Altaba (Yahoo) — $35M SEC + $117.5M class SOX fine (2018)

First SEC enforcement against a public company for failing to disclose a cyber breach

What happened

Yahoo experienced a 2014 breach affecting 500M (later revised to 3B) accounts but did not disclose it until late 2016. The SEC fined Yahoo $35M for misleading investors via securities filings that omitted the known breach, and a class action settled for $117.5M.

Root cause

• Senior management aware of breach but did not escalate to disclosure controls
• No mapping of cyber incidents to Item 105 / 1.05 disclosure triggers
• ICFR / disclosure controls did not include security incident materiality assessment

What every team should do

1. Cyber incidents need a documented materiality-assessment path into Disclosure Committee
2. SEC Cybersecurity Rule (Dec 2023): material incidents disclosed within 4 business days on Form 8-K Item 1.05
3. Annual Form 10-K Reg S-K Item 106 — disclose cyber risk management + governance

Related enforcement actions