Federal officials are investigating Yahoo over how promptly the beleaguered Internet company informed the public about its historic data breaches that together affected more than 1 billion consumers, according to a report by the Wall Street Journal.
The probe will reportedly seek to determine why Yahoo waited weeks to disclose knowledge last year of a hack that occurred in 2014, an incident that compromised 500 million user accounts. An earlier breach, in 2013, left about 1 billion customers at risk, though it was not until last fall that Yahoo discovered evidence of that attack, as well.
The investigation is being handled by the Securities and Exchange Commission, which in 2011 began requiring companies to disclose information about hacking risks or incidents that may affect investors in a "material" way. And it could become a major test case that lays down clearer expectations about when businesses must reveal that information, analysts told the Journal.
The investigation, which began in December, is in its early stages, the Journal reported, and although it could lead to an enforcement action by the agency, such steps are rare. An earlier SEC investigation into a 2013 breach at Target did not lead to a punishment of the retailer, even though the incident affected tens of millions of customer accounts. The SEC declined to comment for this article.
Shortly after Yahoo made its discovery of the 2014 hack public, critics called on the SEC for a deeper look at the company's conduct. In September, Sen. Mark R. Warner (D-Va.) said in a letter to the agency that Americans had the right to know "what senior executives at Yahoo knew of the breach, and when they knew it."
