Path cleared for Yahoo to face data breach lawsuits

Dive Brief:

U.S. District Judge in San Jose, California Lucy Koh on Wednesday said Yahoo must face litigation from victims of three major breaches that occurred between 2013 and 2016 and affected more than 1 billion accounts, according to Reuters.
While many of the lawsuits against Yahoo were previously dismissed, Koh said the plaintiffs could now revisit breach of contract and unfair competition suits, Reuters reports.
Koh's decision, in part, addressed how plaintiffs have alleged the data breach put them at risk for identity theft and decreased the value of their personally identifiable information. Some plaintiffs also alleged spending money on protecting against identity theft. Had Yahoo disclosed the breach earlier, some could have acted to either close their accounts or change their passwords, Koh said.

Dive Insight:

Since Yahoo revealed the extent of the data breaches, critics have questioned the disclosure timing. Yahoo did not disclose the breaches until after Verizon agreed to buy the company's primary business. The U.S. Securities and Exchange Commission intends to investigate whether Yahoo could have disclosed the breaches sooner. SEC policy dictates companies disclose cybersecurity risks immediately if they could have an impact on investors.

Investigations into Yahoo’s practices alleged the company did not take threats and reports of intrusion seriously, leading to one of the largest data breaches on record.

Now Verizon could be left paying the bill if former Yahoo customers serve lawsuits. When the acquisition was finalized in February, Verizon agreed on a $350 million discount for Yahoo and said it would share "certain legal and regulatory liabilities" for the breaches.

The decision is seen as a victory for consumers, but a disappointment for Verizon, which has been trying to put the massive breaches behind them. It’s also a lesson business leaders may want to keep in mind when purchasing other companies. If a company is purchased, buyers could eventually end up paying for any cybersecurity shortcomings that company had.