Failure to report the data breach could lead to prosecution in the case of Yahoo.