Yahoo admitted today that some of its employees were aware of the theft of 500 million users’ data as early as 2014 — years before Yahoo publicly acknowledged the hack, techcrunch reports. 

The hack, which Yahoo has attributed to an unnamed “state-sponsored actor,” occurred in late 2014, and according to today’s filing with the Securities and Exchange Commission, it seems Yahoo detected it early on.

“In late July 2016, a hacker claimed to have obtained certain Yahoo user data. After investigating this claim with the assistance of an outside forensic expert, the Company could not substantiate the hacker’s claim. Following this investigation, the Company intensified an ongoing broader review of the Company’s network and data security, including a review of prior access to the Company’s network by a state-sponsored actor that the Company had identified in late 2014,” Yahoo said in the filing.

Yahoo also reported that 23 consumer class action lawsuits have been filed in response to the breach, but that it’s too early to estimate monetary damages. It estimates the hack has led to a loss of $1 million so far.