Subscribe to Breaking News emails

You have successfully subscribed to the Breaking News email.

Subscribe today to be the first to to know about breaking news and special reports.

Yahoo Must Face Litigation by Data Breach Victims, Judge Rules

/ Source: Reuters
The Yahoo logo is shown at the company's headquarters in Sunnyvale, California.

Breaking News Emails

Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.

Yahoo must face nationwide litigation brought on behalf of well over 1 billion users who said their personal information was compromised in three massive data breaches, a federal judge has ruled.

Wednesday night's decision from U.S. District Judge Lucy Koh in San Jose, California, was a setback for efforts by Verizon Communications Inc, which paid $4.76 billion for Yahoo's Internet business in June, to limit potential liability.

The breaches occurred between 2013 and 2016, but Yahoo was slow to disclose them, waiting more than three years to reveal the first. Revelations about the scope of the cyber attacks prompted Verizon to lower its purchase price for the company.

 The Yahoo logo is shown at the company's headquarters in Sunnyvale, California.

In a 93-page decision, Koh rejected Yahoo's contention that breach victims lacked standing to sue, and said they could pursue some breach of contract and unfair competition claims.

"All plaintiffs have alleged a risk of future identity theft, in addition to loss of value of their personal identification information," the judge wrote.

Koh said some plaintiffs also alleged they had spent money to thwart future identity theft or that fraudsters had misused their data.

Related: More Than 4 Billion Data Records Were Stolen Globally in 2016

Others, meanwhile, could have changed passwords or canceled their accounts to stem losses had Yahoo not delayed disclosing the breaches, the judge said.

While many claims were dismissed, Koh said the plaintiffs could amend their complaint to address her concerns.

Breaking News Emails

Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.

"We believe it to be a significant victory for consumers, and will address the deficiencies the court pointed out," John Yanchunis, a lawyer for the plaintiffs who chairs an executive committee overseeing the case, said in an interview. "It's the biggest data breach in the history of the world."

Verizon spokesman Bob Varettoni said the New York-based company declined to comment on pending litigation.

Yahoo is now part of a Verizon unit called Oath.

In court papers, Yahoo had argued that the breaches were "a triumph of criminal persistence" by a "veritable 'who's who' of cybercriminals," and that no security system is hack-proof.

On March 15, the U.S. Department of Justice charged two officers of the Russian Federal Security Service and two hackers in connection with the second breach in late 2014.

The August 2013 breach affected more than 1 billion accounts, while the 2014 breach affected more than 500 million. A third breach occurred in 2015 and 2016.

Breaking News Emails

Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.
MORE FROM news

Have feedback?

How likely are you to recommend nbcnews.com to a friend or colleague?

0 = Very unlikely
10 = Very likely
Please select answer

Is your feedback about:

Please select answer

Leave your email if you’d like us to respond. (Optional)

Please enter a valid email address

Thank you!

Your feedback has been sent out. Please enjoy more of our content.

We appreciate your help making nbcnews.com a better place.