Hector Mata/Getty Images

Yahoo's cybersecurity failures continue to haunt the company -- now to the tune of $35 million.

The US Securities and Exchange Commission said Tuesday that Altaba, the company formed from the ashes of Yahoo's sale to Verizon, has agreed to pay a penalty of that amount to settle charges that Yahoo failed to disclose a massive data breach from December 2014.

That breach, a state-sponsored attack, affected at least 500 million users and was considered the largest data breach in history until Yahoo announced that all 3 billion accounts on the website had been hit in a separate, 2013 hack.

In the 2014 breach, Russian hackers stole data including phone numbers, passwords, birth dates and email addresses. The cyberattack didn't become public knowledge until 2016, when Yahoo announced it in a press release.

Now playing: Watch this: All Yahoo users affected by largest hack in history

"Yahoo's failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach," Jina Choi, director of the SEC's San Francisco regional office, said in a statement.

Altaba declined to comment.

Disclosing breaches to the public in a timely manner is important, for both investors and the people using the platform. It ensures that people can take precautions with their digital lives before it's too late. But companies have been slow to announce these hacks.

Multiple tech companies have faced scandals over being tardy to disclose a breach. In March, the Pennsylvania attorney general slammed Uber for waiting more than a year to reveal a breach. Facebook has been criticized for its Cambridge Analytica data scandal -- though no breach was involved -- because the social network took up to two years to notify the public after it learned about the issue, in 2015.

"I've been saying for years that Yahoo's failures to notify customers and investors about its massive data breach didn't pass the smell test," Sen. Mark Warner, a Democrat from Virginia, said in a statement. "Holding the company accountable is important, and I hope others will learn you can't sweep this kind of thing under the rug."

The SEC launched its investigation in January 2017, arguing that Yahoo misled investors by keeping quiet about its breaches. The revelations came as Yahoo was attempting to close a $4.83 billion acquisition deal from Verizon. The cybersecurity shortcomings led Verizon to knock $350 million off its buying price and insist that the companies split legal and financial responsibilities related to the hack.

In a separate SEC filing from 2016, Yahoo admitted that some of its employees were aware of the 2014 breach but failed to disclose it.

The Justice Department has indicted the four hackers responsible for Yahoo's 2014 hack, though the attackers behind the 2013 breach are still unknown. Marissa Mayer, Yahoo's CEO during the breaches, apologized to Congress last November, but she didn't explain why it took so long to announce the attack.

First published 9:35 a.m. PT

Updates, 9:47 a.m.: Includes details on breach disclosures; 10:02 a.m.: Adds statements from Sen. Mark Warner and Altaba.

Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.

Follow the Money: This is how digital cash is changing the way we save, shop and work.</s>Altaba, the company formerly known as Yahoo, will have to pay a $35 million fine for failing to disclose a 2014 data breach in which hackers stole info on over 500 million accounts . "The U.S. Securities and Exchange Commission announced today that Altaba, which contains Yahoo's remains, agreed to pay the fine to settle charges that it misled investors by not informing them of the hack until September 2016, despite known of it as early as December 2014," reports The Verge. From the report:</s>If you haven't been keeping tabs on Yahoo lately, you wouldn't be alone. With the exception of the massive 2014 data breach that exposed the personal data of roughly 500 million users, the company has all but dropped off the map for many.

Unfortunately for Yahoo, that very data breach has come back to haunt them yet again. Although the breach initially took place in 2014, Yahoo never disclosed the incident - it wasn't until 2016 that the media discovered the breach and began reporting on it.

As we reported in January last year, the SEC opened an investigation into the matter to determine whether or not Yahoo's decision to avoid disclosing the breach broke any laws.

Now, the SEC has finally come to a decision. The organization has announced that the "entity formerly known as Yahoo! Inc." has agreed to pay a $35 million penalty to settle charges that it misled investors by "failing to disclose one of the world’s largest data breaches."

...the SEC's Steven Peikin made it clear that the commission doesn't take issue with a company simply taking some additional time to disclose a breach...

In a statement, the SEC's Steven Peikin made it clear that the commission doesn't take issue with a company simply taking some additional time to disclose a breach -- indeed, in some cases it's necessary -- but he warns that the organization's patience is not infinite.

"...we [have cautioned] that a company’s response to such an event could be so lacking that an enforcement action would be warranted," Peikin said regarding the incident. "This is clearly such a case."</s>Altaba, formerly known as Yahoo, has agreed to a pay $35 million to the Securities and Exchange Commission for the company’s failure to disclose on the largest data breaches in history.</s>The Securities and Exchange Commission on Tuesday announced a $35 million fine against the company formerly known as Yahoo for failing to tell investors about a massive cyber breach for two years, the first time the regulator has punished a company for such conduct.

The Web giant learned in 2014 that Russian hackers had stolen the user names, email addresses and other key user data of 500 million of its users, the largest breach of its kind at the time. But it didn’t tell investors about it for nearly two years, according to the SEC.

Yahoo left “its investors totally in the dark about a massive data breach,” Jina Choi, director of the SEC’s San Francisco regional office, said in a statement.

Yahoo, which sold its core business to Verizon last year for $4.8 billion and renamed itself Altaba, did not admit wrongdoing as part of the settlement. The company declined to comment. SEC officials declined to comment on whether any former or current executives could be held personally responsible for the lapse, noting that the investigation is ongoing.

The case highlights a common complaint in the wake of a growing number of cyber breaches: Companies often take months, sometimes years, to disclose a suspected breach, if they report them publicly at all. Equifax, for example, disclosed last year that hackers had obtained sensitive information, including Social Security numbers and dates of birth, for more than 143 million people. The breach began in May and was discovered by the company at the end of July, but it wasn’t reported to the public until September.

[Former Equifax executive charged with illegally trading before massive data breach was made public]

In the Yahoo case, company executives failed to tell the public about the hack even after learning that sensitive information that it referred to as “crown jewels” had been stolen, according to the SEC. The hackers also gained access to the email accounts of 26 Yahoo users who had connections to Russia, according to SEC court documents. Eventually, Yahoo would reveal that information about all 3 billion of its users had been stolen as part of a separate breach.

“I’ve been saying for years that Yahoo’s failure to notify customers and investors about its massive data breach didn’t pass the smell test,” Sen. Mark R. Warner (D-Va.) said Tuesday on Twitter. “Holding the company accountable is important, and I hope others will learn you can’t sweep this kind of thing under the rug.”

The SEC is not trying to second-guess good-faith efforts by companies to properly respond to a cyber breach, said Steven Peikin, co-director of the SEC enforcement division. “We are aware of the challenges that companies face” from hackers, he said, but the Yahoo case reflected a “complete corporate failure.”

Peikin said the first-of-its-kind fine “should serve as a message to other companies.”</s>(RTTNews) - The U.S. Securities and Exchange Commission said that Altaba Inc. (AABA), formerly known as Yahoo! Inc., has agreed to pay a $35 million penalty to settle charges that it misled investors by failing to disclose one of the world's largest data breaches in which hackers stole personal data relating to hundreds of millions of user accounts.

According to the SEC's order, within days of the December 2014 intrusion, Yahoo's information security team learned that Russian hackers had stolen what the security team referred to internally as the company's "crown jewels": usernames, email addresses, phone numbers, birthdates, encrypted passwords, and security questions and answers for hundreds of millions of user accounts.

Although information relating to the breach was reported to members of Yahoo's senior management and legal department, Yahoo failed to properly investigate the circumstances of the breach and to adequately consider whether the breach needed to be disclosed to investors. The fact of the breach was not disclosed to the investing public until more than two years later, when in 2016 Yahoo was in the process of closing the acquisition of its operating business by Verizon Communications, Inc.</s>Altaba, the holding company formed to carry the remains of Yahoo after it sold its core business to Verizon, has agreed to pay a $35 million fine to the Securities and Exchange Commission for Yahoo’s failure to quickly inform users about several massive breaches.

Hackers stole credentials for all 3 billion Yahoo accounts as well as some personal information in 2013. A separate 2014 incident affected 400 million Yahoo accounts. In the 2014 breach, hackers forged cookies that enabled them to log into targeted accounts without obtaining the passwords.

Yahoo didn’t disclose the breaches until late 2016, after its sale to Verizon was already underway. Verizon ultimately negotiated a $350 million decrease in the acquisition price, due to Yahoo’s poor cybersecurity and incident response.

“We do not second-guess good faith exercises of judgment about cyber-incident disclosure,” Steven Peikin, co-director of the SEC Enforcement Division, said in a statement. “But we have also cautioned that a company’s response to such an event could be so lacking that an enforcement action would be warranted. This is clearly such a case.”

In quarterly and annual reports Yahoo filed with the SEC between the 2014 breach and the 2016 disclosure, it made no mention of the breach or its potential impact on investors.

“Yahoo’s failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach,” said Jina Choi, director of the SEC’s San Francisco Regional Office. “Public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors.”</s>WASHINGTON, April 24 (Reuters) - U.S. regulators fined Altaba, the company formerly known as Yahoo! Inc., $35 million on Tuesday to settle charges that kept its massive 2014 cyber security breach a secret from investors for more than two years.

The Securities and Exchange Commission’s case marks the first time it has ever gone after a company for failing to disclose a cyber security breach.

The company agreed to settle the charges without admitting or denying any wrongdoing. (Reporting by Sarah N. Lynch)</s>WASHINGTON/SAN FRANCISCO (Reuters) - U.S. regulators fined Altaba Inc, the company formerly known as Yahoo! Inc, $35 million on Tuesday to settle charges that kept its massive 2014 cyber security breach a secret from investors for more than two years.

The Securities and Exchange Commission's case marks the first time it has ever gone after a company for failing to disclose a cyber security breach.

Altaba agreed to settle without admitting or denying any wrongdoing.

An Altaba spokesman did not immediately respond to a request for comment.

Yahoo's information security team learned just days after the December 2014 breach that Russian hackers had stolen the company's "crown jewels," including email addresses, encrypted passwords and security questions, the SEC said in a statement.

Despite becoming aware of the breach and having it reported to Yahoo's senior management and legal department, the company failed to properly investigate and did not disclose it to the public until more than two years later, when it was in the process of being acquired by Verizon Communication Inc, the regulator said.

The U.S. Justice Department announced charges last year against four men, including two officers in Russia's Federal Security Service, for their roles in the theft of 500 million Yahoo accounts.

One of them, Karim Baratov, a Canadian citizen born in Kazakhstan, pleaded guilty late last year to charges related to helping Russian intelligence agents break into email accounts as part of a massive 2014 breach.

Baratov was expected to be sentenced on Tuesday for his role in the Yahoo hack.

During its investigation into the 2014 breach, Yahoo uncovered a separate 2013 breach that compromised all 3 billion of its accounts, which is by far the largest known breach of consumer information.</s>Washington D.C.--(Newsfile Corp. - April 24, 2018) - The Securities and Exchange Commission today announced that the entity formerly known as Yahoo! Inc. has agreed to pay a $35 million penalty to settle charges that it misled investors by failing to disclose one of the world's largest data breaches in which hackers stole personal data relating to hundreds of millions of user accounts.

 

According to the SEC's order, within days of the December 2014 intrusion, Yahoo's information security team learned that Russian hackers had stolen what the security team referred to internally as the company's "crown jewels": usernames, email addresses, phone numbers, birthdates, encrypted passwords, and security questions and answers for hundreds of millions of user accounts. Although information relating to the breach was reported to members of Yahoo's senior management and legal department, Yahoo failed to properly investigate the circumstances of the breach and to adequately consider whether the breach needed to be disclosed to investors. The fact of the breach was not disclosed to the investing public until more than two years later, when in 2016 Yahoo was in the process of closing the acquisition of its operating business by Verizon Communications, Inc.

 

"We do not second-guess good faith exercises of judgment about cyber-incident disclosure. But we have also cautioned that a company's response to such an event could be so lacking that an enforcement action would be warranted. This is clearly such a case," said Steven Peikin, Co-Director of the SEC Enforcement Division.

 

Jina Choi, Director of the SEC's San Francisco Regional Office, added, "Yahoo's failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach. Public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors."

 

The SEC's order finds that when Yahoo filed several quarterly and annual reports during the two-year period following the breach, the company failed to disclose the breach or its potential business impact and legal implications. Instead, the company's SEC filings stated that it faced only the risk of, and negative effects that might flow from, data breaches. In addition, the SEC's order found that Yahoo did not share information regarding the breach with its auditors or outside counsel in order to assess the company's disclosure obligations in its public filings. Finally, the SEC's order finds that Yahoo failed to maintain disclosure controls and procedures designed to ensure that reports from Yahoo's information security team concerning cyber breaches, or the risk of such breaches, were properly and timely assessed for potential disclosure.

 

Verizon acquired Yahoo's operating business in June 2017. Yahoo has since changed its name to Altaba Inc.

 

Yahoo neither admitted nor denied the findings in the SEC's order, which requires the company to cease and desist from further violations of Sections 17(a)(2) and 17(a)(3) of the Securities Act of 1933 and Section 13(a) of the Securities Exchange Act of 1934 and Rules 12b-20, 13a-1, 13a-11, 13a-13, and 13a-15.

 

The SEC's investigation, which is continuing, has been conducted by Tracy S. Combs of the Cyber Unit and supervised by Jennifer J. Lee and Erin E. Schneider of the San Francisco office.

 

Earlier this year, the SEC adopted a statement and interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents.
The U.S. Securities and Exchange Commission fines Altaba US$35 million for failing to disclose its 2014 data breach in a timely manner.