It's one of the largest data breach settlements in U.S. history, and it's the latest in a series of legal consequences related to security issues at Yahoo.
The SEC said Yahoo didn't properly investigate or consider whether to inform investors of its 2014 breach, which didn't become public until two years later.
Karim Baratov, a 22-year-old Kazakhstan-born Canadian citizen, was arrested in Toronto in March before waiving his right to fight extradition to the U.S. earlier this year.