Yahoo Class Action Lawsuit Filed Over Massive Data Breach

Less than a day after news broke that more than 500 million Yahoo accounts had been hacked, two San Diego users filed a class action lawsuit accusing the tech company of putting their finances at risk and failing to notify them earlier about the breach.

Plaintiffs Jennifer Myers and Paul Dugas allege in their Yahoo data breach class action lawsuit their private information was compromised.

They accuse Yahoo of “deceptive practices” and “negligence,” alleging the tech giant did not take reasonable care to prevent the hack.

The 23-page complaint states that “damage caused by identity theft in general registers in the billions of dollars.”

Additionally, the proposed class action lawsuit alleges Yahoo took an “unusually long period of time” uncovering the breach, and in the two years since it was hacked and disclosed, people were at risk of identity theft.

“While investigating another potential data breach, Yahoo uncovered this data breach, dating back to 2014,” the lawsuit states. “Two years is unusually long period of time in which to identify a data breach.”

The data breach, announced on Sept. 22, 2016, actually took place in late 2014 and appears to the largest in history, according to security experts.

Users’ email addresses, birthdates, phone numbers, passwords with various levels of encryption, security questions and answers “may” have been among the data stolen, Yahoo announced last Thursday. The company said users’ financial information had not been compromised.

However, Myers and Dugas claim Yahoo users’ financial information had been breached.

David S. Casey Jr., attorney for the pair, said it wasn’t necessary for financial data to have been stolen to jeopardize users’ finances, as non-financial information can be used to steal identities and gain access to personal finances.

“The type of information compromised in this data breach is highly valuable to perpetrators of identity theft,” Myers and Dugas wrote. “Plaintiffs and class members are at risk for identity theft in its myriad forms, potentially for the remainder of their lives.”

Other allegations against Yahoo in the San Diego lawsuit include deception, misrepresentation, invasion of privacy and negligence.

The plaintiffs are seeking to represent a certified nationwide Class of Yahoo account holders whose personal and financial information was accessed, compromised, or stolen from Yahoo in 2014 as well as a California subclass.

A similar complaint filed in the U.S. District Court in San Jose on Friday says Yahoo was “grossly negligent” in dealing with and reporting the security breach.

Plaintiff Ronald Schwartz, of New York, claims his personal information was stolen. His class action lawsuit calls Yahoo’s treatment of users’ data “grossly negligent” and alleges that circumstantial evidence indicates “Yahoo insiders” knew of the breach “long before it was disclosed.”

Another proposed nationwide class action lawsuit filed by Illinois residents, Christopher Havron and Katelyn Smith, against Yahoo on Thursday in Illinois federal court, alleges breach of express and implied contract, breach of good faith, unjust enrichment and a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.

Myers and Dugas are represented by David S. Casey Jr., Gayle M. Blatt and Wendy M. Behan of Casey Gerry Schenk Francavilla Blatt & Penfield LLP, and Deval R. Zaveri and James A. Tabb of Zaveri Tabb APC.

The Yahoo User Data Breach Class Action Lawsuit is Jennifer J. Myers, et al. v. Yahoo! Inc., Case No. 3:16-cv-02391, in the U.S. District Court for the Southern District of California.

UPDATE: On Aug. 30, 2017, Yahoo will continue to face a massive data breach class action lawsuit following a federal judge’s denial of the company’s motion for dismissal.

UPDATE 2: On March 9, 2018, a federal judge trimmed some claims in a Yahoo email data breach multidistrict litigation, but lets others stand, finding flaws in most of the consumers’ effort to sue for punitive damages.

UPDATE 3: On Oct. 22, 2018, Yahoo users are seeking approval from a California federal judge for a $50 million settlement deal that would end three class action lawsuits claiming that Yahoo’s negligence led to data breaches affecting American and Israeli email users.

UPDATE 4: On Jan. 28, 2019, a federal judge denied a $50 million Yahoo class action settlement, finding the proposed deal lacked specific information about ways the tech company would improve data security.

UPDATE 5: On April 9, 2019, Yahoo has now agreed to pay $117.5 million to resolve legal claims regarding three large data breaches that affected the internet company.

UPDATE 6: On July 20, 2019, a federal judge has preliminarily signed off on a $117 million class action settlement agreement between Yahoo and accountholders who were affected by numerous data breaches.

UPDATE 7: September 2019, the Yahoo data breach class action settlement is now open. Click here to file a claim.