The SEC are investigating whether Yahoo could have told investors sooner about two mega-breaches in 2014.