Lawmaker urges SEC to investigate Yahoo hack
What exactly did Yahoo (YHOO) leaders know about the massive theft of its users’ personal data before publicly disclosing the hack, and when did they know it?
That’s what Sen. Mark Warner, D-Virginia, wants to know in asking the Securities and Exchange Commission (SEC) to investigate the breach, in which email addresses, telephone numbers, scrambled passwords and other information belonging to 500 million accounts were stolen by what Yahoo has described as a “state-sponsored actor.”
“I encourage you to investigate whether Yahoo and its senior executives fulfilled their obligations to keep investors and the public informed, and whether the company made complete and accurate representations about the security of its IT systems,” he said in a letter on Monday to SEC Chair Mary Jo White.
Warner also questioned when Yahoo informed Verizon (VZ), which agreed in July to buy the company’s core internet business for $4.8 billion, of the breach.
Yahoo said in a regulatory filing on September 9 that it was unaware of any attacks on its tech systems.
Citing published reports, Warner said Yahoo did not inform Verizon of the hack, the largest in corporate history, until September 20. Under U.S. securities law, public companies must disclose events that can have a material impact on their value within four business days, typically through a so-called 8-K filing.
A Verizon spokesperson on Thursday said the company had been notified of Yahoo’s security incident within the past two days.
“A breach of the magnitude that Yahoo and its users suffered seems to fit squarely within the definition of a material event,” said Warner, who also wants the SEC to evaluate whether the agency’s disclosure requirements for data breaches are adequate.
Yahoo has not specified when the data theft occurred, saying only that it took place in “late 2014.” The company did not immediately respond to a request for comment.
An SEC investigation could cause trouble for Yahoo as it seeks to close the deal with Verizon early next year, potentially giving the wireless company leverage to reduce its acquisition offer, or even abandon the purchase.
Yahoo shares, which had steadily risen after the sale to Verizon was announced on July 25, closed Monday at $42.29.