SEC Issues $35 Million Fine For Alleged Failure To Disclose Data Breach

On 24 April 2018, the SEC instituted a settled administrative proceeding against Altaba Inc., f/d/b/a Yahoo! Inc. (Yahoo!) for allegedly failing to disclose a significant data breach that affected its user accounts, in violation of Sections 17(a)(2) and 17(a)(3) of the Securities Act and Section 13(a) of the Exchange Act. The SEC imposed a $35 million penalty on Yahoo!, which neither admitted nor denied the SEC's findings.

Yahoo! provides more than a billion users worldwide with Internet search services, emails, and digital content. According to the SEC, in late 2014, Yahoo! learned of a breach in its user database that resulted in the theft of hundreds of millions of its users' personal data, including usernames, telephone numbers, dates of birth and passwords. Although the company's senior management was notified of the breach, Yahoo!'s auditors and outside counsel were not, and Yahoo!'s internal disclosure controls did not mandate that the breach be assessed to