The disclosure that was owed

Graduate · enrolled learners

This lesson opens with Yahoo, disclosure failure charged 2018.

What happened

In late 2014 Yahoo's information security team learned that hackers associated with the Russian Federation had stolen data associated with hundreds of millions of user accounts, at the time the largest known theft of user data. Within days, members of senior management and the legal team received internal reports that the theft had occurred. Yet for nearly two years Yahoo's public filings did not disclose the breach: its risk factors continued to describe data breaches as a risk that might happen in the future, a hypothetical, even though it knew a massive one already had. In July 2016, agreeing to sell its operating business to Verizon, Yahoo represented that it knew of no significant breaches. When the breach was finally disclosed in September 2016, Verizon renegotiated and cut the price by 350 million dollars, 7.25 percent. In 2018 the Securities and Exchange Commission charged the company, by then renamed Altaba, and it paid a 35 million dollar penalty, neither admitting nor denying the findings, in the first SEC fine based on investors having been misled by a failure to disclose a cyberattack. The breach was material and known, and the failure was not the hack: it was filing report after report that presented a realized, known event to investors as a mere possibility.

The decision point

A public company that files reports owes investors reports that are not misleading about material facts, the information a reasonable investor would consider important, and what makes a report misleading is judged against what the company knows, not against what is convenient to reveal. The precise failure Yahoo teaches is the difference between a risk and an event: a filing may honestly describe a breach as a risk that could occur, but once the company knows a major breach has occurred, continuing to present it as merely hypothetical is a false picture, because the risk factor now states a half-truth. Silence is not the safe harbor it looks like. US law does not treat bare silence as fraud, but Yahoo was not silent: every quarter it filed reports that discussed the very risk that had already materialized, and leaving the known event out of those reports is what made them misleading. For cybersecurity incidents the SEC has since set an explicit clock: a Form 8-K is due four business days after a company determines an incident is material, and the determination itself must be made without unreasonable delay after discovery. So the discipline is to disclose the material events you actually know, distinguishing what has happened from what merely might, because the disclosure that was owed is measured by what the company knew and its investors did not, and keeping a filing's comfortable risk language in place after the risk has happened is how a known omission becomes an enforcement action.

Recorded loss

$35,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.