Investigation focuses on whether two massive hacks should have been reported sooner to investors