The US Securities and Exchange Commission has opened an investigation into whether Yahoo should have informed investors sooner about two major data breaches, the Wall Street Journal reported Sunday, citing people familiar with the matter.
The SEC in December requested documents from the tech company concerning the cyberattacks, the paper reported.
US law requires companies that fall victim to such hacks disclose them as soon as they are deemed to affect stock prices.
Yahoo announced in September that hackers in 2014 stole personal data from more than 500 million of its user accounts. It admitted another cyberattack in December, this one dating from 2013, affecting over a billion users.
Yahoo is in the process of a buy-out by Verizon, which is investigating the cyberattacks' impact on the $4.8 billion deal. The telecom giant plans to acquire Yahoo's core business, namely its online advertising activities as well as websites including Yahoo Mail and Yahoo News.
The SEC's investigation is focusing on why it took Yahoo several years to reveal the 2013 and 2014 attacks. However, the agency has not yet decided whether it will file suit against Yahoo, the Journal reported.
Yahoo is expected to report its fourth-quarter earnings for 2016 after the market closes on Monday.
The data breaches have been a major embarrassment for a former internet star that has failed to keep up with Google, Facebook and other rising stars.
Explore further: Yahoo chief Marissa Mayer to leave company board after Verizon sale