On Friday, September 23, 2016, Yahoo Inc. (“Yahoo” or the “Company”) was hit with three proposed class action lawsuits, two in California and one in Illinois, just one day after the Company announced it had been hacked in 2014. The Company revealed that over 500 million people had their personal information, including names, passwords, security questions and answers, dates of birth, email addresses, and telephone numbers stolen from Yahoo’s online database. The Company believes that the hack was executed by a state-sponsored actor – in other words, an unidentified foreign government.
In its announcement, Yahoo reassured users that the passwords were protected in the “vast majority” of cases because the stolen passwords were “hashed,” meaning the original text of the passwords were hidden. Moreover, Yahoo explained that no information was stolen with respect to banking or payment data. While Yahoo does not believe the hacker is still able to access the system, Yahoo is continually working to alert users regarding the hack and investigating who exactly was behind this massive data breach.
Despite these assurances by Yahoo, Jennifer Myers (“Myers”), Ronald Schwartz (“Schwartz”), Christopher Havron (“Havron”), and Katelyn Smith (“Smith”), the named Plaintiffs in their respective cases, filed complaints claiming that Yahoo should be held responsible for the 2014 hack. Each Plaintiff seeks to represent all Yahoo users who had their information stolen, but brings the cases under different theories.
For example, Myers asserted Yahoo violated California’s Unfair Competition Law and Consumer Legal Remedies Act by failing to take due care of sensitive information. She further claimed that the Company failed to inform the users of the breach in security “in the most expedient time possible,” in violation of California’s Civil Code Section 1798.82. Finally, she alleged violations of the Stored Communications Act, which restricts Yahoo’s ability to share users’ personal information and requires that such information remain confidential, except in limited circumstances. Myers emphasized that those involved in the suit are now prone to identity theft, “potentially for the remainder of their lives.” (Trader). As a result, Myers wants to ensure that companies like Yahoo, are held legally responsible for the loss of users’ personal information.
Meanwhile, Schwartz alleged that the Company exercised gross negligence by not taking the proper steps necessary to protect users’ private information. As Schwartz’s lawyers noted, “[t]he fact that a breach of this magnitude went undetected at a tech giant like Yahoo for two years is astounding.” Moreover, Schwartz’s complaint also included a bailment claim, because according to Schwartz, it was Yahoo’s responsibility to ensure that users’ personal information was not transferred to any third parties, unless absolutely necessary.
Finally, Havron and Smith claimed that since Yahoo’s Terms of Service Agreement promised that the Company will not share users’ information with other people or companies, Yahoo breached its contracts with its users. Their complaint also included claims for breach of good faith, unjust enrichment, and a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.
This massive data breach consists of several potential violations and as the three suits move forward in court, Yahoo must answer its users.
The legal team at SFMS has significant experience litigating class action matters. If you have any questions regarding this subject or this posting, please contact Nick Lussier (email@example.com) or Chiharu Sekino (firstname.lastname@example.org). We can also be reached toll-free at (866) 540-5505.
Shepherd, Finkelman, Miller & Shah, LLP is a law firm with offices in California, Connecticut, Florida, New Jersey, New York, Pennsylvania and Wisconsin. SFMS is an active member of Integrated Advisory Group (www.iaginternational.org), which provides us with the ability to provide our clients with access to excellent legal and accounting resources throughout the globe. For more information about our firm, please visit us at www.sfmslaw.com.
Trader, Steven. “Yahoo Battered With Class Actions Over 2014 Data Breach.” Law360. Portfolio Media, Inc. 23 Sept. 2016. Web.