The SEC stated that: "This matter concerns material misstatements and omissions by Yahoo, one of the world's largest Internet media companies, regarding a 2014 data breach affecting more than 500 million of its user accounts. In late 2014, Yahoo learned of a massive breach of its user database that resulted in the theft, unauthorized access, and acquisition of hundreds of millions of its users' data, including usernames, birthdates, and telephone numbers. At that time, the breach was the largest known theft of user data. Despite its knowledge of the 2014 data breach, Yahoo did not disclose the data breach in its public filings for nearly two years."

The SEC stated that: "The Securities and Exchange Commission today announced that the entity formerly known as Yahoo! Inc. has agreed to pay a $35 million penalty to settle charges that it misled investors by failing to disclose one of the world's largest data breaches in which hackers stole personal data relating to hundreds of millions of user accounts. . . . The fact of the breach was not disclosed to the investing public until more than two years later, when in 2016 Yahoo was in the process of closing the acquisition of its operating business by Verizon Communications, Inc."