Yahoo Data Breach Spurs First Consumer Class Complaints

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

Sept. 23 — The massive Yahoo! Inc. data breach has spurred the first three of what are sure to be many federal court consumer class action complaints ( Havron v. Yahoo, Inc. , S.D. Ill., No. 16-cv-01075, complaint, 9/22/16 ; Myers v. Yahoo!, Inc. , S.D. Cal., No. 16-cv-02391, complaint, 9/22/16 ; Schwartz v. Yahoo!, Inc., N.D. Calif., No. 16-cv-05456, complaint, 9/23/16 ).

The hacking incident, which affected at least 500 million Yahoo users’ account information (185 PRA, 9/23/16), is sure to spark multiple class actions that will eventually be combined in a single federal court.

The complaints, filed Sept. 22 in the U.S. District Court for the Southern District of Illinois and the U.S. District Court for the Southern District of California, as well as in the Northern District of Illinois Sept. 23, generally allege that Yahoo didn’t adequately protect the consumers personal information that may be used by the hackers for financial gain.

Verizon Communications Inc. has agreed to pay $4.83 billion to purchase Yahoo. The merger hasn’t been formalized and it is unclear whether this hacking breach will have any meaningful impact on the deal.

Regardless of whether the deal gets approved, Yahoo will face the potentially high cost of defending multiple class actions, the cost of which may reach into the tens of millions.

Consumer Claims

Specifically, the Illinois case alleges that under Yahoo’s terms of service and privacy policy the company was entrusted to “strictly maintain the confidentiality of the information and safeguard from theft or misuse.” The plaintiff alleges that Yahoo violated common law contract and tort law and violated the Illinois Consumer Fraud and Deceptive Business Practices Act.

The Southern District of California case alleges that the plaintiffs were harmed because the information stolen was valuable and may be used by identity thieves “to open new financial accounts, incur charges in the name of class members, take out loans, clone credit and debit cards, and other unauthorized activities.” The plaintiff brings common law invasion of privacy claims, negligence and California consumer protection claims. Unlike the Illinois case, the plaintiff also alleges that Yahoo violated the Federal Stored Communications Act.

The case in the Northern District of California accuses Yahoo of gross negligence.

A Yahoo spokeswoman told Bloomberg BNA Sept. 23 that the company doesn’t comment on ongoing litigation.

With assistance from Robert Burnson in San Francisco

To contact the reporter on this story: Daniel R. Stoller in Washington at

To contact the editor responsible for this story: Donald G. Aplin at

For More Information

Full text of the complaint in Havron v. Yahoo is available at

Full text of the complaint in Myers v. Yahoo is available at

The complaint in Schwartz v. Yahoo is available at

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law Privacy and Data Security