take the security of our users very seriously. In we recognize the need to continuously evaluate how to best pYahoo Mail users can already enable https [or Secure Sockets that securely encrypts your information and messages as they 

servers. You’ll find this option in your Yahoo Mail settings m

option enhances your privacy and security. Starting January 8, 2014, we will make encrypted https conne

Our teams are working hard to make the necessary changes to 

and we look forward to providing this extra layer of security fYahoo will continue to enhance our security technology, poliprotections for our users. We invite you to check out our Yahyou can take to help protect yourself online. UPDATE: In addition to making https a default feature by Janto implement 2048-bit encryption keys, which will provide ou

9 

Jeffrey Bonforte 1/7/2014 

Yahoo’s Website ¶ 264 

Yahoo is fully committed to keeping our users safe and securwe are now automatically encrypting all connections between Yahoo Mail - whether it’s on the web, mobile web, mobile apencrypted by default and protected with 2,048 bit certificates. 

attachments, contacts, as well as Calendar and Messenger in MSecurity is a key focus for us and we’ll continue to enhance o

can provide a safe and secure experience for our users. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

3 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

13 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 274 

When I joined Yahoo four weeks ago, we were in the middle their data through the deployment of encryption technologies Tumblr. So today, we’re updating you on our progress: Traffic moving between Yahoo data centers is fully encrypted In January, we made Yahoo Mail more secure by making bromonth, we enabled encryption of mail between our servers anSMTPTLS standard. The Yahoo Homepage and all search queries that run on the Yalso have HTTPS encryption enabled by default. We implemented the latest in security best-practices, includinSecrecy and a 2048-bit RSA key for many of our global propMagazines. We are currently working to bring all Yahoo sites 

14 

Alex Stamos 4/2/2014 

Yahoo’s Website ¶ 275 

Hundreds of Yahoos have been working around the clock ovesecure experience for our users and we want to do even more 

entire platform for all users at all time, by default. One of our biggest areas of focus in the coming months is to wpartners across all of Yahoo’s hundreds of global properties tour network is secure. Our broader mission is to not only makthe overall web ecosystem. In addition to moving all of our properties to encryption by de

security measures such as HSTS, Perfect Forward Secrecy an

months. This isn’t a project where we’ll ever check a box and and their data is an ongoing and critical effort. We will contintechnology to combat attacks and surveillance that violate our 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

4 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

15 

Jeffrey Bonforte 4/11/2014 

Yahoo’s Website ¶ 277 

The world has changed. So while email is an essential tool fo

focus for some of those who endeavor to do us harm. The new 

attempts at account hacking, email spoofing (forging sender ito give up account credentials). The doors to your inbox need another lock. Because of the rise of spoofing and phishing attacks, the induemails to be sent more securely and formed an organization, i

LinkedIn, and Facebook, to work out a solution. The organiza

DMARC, or Domain- based Message Authentication, Reportemail user accounts and over 2B accounts globally can be pro

On Friday afternoon last week, Yahoo made a simple change “reject”. In other words, we requested that all other mail servi

Yahoo user, but not signed by Yahoo. Yahoo is the first major email provider in the world to adopt t

behalf of our users. And overnight, the bad guys who have used email spoofing to 

pretending to come from a Yahoo Mail account were nearly sWith stricter DMARC policies, users are safer, and the bad guverified senders will unlock a massive wave of innovation a

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

5 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

23 Ron Bell 6/5/2014 

Yahoo’s Website ¶ 290 

Here’s a look at how we’ve had our users’ back when it comeEncryption: In November 2013, we committed to introducing 

encryption with 2048-bit keys across our network. We’ve ma

including: encrypting all data moving between our data centers; making browsing via Yahoo Mail HTTPS by default; ensuring that the Yahoo Homepage and all search queries run 

properties have HTTPS by default; implementing the latest in security best-practices, including sand a 2048-bit RSA key for many of our global properties sucMagazines; empowering users to initiate an encrypted session for Yahoo 

Good Morning America on Yahoo (gma.yahoo.com) by typinbrowser; preparing to deploy a new, encrypted, version of Yahoo Mess

work with our thousands of partners to make sure that data ru

26 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 297 

Yahoo pointed out how the Company combats security bugs:  Detailed descriptions and mitigation instructions  Accurate prioritization  Consistent follow-up and real-time reporting  Executive visibility  Convincing company that you are a madman 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

6 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

27 

Alex Stamos 8/7/2014 

Presentation at Black Hat USA 2014 Conference ¶ 298 

something that works really well for [Yahoo] is that the leadedashboard to see how many bugs are handing over them and o

28 Ron Bell 9/11/2014 

Yahoo’s Website ¶ 300 Users come first at Yahoo . . . We are also committed to prote

29 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 302 

Yahoo! takes your privacy seriously . . . We limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

7 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

30 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 303 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances: We provide the information to trusted partners who work on bagreements. These companies may use your personal informa

about offers from Yahoo and our marketing partners. Howeveindependent right to share this information. We have a parent’s permission to share the information if the We respond to subpoenas, court orders, or legal process (such enforcement requests), or to establish or exercise our legal rigWe believe it is necessary to share information in order to inv

illegal activities, suspected fraud, situations involving potenti

person, violations of Yahoo's terms of use, or as otherwise reqWe transfer information about you if Yahoo is acquired by or Yahoo will notify you before information about you is transfe

privacy policy. 

31 

Not Identified 9/25/2014 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 304 

Updated to include data collection practices-Data Storage and 

In addition to the other purposes for which we collect informato search) (such as ad views, ad clicks, page views and page corder to power innovative product development, provide pers

able our security systems to detect and defend against fraudulQ: What is Yahoo’s updated user log data retention policy? A: Yahoo’s new policy will be able to de-identify search log limited exceptions to meet legal obligations. For other, non-seretained for a longer period in order to power innovative prod

experiences, and better enable our security systems to detect a

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

8 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

34 

Lovlesh Chhabra (Product Manager) 2/9/2015 

Yahoo’s Website ¶ 311 

At Yahoo, our users’ security is paramount, and we continue our users’ accounts and data secure. While developers and pause basic authentication protocols and/or ‘plain text’ usernambeginning May 30, 2015, all third-party applications will need 

The good news is that Yahoo APIs already support OAuth-ba

37 

Alex Stamos 3/15/2015 

Yahoo’s Website ¶ 318 

At Yahoo, we’re committed to protecting our users’ security. updates on our latest security innovation: an end-to-end (e2e) Just a few years ago, e2e encryption was not widely discussedare much more conscious of the need to stay secure online. Thencryption, ranging from the straightforward (sharing tax formlife-threatening (emailing in a country that does not respect frthe spectrum, we’ve heard you loud and clear: We’re building user experience and overall digital ecosystem. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

9 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

38 

Not Identified 3/26/2015 

Yahoo’s Website ¶ 320 

Our Users First Approach in Action Protecting Users . . . We’ve encrypted many of our most important products and segovernments or other actors. This includes: Encryption of the traffic moving between Yahoo data centersMaking browsing over HTTPS the default on Yahoo Mail and Implementing the latest in security best-practices, including s

and a 2048-bit RSA key for many of our global properties suc

Magazines; and We’ve also rolled out an end-to-end (e2e) encryption extensio

We are committed to the security of this solution and oppose 

other cryptographic system. We are committed to notifying users when we strongly suspesponsored attack. 

39 Ron Bell 3/26/2015 

Yahoo’s Website ¶ 322 

At Yahoo, users always come first . . . As we note in our transparency report, we’ve encrypted many to protect against unauthorized access by governments or othend (e2e) encryption extension for Yahoo Mail, now availabl

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

10 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

40 

Sean Zadig (Senior Manager, Yahoo ECrime Investg’ns 5/4/2015 

Yahoo’s Website ¶ 324 

Good governance and Users First: We adhere to the laws of thof Service, and our Privacy Policy. We encrypt our products 

44 

Daryl Low (Tech Yahoo, Architect) 9/17/2015 

Yahoo’s Website ¶ 334 

At Yahoo, we’re committed to protecting our users’ security, 

HTTPS across the board . . . Since we first began deploying encryption technologies acros

of our partners across all of Yahoo’s hundreds of global properunning on our network is secure. This continues to be an areposition to move the needle by encouraging our broad array o

45 Marissa 

Mayer 

10/20/2015 October 20, 

2015 earnings call transcript 

SAC ¶ 336 Just last week, we launched the new Yahoo! Mail mobile app

In addition to focusing on back end improvements to improve the design, making Mail more beautiful and intuitive. We inteasier for users to access their other e-mail accounts directly fleading step towards a password-free future with the announcpushes notifications to your phone to provide a fast, convenieaccounts without having to memorize a password. This also musers’ accounts going forward. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

11 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

49 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 345 

As always, Yahoo is committed to gaining your trust. Yahoo access to personal information about you to employees who wcontact with that information to provide product or services to We have physical, electronic, and procedural safeguards that personal information about you. 

50 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 346 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yocommunicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or 

Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

12 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

51 

Not Identified 11/23/2015 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 347 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...). On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...). Secure Storage. We deploy industry standard physical, technwith relevant regulations to protect your personal informationVendors and Partners. To protect the security and privacy of information to partners and vendors who work on our behalf These companies do not have any independent right to use or Access to Information. We limit access to personal informati

reasonably believe need to come into contact with that inform

or in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

13 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

54 

Binu Ramakrishnan (Security Engineer, Yahoo Mail) 3/22/2016 

Yahoo’s Website ¶ 354 

At Yahoo, our users send and receive billions of emails everyuse, personalized, and secure for our hundreds of millions of efforts to protect our users’ data, our security team recently coquality of SMTP STARTTLS deployments. We found that wwidespread, the growth has slowed in recent years. Providers settings compared to others, and we believe there is an imporSTARTTLS deployments to protect messages – and therefore

58 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 364 

As always, Yahoo is committed to gaining your trust . . . YahWe limit access to personal information about you to employinto contact with that information to provide products or servWe have physical, electronic, and procedural safeguards that 

personal information about you. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

14 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

59 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 365 

Yahoo does not rent, sell, or share personal information abou

companies except to provide products or services you've requunder the following circumstances:  We provide the information to trusted partners who work 

confidentiality agreements. These companies may use yocommunicate with you about offers from Yahoo and our companies do not have any independent right to share thi

 We have a parent's permission to share the information if 

Children's Privacy & Family Accounts for more informatunder 13. 

 We respond to subpoenas, court orders, or legal process (

establish or exercise our legal rights or defend against leg

 We believe it is necessary to share information in order to 

regarding illegal activities, suspected fraud, situations invof any person, violations of Yahoo's terms of use, or as ot

We transfer information about you if Yahoo is acquired by or 

Yahoo will notify you before information about you is transfe

privacy policy. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18 
Tab H – Statement not Made in connection with purchase or sale of securities in 

In re Yahoo Sec. Litig., No. 17-CV-00373 (L

15 

sf-3873990

Stmt. 

No. 

Alleged 

Statement 

Maker 

Date of 

Statement Source(s) SAC ¶ No. Text of Statemen

60 

Not Identified 8/30/2016 

Yahoo Privacy Policy as it appeared in the “Policy Center” section of Yahoo’s Website ¶ 366 

Protecting our systems and our users’ information is paramouuser experience and maintaining our users’ trust. We have takinformation: Transport Layer Security (TLS). We use TLS encryption whsuch as financial services information or payment informationin most browsers during TLS sessions. Second Sign-in Verification. You may turn on a setting that ras a code sent via SMS - in addition to your password - when location we don’t recognize. (...) On-Demand Passwords. Yahoo also offers on-demand passwaccount, you enable Yahoo to provide you with an on-demand you don't have to remember passwords anymore. (...) Secure Storage. We deploy industry standard physical, technwith relevant regulations to protect your personal informationVendors and Partners. To protect the security and privacy of information to partners and vendors who work on our behalf 

These companies do not have any independent right to use or Access to Information. We limit access to personal informatireasonably believe need to come into contact with that informor in order to process this information for us. Education and Training. We have implemented a company-wsecurity that is required of every Yahoo employee. (...) Please note that no data transmission over the Internet or infoguaranteed to be 100% secure. We continue to evaluate and imtechnology and practices. 

Case 5:17-cv-00373-LHK Document 76 Filed 03/02/18