Personal data was stolen from hundreds of millions of Yahoo users in the December 2014 breach attributed to Russian hackers. The SEC alleged that, although Yahoo senior managers and attorneys were told about the breach, the company failed to fully investigate. The breach wasn't disclosed to the investing public until more than two years later, when Yahoo was working on closing Verizon's acquisition of its operating business in 2016, the SEC said.