Yahoo Breach Victims Can Sue

Here’s a thought.  If the lawsuit against Yahoo succeeds and the award is $10 per victim, that would be a $30 billion judgement.

The breach, you may remember, was publicly disclosed after Verizon agreed to buy Yahoo but before the deal closed.  As a result of the announcement the price was lowered by $350 million, but there were also some changes to the terms.

The changes were not all announced publicly, but likely some of the changes were related to who gets to pay for fines and penalties.

*IF* the plaintiffs win and the award is $30 billion –  two VERY BIG ifs – and even if the two companies split the $30 billion, then that $350 million discount won’t seem like much of a deal.  All of this is a big if.

For years judges dismissed these lawsuits out of hand saying that the plaintiffs didn’t suffer imminent harm or didn’t have standing at all.

In this case, the judge is someone who is familiar with both high tech and very public trials – she presided over the Apple-Samsung trial, among others.

The judge, Lucy Koh, said that it is reasonable that the plaintiffs might have chosen a different email provider if they had known that Yahoo’s email system had weaknesses.

She also said that the plaintiffs were going to be allowed to try and prove that the liability limits in Yahoo’s terms of service were unconscionable given the allegations that Yahoo knew it’s security was horrible and didn’t do much about it.

It is going to be years before anything is likely settled, but we are seeing more and more that judges are no longer siding with companies blindly saying there is nothing that companies can do to prevent breaches.

Obviously no one knows what the outcome of this trial and appeals will be, but if the plaintiffs win and if there is a big award, it would set an interesting precedent.  This case is being tried in the 9th Circuit, which is in the  heart of Silicon Valley.  If the plaintiffs win, it will definitely get the attention of every tech company in the valley.

I have heard that Yahoo did not have any cyber risk insurance.  If true, they could be digging deep in the couch cushions to pay for the trial, appeal and possible verdict.

Information for this post came from Reuters.

by