The disclosure that was owed

Graduate · enrolled learners

This lesson opens with Yahoo, disclosure failure charged 2018.

What happened

In late 2014 Yahoo's security team learned that state-sponsored hackers had stolen data associated with hundreds of millions of user accounts, one of the largest breaches known at the time. Senior management and legal knew within days. Yet for roughly two years Yahoo did not disclose the breach to investors, and in its public filings it continued to describe data breaches as a risk that could happen in the future, a hypothetical, even though it knew a massive one already had. When the breach was finally revealed in 2016, during the sale of Yahoo's operating business, the price of that business was cut. In 2018 the Securities and Exchange Commission charged the company, by then renamed Altaba, and it paid a 35 million dollar penalty, the SEC's first for failing to disclose a data breach. The breach was material and known, and the failure was not the hack: it was presenting a realized, known event to investors as a mere possibility, and staying silent about the disclosure that was owed.

The decision point

A public company owes investors disclosure of material facts, the information a reasonable investor would want in deciding whether to invest, and the duty attaches to what the company knows, not to what is convenient to reveal. The precise failure Yahoo teaches is the difference between a risk and an event: a filing may honestly describe a breach as a risk that could occur, but once the company knows a major breach has occurred, continuing to present it as merely hypothetical is a false picture, because a realized, known material event must be disclosed rather than folded back into a list of things that might someday happen. And silence itself is a failure: withholding a known material fact is not neutral, it is an omission the law treats as reportable, which is why staying quiet for two years about a breach it knew of was the violation, not just a delay. So the discipline is to disclose the material events you actually know, distinguishing what has happened from what merely might, because the disclosure that was owed is defined by what the company knew and its investors did not, and closing that gap honestly and promptly is the obligation, while managing the timing to protect a price or a deal is how a known omission becomes an enforcement action.

Recorded loss

$35,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.