Three billion user accounts. Two separate breaches. Four FSB-directed operatives. And nearly two years of silence between what Yahoo's security team knew and what the public was told.

This episode traces the full operation from the spear phishing campaign that opened the door, through the forged authentication cookies that bypassed every login screen, to the SEC enforcement action that established a new category of regulatory risk: the failure to disclose a known breach.

Chapters:
0:00 — 3 Billion
1:47 — The Spear Phishing Campaign
3:26 — Inside Yahoo's Network
5:39 — The Stolen Database
7:28 — The Account Management Tool
9:14 — The Hybrid Model: State + Criminal
11:03 — The Silence
13:23 — The Disclosures
15:23 — The SEC Enforcement
17:14 — The Indictment
17:58 — Aftermath
18:20 — The Pattern

Sources: DOJ indictment (United States v. Dokuchaev et al.), SEC enforcement order (Altaba Inc.), Yahoo SEC filings, Verizon acquisition disclosures.

Full technical breakdown and free PDF summary at zerodaylogs.com.