The U.S. Securities and Exchange Commission is investigating Yahoo for its failure to promptly report two massive hacks of its systems to its investors.
Yahoo did not disclose the 2014 breach of 500 million user accounts until last September and then, in December, Yahoo admitted to yet another hack, this one in 2013, affecting one billion accounts.
The SEC in December demanded documents from Yahoo to determine if the company’s disclosures about the hacks complied with civil securities laws, sources told The Wall Street Journal. The SEC expects companies to divulge a cyber-attack as soon as it has been discovered to have an effect on investors.
The probe, sources told the WSJ, is likely to focus on the 2014 breach because, despite having been linked to state-sponsored hackers, it took Yahoo two years to go public with the information. Yahoo has yet to explain why it kept the information a secret.
The SEC has probed the actions of other firms in similar situations, although the agency has yet to take action against a company. For example, Target’s response to the cyber-attack that breached its systems between 2013 and 2014, making off with the credit card information of millions of customers, was investigated by the SEC. The agency found no evidence of wrongdoing, however.
The SEC investigation is one more headache for Yahoo to deal with as the tech firm tries to complete its $4.83-billion all-cash deal with Verizon. Originally scheduled to be completed by the first quarter of 2017, the sale of Yahoo’s Internet division, which was to be integrated with Verizon-owned AOL, has been put on hold.
Verizon, at one point, was said to be pushing for a $1-billion discount off the purchase price, but Marni Walden, EVP and president of the product innovation and new businesses organization at Verizon, has expressed doubt about the deal happening. When asked earlier this month if the transaction would still occur, she was quoted by Reuters as saying: “I can’t sit here today and say with confidence one way or another because we still don’t know.”
Whether Verizon will continue to push for a lower price or find a way to scrap the deal altogether is anyone’s guess, but one thing is certain, if the SEC finds Yahoo guilty mishandling of how and when it informed investors of the hack, it will not aid in the transaction’s completion.