The phishing methods are not new, but point to an effort to automate them at scale to target human rights activists, journalists and others.

It's one of the largest data breach settlements in U.S. history, and it's the latest in a series of legal consequences related to security issues at Yahoo.

Karim Baratov pleaded guilty in November for playing a role in the massive 2014 Yahoo data breach.

Baratov is charged with building a for-profit hacking empire whose customers included Russian intelligence.

The SEC said Yahoo didn't properly investigate or consider whether to inform investors of its 2014 breach, which didn't become public until two years later.

The plaintiffs say they would have chosen a different email provider had they been aware of Yahoo's risks.