SEC said to probe Yahoo data breaches
The Securities and Exchange Commission is reportedly investigating whether Yahoo should have notified investors sooner about the two massive data breaches that occurred at the company.
Last month, the Federal Bureau of Investigation said it had begun an investigation into a 2013 data breach that involved more than 1 billion users' accounts. That followed Yahoo's disclosure that a 2014 intrusion involved about 500 million accounts.
The SEC's investigation looks into whether Yahoo disclosed information about the data breaches in timely enough fashion, The Wall Street Journal reported Monday. SEC rules require companies to disclose data breaches and cyberattacks as soon as it is determined the incidents could have an effect on investors.
Representatives for the SEC, Yahoo and Verizon, which is in the process of buying Yahoo, declined comment on the report.
After the close Monday, Yahoo reported better-than-anticipated earnings but said it would push off the close of its sale to Verizon to the second quarter "given work required to meet closing conditions."
Yahoo (YHOO) shares rose 0.8% Monday and another 1% after the bell. Shares have risen 9% over the last month. Verizon shares fell 0.6%.
It's new and it's bad: Yahoo discloses 1B account breach
As part of its investigation, the SEC last month requested documents from Yahoo, the Journal said, citing persons familiar with the situation. The agency has been seeking a model case for cybersecurity rules it issued in 2011, legal experts told the Journal.
In a November 2016 SEC filing, Yahoo noted that it was cooperating with the SEC, Federal Trade Commission and other federal, state, and foreign governmental officials and agencies including "a number of State Attorneys General, and the U.S. Attorney’s office for the Southern District of New York."
When Yahoo reported the 2014 breach it said that evidence linked it to a state-sponsored attacker. It has not announced a suspected responsibility for the larger 2013 intrusion, but the company has said it does not believe the two breaches are linked.
Sen. Mark Warner, D-Va., a member of the Senate Intelligence and Banking committees, called for the SEC to investigate the 2014 breach in September 2016, saying "the public ought to know what senior executives at Yahoo knew of the breach, and when they knew it.”
The revelations of the cyberattacks came after Verizon in July 2016 announced its plan to acquire Yahoo for $4.8 billion. Since then, some Verizon executives have publicly questioned the cost of the deal in the wake of the breaches.
As to whether the telecom giant might abandon the deal, Verizon executive Marni Walden said earlier this month that the acquisition still made sense. However, she said, "I can't sit here today and say with confidence one way or another because we still don't know."
Follow USA TODAY reporter Mike Snider on Twitter: @MikeSnider.