The US Securities and Exchange Commission has opened an investigation into whether Yahoo should have informed investors sooner about two major data breaches, the Wall Street Journal has reported.
The SEC in December requested documents from the search company concerning the cyberattacks, the paper reported.
The SEC requires companies to disclose cybersecurity risks as soon as they are determined to have an effect on investors.
Yahoo announced in September that hackers in 2014 stole personal data from more than 500 million of its user accounts. It admitted another cyberattack in December, this one dating from 2013, affecting over a billion users.
Yahoo is in the process of a buy-out by Verizon, which is investigating the cyberattacks’ impact on the $4.8 billion deal.
The SEC’s investigation is focusing on why it took Yahoo several years to reveal the 2013 and 2014 attacks. However, the agency has not yet decided whether it will file suit against Yahoo, the Journal reported.
Yahoo is expected to report its fourth-quarter earnings for 2016 after the market closes on Monday.