Advertisement

Yahoo loses its bid to reject data breach lawsuit

Verizon had tried to dismiss large portions of the case.

Yahoo (and by extension, its parent/Engadget owner Verizon) now has no choice but to face the majority of claims in a US lawsuit over the internet giant's multiple data breaches. California Judge Lucy Koh (of Apple-versus-Samsung fame) has denied Verizon's bid to dismiss numerous claims in the suit, including breach of contract and negligence. The plaintiffs' claims demonstrated that they would have "behaved differently" if they'd known about Yahoo's email security woes, Judge Koh said, and that Yahoo's attempts to limit liability were "unconscionable" given how much it knew about its security problems and how little it did.

The judge had previously shot down attempts by Yahoo and Verizon to dismiss unfair competition claims. In attempting to take down most of the claims, Yahoo had maintained that the lawsuit was based on "20/20 hindsight" and didn't change that the company had been continuously fighting security threats.

This ruling could put Yahoo and Verizon on the hook for a tremendous sum if the lawsuit is successful. It eventually became clear that all of Yahoo's 3 billion users circa 2013 were affected by the first big breach, and that's not including the people affected by the two other breaches between then and 2016. Only a fraction of those users are American, but that could still lead to a costly payout.