$117M Yahoo Data Breach Settlement Gets OK

A federal judge has preliminarily signed off on a $117 million class action settlement agreement between Yahoo and accountholders who were affected by numerous data breaches.

After initially denying a $50 million settlement in January 2019, Yahoo agreed to the new settlement terms in April 2019.

U.S. District Judge Lucy Koh found six issues with the first settlement between the parties and stayed the case so that new negotiations could commence.  

At a preliminary approval hearing on June 27, 2019, the court ruled that the proposed notices were not adequate, because they “failed to inform the class about the data breaches at issue.” The notices were then amended to the satisfaction of Judge Koh.

In her order for the preliminary approval of the settlement, the judge wrote, “Based on its review of these filings, the Court finds that the Amended Settlement Agreement appears to be the result of serious, informed, non-collusive negotiations conducted with mediators.”

Apart from the settlement fund of $117 million, Yahoo has also agreed to make “significant financial investment” to its information security environment, which includes, “encryption of the UDB backup files, enhanced intrusion detection tools, increased information security team headcount and budget, and implementation of the NIST Framework for Improving Critical Infrastructure Cybersecurity (‘NIST Cybersecurity Framework’),” according to the Yahoo settlement agreement.

In addition, as part of the settlement agreement, Yahoo will have a security budget of $300 million over the next four years and 200 employees, which is a lot more than the company had prior to this case.

The Yahoo data breach class action was consolidated to bring in three separate claims for data breaches that have been brought against the company.

The first breach reportedly occurred in 2013 when personal information of 3 billion Yahoo Mail users were leaked.

The second breach reportedly happened in 2014 after a worker at the company was caught in a “spear phishing” attack which exposed around 500 million accounts.

The last breach reportedly happened from 2015 to 2016 when hackers supposedly used cookies to gain access to 32 million accounts.

In her order for preliminary approval of the settlement agreement, Judge Koh wrote, “Settlement Class Members who wish to opt-out and exclude themselves from the Settlement Class may do so by notifying the Settlement Administrator in writing, postmarked no later than 230 calendar days from the instant Order. To be valid, each request for exclusion must be made in writing, set forth the name of the individual, and request exclusion for that individual, not a group or class of individuals.”

The judge also stated, “The terms of the Amended Settlement Agreement do not improperly grant preferential treatment to any individual or segment of the Settlement Class and fall within the range of possible approval as fair, reasonable, and adequate. The terms of the Amended Settlement Agreement also address the inadequacies of the First Settlement Agreement identified in this Court’s order denying the motion for preliminary approval of the First Settlement Agreement.”

Top Class Actions will post updates to this class action settlement as they become available. For the latest updates, keep checking TopClassActions.com or sign up for our free newsletter. You can also receive notifications when this article is updated by using your free Top Class Actions account and clicking the “Follow Article” button at the top of the post.

The consumers are represented by John Yanchunis of Morgan & Morgan Complex Litigation Group, Stuart A. Davidson of Robbins Geller Rudman & Dowd LLP, Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP, Ariana J. Tadler of Tadler Law LLP, Karen Hanson Riebel of Lockridge Grindal Nauen PLLP and Daniel S. Robinson of Robinson Calcagnie Inc.

The Yahoo Data Breach Class Action Lawsuit is In re: Yahoo Inc. Customer Data Security Breach Litigation, Case No. 5:16-md-02752, in the U.S. District Court for the Northern District of California.

UPDATE: September 2019, the Yahoo data breach class action settlement is now open. Click here to file a claim. 

Read More Lawsuit & Settlement News:

$13M Google Street View Privacy Class Action Settlement Reached

Do I Need a Nursing Home Abuse Lawyer in Memphis?

Nintendo Class Action Says Switch Joy-Con Controllers Are Defective

Missed Meal Breaks and Overtime Pay Spur Wage and Hour Class Action