Judge Denies $50M Yahoo Data Breach Class Action Settlement

A federal judge recently denied a $50 million Yahoo class action settlement, finding the proposed deal lacked specific information about ways the tech company would improve data security.

In addition, the judge took issue with what she calls “unreasonably high attorneys’ fees,” and a lack of transparency related to the total settlement fund.

“The proposed notice does not disclose the costs of credit monitoring services or costs for class notice and settlement administration, and does not disclose the total size of the settlement fund,” U.S. District Judge Lucy Koh wrote. “Without knowing the total size of the settlement fund, class members cannot assess the reasonableness of the settlement.”

The settlement would resolve years of litigation, but Judge Koh found that it was not sufficient. She determined that the lack of specific costs of credit monitoring translated to a vague total settlement amount.

The non-monetary relief included in the settlement was also critiqued by Judge Koh, who said that the settlement differs from other security breach settlements in that it does not require Yahoo to buff up their security measures to prevent further breaches.

“As a result of the lack of specific increases in budget or number of employees and the vague commitments as to changed business practices, the court cannot adequately consider the benefits offered to the class in settlement,” the judge’s ruling stated.

Judge Koh also found that attorneys’ fees for the case were far too high relative to the total settlement fund. Plaintiff counsel sought $22 million for 33 firms including 140 attorneys who reportedly worked on the case. However, only five firms were reportedly authorized to work on the case after it was consolidated.

Additionally, Judge Koh noted that counsel in the case is asking for more in attorneys’ fees than was requested in the High Tech case – a massive antitrust litigation targeting collusion between Apple, Google, and Intel to suppress employee wages. The judge questioned whether the quality of the work by attorneys in the Yahoo case justified the enormous figure for fees.

“Class counsel claim to have spent more time litigating this case and request a higher lodestar figure than class counsel did in High-Tech,” Judge Koh wrote. “This claim is surprising. Moreover, class counsel in High-Tech secured a significantly larger settlement of $415 million with more direct payments to class members than the $50 million settlement fund disclosed in the proposed notice here.”

Overall, Judge Koh determined that the settlement was an inadequate resolution to the largest data breach in history. This ruling reflects her stance from a November hearing in which she repeatedly asked both parties important questions regarding the settlement that they failed to answer.

Judge Koh specifically expressed disappointment with the plaintiffs, stating that it seemed they were more worried about securing payment than determining the facts behind the massive Yahoo data breach.

“I’m disappointed that there doesn’t seem to be any motivation to get to the bottom of this,” Judge Koh said at the time. “It appears there’s a willful blindness or an attitude of ‘Let’s settle this and get out.’ The motivation of this lawsuit should be to find out the full extent of the potential damage and alert users so they can take precautions like shutting down bank accounts or getting new credit cards.”

The consumers are represented by John Yanchunis of Morgan & Morgan Complex Litigation Group, Stuart A. Davidson of Robbins Geller Rudman & Dowd LLP, Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP, Ariana J. Tadler of Milberg Tadler Phillips Grossman LLP, Karen Hanson Riebel of Lockridge Grindal Nauen PLLP and Daniel S. Robinson of Robinson Calcagnie Inc.

The Yahoo Data Breach Class Action Lawsuit is In re: Yahoo! Inc. Customer Data Security Breach Litigation, Case No. 5:16-md-02752-LHK, in the U.S. District Court for the Northern District of California.

UPDATE: On April 9, 2019, Yahoo has now agreed to pay $117.5 million to resolve legal claims regarding three large data breaches that affected the internet company.

UPDATE 2: On July 20, 2019, a federal judge has preliminarily signed off on a $117 million class action settlement agreement between Yahoo and accountholders who were affected by numerous data breaches.

UPDATE 3: September 2019, the Yahoo data breach class action settlement is now open. Click here to file a claim.