Yahoo data breach settlement reaches $117.5M

Attorneys have boosted a class action settlement over Yahoo Inc.’s recent data breaches to $117.5 million after a federal judge rejected preliminary approval of it earlier this year.

The settlement, filed Tuesday with the U.S. District Court for the Northern District of California, includes a single fund from which $55 million would be available for out-of-pocket costs and $24 million in identity theft protection for class members (or $100 payments to those who already have credit monitoring). It also includes $30 million in attorney fees and $2.5 million in legal costs, a slight reduction from the original fee request.

Re-engineered resolution

“Following the court’s denial of preliminary approval, the parties immediately set about addressing the issues the court identified, re-engineering the resolution of this case,” wrote lead plaintiffs counsel, Tampa, Florida-based John Yanchunis of Morgan & Morgan.

The deal is one of the largest data breach settlements in U.S. history.

In 2016, Yahoo announced that 500 million accounts had been hacked in 2014, compromising names, email addresses, phone numbers, birth dates and passwords. Months later, Yahoo disclosed another breach in 2013 that affected 1 billion accounts, a figure that Verizon increased to 3 billion last year. The settlement also involves a third breach in 2015 and 2016.

The defendants are Altaba Inc., the division of Verizon formerly known as Yahoo, and Oath Holdings Inc., which owns Yahoo’s holding company.

Original $85M settlement rejected

The original $85 million settlement included a $50 million fund from which consumers could make claims for out-of-pocket costs. In addition, Yahoo had agreed to provide at least two years of credit monitoring and identity theft protection insurance to class members.

U.S. District Judge Lucy Koh, who rejected the deal on Jan. 28, asked why the class involved only 200 million individuals with about 1 billion Yahoo accounts. She also questioned why it took 32 firms to work on issues that were “not particularly novel.” The $35 million fee request was “unreasonably high,” she wrote. The firms had included a $22 million lodestar calculation for 143 lawyers.

She also found the settlement improperly released claims relating to smaller breaches in 2012, calling Yahoo’s nondisclosures and lack of transparency “egregious.”

An amended complaint filed Monday, however, expanded the class to include Yahoo users in 2012. The motion for settlement approval estimated that 194 million individuals holding 896 million accounts would be part of the class.

Reimburse businesses and individuals

The $117.5 million settlement fund would reimburse businesses and individuals, with a $25,000 cap for individuals. The reimbursement is for fraud charges, and other costs, and includes compensable time spent dealing with the breach’s repercussions. The fund also includes $6 million in administrative costs.

Leftover funds would not revert to the defendants but end up distributed as cy pres to the Electronic Privacy Information Center.

The new deal includes an information security budget of more than $300 million over the next four years, with 200 people involved, which are “amounts that are at least four times and three times greater, respectively, than Yahoo maintained prior to this case,” the motion says.

‘Enhanced and improved data security’

“Enhanced and improved data security is a critical aspect of the settlement,” the motion says.

A spokesman for Verizon Media, speaking for Yahoo, said in an emailed statement: “We believe that the settlement demonstrates our strong commitment to security.”

Related:

• Employees’ emails, file sharing are data breach Trojan Horses
• Marriott breach to cost $200-600M in losses AIR estimates
• How to underwrite 2019′s emerging cyber risks

Amanda Bronstad (abronstad@alm.com) is the ALM staff reporter covering class actions and mass torts nationwide. She writes the email dispatch Critical Mass. She is based in Los Angeles.