The US Securities and Exchange Commission has fined Altaba, the company formerly known as Yahoo!, USD 35 million for failing to disclose the major personal data breach on its site and misleading investors.
According to the SEC, Yahoo’s information security team was aware of the 2014 breach within days of the Russian hacking attempt, which affected hundreds of millions of user accounts. Although information relating to the breach was reported to members of Yahoo’s senior management and legal department, Yahoo failed to properly investigate the circumstances of the breach and to adequately consider whether the breach needed to be disclosed to investors. In the end the breach was not disclosed to the public until more than two years later, when Yahoo was in the process of closing the acquisition of its operating business by Verizon.
The SEC said public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors. None such information on the attack appeared in Yahoo's regular SEC filings in the two-year period.
