SEC fines Yahoo $35 million for not telling investors about breach

The Securities and Exchange Commission fined Altaba, the holding company of the of the remaining bits and pieces of Yahoo, $35 million on Tuesday for failing to disclose its historic data breach to shareholders.

The big picture: Hackers stole hundreds of millions of usernames, email addresses, phone numbers, birthdates, encrypted passwords and security questions and answers from Yahoo in 2014. Yahoo did not disclose the breach until it began closing its sale to Verizon in 2016.

• The United States indicted Russian intelligence agents and co-conspirators for the hack in 2017.

What they're saying: “We do not second-guess good faith exercises of judgment about cyber-incident disclosure," said Steven Peikin, co-director of the SEC Enforcement Division. said in a written statement. "But we have also cautioned that a company’s response to such an event could be so lacking that an enforcement action would be warranted. This is clearly such a case.”