Six Democratic U.S. Senators on Tuesday said it was “unacceptable” that Yahoo only last week announced a 2014 hack into 500 million user accounts and asked embattled CEO Marissa Mayer for more information about the company’s investigation into the data breach.
The lawmakers said they were “disturbed” the two-year-old intrusion was detected so long after the hack occurred.
“That means millions of Americans’ data may have been compromised for two years,” the senators wrote in a joint letter addressed to Mayer. “This is unacceptable.”
Yahoo did not immediately respond to a request for comment about the letter.
Yahoo has faced mounting questions about exactly when it knew about the 2014 cyber attack that exposed the email credentials of users, a critical issue for the company as it seeks to prevent the breach from affecting a pending takeover of its core business by Verizon (VZ).
The internet firm has said it detected the breach this summer after conducting a security review prompted by an unrelated hack claim that turned out to be meritless. Yahoo has not given a precise timeline explaining when it was made aware of the 2014 attack, or if it knew of the breach before announcing the deal with Verizon in late July.
The senators requested a briefing from Yahoo to explain the company’s investigation into the breach, its cooperation with law enforcement and national security authorities, and plans to protect affected users.
The letter was signed by Sens. Patrick Leahy, Al Franken, Elizabeth Warren, Richard Blumenthal, Ron Wyden, and Edward Markey.
The senators asked Mayer for a timeline of the hack and its discovery and how such a large breach went undetected for so long. They also asked what Yahoo was doing to prevent another breach in the future, if the company has changed its security protocols, and whether the U.S. Government had warned of a possible hacking attempt.
The letter came a day after Democratic Senator Mark Warner asked the U.S. Securities and Exchange Commission to investigate whether Yahoo and its senior executives fulfilled obligations to inform investors and the public about the hacking attack, which Yahoo has blamed on a “state-sponsored actor.”