Yahoo Data Breach Class Action Survives Motion for Dismissal

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Yahoo will continue to face a massive data breach class action lawsuit following a federal judge’s denial of the company’s motion for dismissal.

U.S. District Judge Lucy H. Koh granted defendant Yahoo! Inc.’s motion for dismissal on some claims but denied it on others, ultimately allowing the Yahoo data breach class action lawsuit to continue.

Judge Koh determined that the plaintiffs’ alleged increased risk of identity theft is injury enough to satisfy the basic requirements of standing.

Contractual claims and claims for violations of certain California consumer protection laws will be allowed to proceed. Plaintiffs will have a chance to revise and resubmit most of their denied claims. Certain claims under the California Consumer Records Act and Online Privacy Protection Act were dismissed with prejudice.

This consolidated Yahoo class action lawsuit combines claims from 12 different plaintiffs originally filed in separate actions, all seeking to hold Yahoo accountable for the exposure of personally identifiable information associated with their Yahoo user accounts. Their separate claims were consolidated last December.

Plaintiffs claim Yahoo has been subject to a large number of security breaches that should have put the company on notice long ago that it is a prime target for cybersecurity attacks. Yet requests by Yahoo’s security team for new protections were allegedly rejected, either because the requested features were too expensive or complicated, or because the supposed security problems were not considered a priority.

Three specific breaches that occurred between 2013 and 2016 are the subjects of the current Yahoo class action lawsuit. In the first breach, hackers made off with the personally identifiable information of more than one billion Yahoo users. Stolen information included users’ logins and hashed passwords, dates of birth, and cell phone numbers, and hackers also got access to the content of users’ emails.

Yahoo did not disclose this 2013 breach until December 2016, the plaintiffs say. Plaintiff Amy Vail filed her Yahoo data breach class action lawsuit shortly thereafter.

Plaintiffs now claim the breach could have been avoided had Yahoo made a timely upgrade of its encryption technology. Instead, the company continued to use technology known as MD5, which according to plaintiffs had long been considered “cryptographically broken and unsuitable for further use” by the time the 2013 breach happened.

The second breach happened in 2014 when an upper-level Yahoo employee fell for a “spear phishing” campaign, giving hackers access to around 500 million user accounts.

Yahoo allegedly delayed announcement of this breach until September 2016 so as not to scuttle a deal in which Verizon would purchase Yahoo’s operating assets. Days after that announcement, plaintiffs Jennifer Myers and Paul Dugas filed their own Yahoo class action lawsuit.

In the third breach, stretching from 2015 to 2016, hackers used forged cookies to get access to around 32 million user accounts without needing their passwords. Use of the forged cookies allowed hackers to remain logged in for extended periods of time.

Plaintiffs’ counsel are John A. Yanchunis of Morgan & Morgan Complex Litigation Group, Ariana J. Tadler of Milberg LLP, Karen Hanson Riebel of Lockridge Grindal Nauen PLLP, Stuart A. Davidson of Robbins Geller Rudman & Dowd LLP, and Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP.

The Yahoo Data Breach Consolidated Class Action Lawsuit is In re: Yahoo! Inc. Customer Data Security Breach Litigation, Case No. 5:16-md-02752, in the U.S. District Court for the Northern District of California.

UPDATE: On Oct. 3, 2017, Yahoo announced that the personal private information of all 3 billion Yahoo users was exposed in a 2013 data hack.

UPDATE 2: On Jan. 19, 2018, Yahoo requested another round of dismissals in a litigation over three data breaches that exposed millions of users’ sensitive information. According to Yahoo, three of the plaintiffs have failed to allege that they were financially harmed.

UPDATE 3: On March 9, 2018, a federal judge trimmed some claims in a Yahoo email data breach multidistrict litigation, but lets others stand, finding flaws in most of the consumers’ effort to sue for punitive damages.

UPDATE 4: On Oct. 22, 2018, Yahoo users are seeking approval from a California federal judge for a $50 million settlement deal that would end three class action lawsuits claiming that Yahoo’s negligence led to data breaches affecting American and Israeli email users.

UPDATE 5: On Jan. 28, 2019, a federal judge denied a $50 million Yahoo class action settlement, finding the proposed deal lacked specific information about ways the tech company would improve data security.

UPDATE 6: On April 9, 2019, Yahoo has now agreed to pay $117.5 million to resolve legal claims regarding three large data breaches that affected the internet company.

UPDATE 7: On July 20, 2019, a federal judge has preliminarily signed off on a $117 million class action settlement agreement between Yahoo and accountholders who were affected by numerous data breaches.

UPDATE 8: September 2019, the Yahoo data breach class action settlement is now open. Click here to file a claim.