Yahoo's failure to disclose a 2014 data breach involving Russian hackers has resulted in a $35 million fine from the Securities and Exchange Commission for misleading investors.
The data breach involved 500 million user accounts, but even though Yahoo executives were aware of the incident as early as December 2014, they refrained from telling the public about it or doing a full investigation, the SEC said.
As a result, Yahoo investors were left "totally in the dark about a massive data breach" that had financial implications, Jina Choi, an SEC director, said in a statement.
Yahoo only decided to reveal the breach when, in September 2016, the company began investigating claims that the stolen data was up for sale on the black market. By then, Yahoo was in the process of being acquired by Verizon. The hacking revelations resulted in Verizon dropping its purchase price by $350 million.
The $35 million fine, however, won't be leveled at Verizon, which finalized the Yahoo deal in 2017. The penalty was levied against the holding company Altaba, or what remains of Yahoo's assets.
Altaba declined to comment. But according to the SEC, the company has agreed to pay the fine.
The FBI later indicted four suspects, including two officers from a Russian spy agency, for carrying out the hack against Yahoo. Usernames, email addresses, phone numbers, birthdates, and scrambled-versions of passwords were stolen.
US Senator Mark Warner supported the SEC's move to penalize the company. "I've been saying for years that Yahoo's failure to notify customers and investors about its massive data breach didn't pass the smell test," he tweeted. "Holding the company accountable is important, and I hope others will learn you can't sweep this kind of thing under the rug."
Although the SEC charged Yahoo with misleading investors, failing to disclose the data breach also put actual users in jeopardy. Essentially, the Russian hackers had two years to exploit the stolen data. According to federal investigators, the Russian hackers used the information to target Yahoo accounts belonging to Russian and US government officials. They also went after regular users by looking for data, including credit card numbers.
This breach is separate from a 2013 hack that affected more than 1 billion Yahoo accounts.