Yahoo — or rather, the shell company holding on to its remnants — will have to pay a $35 million fine for failing to disclose a 2014 data breach in which hackers stole info on over 500 million accounts. The US Securities and Exchange Commission announced today that Altaba, which contains Yahoo’s remains, agreed to pay the fine to settle charges that it misled investors by not informing them of the hack until September 2016, despite knowing of it as early as December 2014.
The SEC admonishes Yahoo for its failure to disclose the breach to investors, saying that the agency wouldn’t “second-guess good faith exercises of judgment” but that Yahoo’s decisions were “so lacking” that a fine was necessary.
Yahoo isn’t being fined for having poor security practices, not informing users, or really anything related to the hack happening.
“Public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors,” Jina Choi, director of the SEC’s San Francisco Regional Office, said in a statement.
The SEC released guidance to public companies on what to disclose about data breaches earlier this year, which could help to avoid similar situations in the future.
The hack is said to be done by Russian agents and other criminals, who the US Justice Department is attempting to prosecute. They obtained data from Yahoo including usernames, email addresses, encrypted passwords, birthdates, phone numbers, and security questions.
Yahoo revealed the breach shortly after reaching an agreement to be purchased by Verizon in July 2016. That acquisition has since closed, but Verizon didn’t purchase all of Yahoo. And apparently, it left behind the portion that was liable for this failure.
