(Photo: Jason Doiy/ALM)

This week, the U.S. Securities and Exchange Commission and Altaba Inc., (formerly known as Yahoo! Inc), came to a $35 million settlement over the company's alleged failure to disclose a massive data breach that was discovered in 2014 but, according to the commission, was not reported to investors until 2016.

Attorneys who work on cybersecurity matters believe this action will be far from the last of its kind—and that the SEC will continue to pursue publicly traded companies that it believes are not keeping investors informed enough.

“This is a Rubicon moment,” said Denver Edwards, a principal at Bressler Amery Ross. He said the SEC has been talking “for a long time” about cracking down on publicly traded companies that fail to properly report data breaches to investors and regulators.

The breach allowed Russian hackers to gain access to usernames, birthdates, telephone numbers and encrypted emails and affected over 500 million of its users' accounts. It also impacted the company's former GC, Ron Bell, who resigned after the in-house legal team was blamed in part for not sufficiently pursuing an investigation of the attack.

Yahoo neither admitted nor denied the SEC's allegations.

Companies deciding when to speak up about a breach face competing regulations and business interests. Edwards said that, before reporting data breaches, companies must “not jump out in front without having the material in hand.” He said it is reasonable for a company to gather as much information as possible before reporting the breach, however they should also notify the SEC as soon as possible.

The amount of time companies can put off telling regulatory agencies about a data breach varies from state to state. Edward McAndrew, partner at Ballard Spahr, said that in some states, such as New York, companies have as little as 72 hours to report a breach after they have a reasonable suspicion of one occurring, but other states give companies as many as 45 to 60 days to report to state authorities.

Robert E. Cattanach, a partner at Dorsey & Whitney in Minneapolis specializing in cybersecurity, said three things should be done when a company reasonably suspects a breach might have occurred. He said the breach should be confirmed, there should be a blackout on trading in that company's stock, and the breach should be reported. “That sequence should be done within hours,” Cattanach said.

McAndrew said that attorneys should be more careful in how they speak about cybersecurity. What got Yahoo in trouble, he said, is that the company wrote in its quarterly and annual filings “[W]e may be at risk for future data breaches.”

“That language is going to be problematic where there is any type of significant data breach,” McAndrew said. “In-house lawyers are going to have to be much more careful that they are not misrepresenting, by omission, cyber incident history.”

Ultimately, he said, the legal department is going to have to be more involved in instances of data breaches than Yahoo's legal team appeared to be.

“One of the lessons for the general counsel is they have to be quarterbacking these investigations,” McAndrew said. “If they're not in the loop in the investigation, they're not going to be able to make decisions.”