Yahoo may have dragged feet on disclosing breaches
The Securities and Exchange Commission is reportedly investigating whether Yahoo should have notified investors sooner about the two massive data breaches that occurred at the company.
Last month, the FBI said it had begun an investigation into a 2013 data breach that involved more than 1 billion users’ accounts. That followed Yahoo’s disclosure that a 2014 intrusion involved about 500 million accounts.
The SEC’s investigation looks into whether Yahoo disclosed information about the data breaches in timely enough fashion, The
Wall Street Journal reported Monday. SEC rules require companies to disclose data breaches and cyberattacks as soon as it is determined the incidents could have an effect on investors.
Representatives for the SEC, Yahoo and Verizon, which is in the process of buying Yahoo, declined to comment on the report.
After the close Monday, Yahoo reported better-than-anticipated earnings but said it would push off the close of its sale to Verizon to the second quarter “given work required to meet closing conditions.”
Yahoo shares rose 0.8% Monday and another 1% after the bell. Shares have risen 9% over the past month. Verizon shares fell 0.6%.
As part of its investigation, the SEC last month requested documents from Yahoo, the Journal said, citing persons familiar with the situation.
The agency has been seeking a model case for cybersecurity rules it issued in 2011, legal experts told the Journal.
In a November 2016 SEC filing, Yahoo noted that it was cooperating with the SEC, Federal Trade Commission and other federal, state, and foreign governmental officials and agencies, including “a number of State Attorneys General, and the U.S. Attorney’s office for the Southern District of New York.”
When Yahoo reported the 2014 breach, it said that evidence linked it to a state-sponsored attacker. It has not announced a suspected responsibility for the larger 2013 intrusion, but the company has said it does not believe the two breaches are linked.
Sen. Mark Warner, D-Va., a member of the Senate Intelligence and Banking committees, called for the SEC to investigate the 2014 breach in September 2016, saying “the public ought to know what senior executives at Yahoo knew of the breach, and when they knew it.”