The SEC in December requested documents from the tech company concerning the cyberattacks, the paper reported.
US law requires companies that fall victim to such hacks disclose them as soon as they are deemed to affect stock prices .
Yahoo announced in September that hackers in 2014 stole personal data from more than 500 million of its user accounts. It admitted another cyberattack in December, this one dating from 2013, affecting over a billion users.
Yahoo is in the process of a buy-out by Verizon, which is investigating the cyberattacks‘ impact on the $4.8 billion deal.
