1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

MORGAN & MORGAN

COMPLEX LITIGATION GROUP

John A. Yanchunis (Admitted Pro Hac Vice)

201 N. Franklin Street, 7th Floor

Tampa, FL 33602

Telephone: 813/223-5505

813/223-5402 (fax)

jyanchunis@ForThePeople.com

ROBBINS GELLER RUDMAN

& DOWD LLP

Stuart A. Davidson (Admitted Pro Hac Vice)

120 East Palmetto Park Road, Suite 500

Boca Raton, FL 33432

Telephone: 561/750-3000

561/750-3364 (fax)

sdavidson@rgrdlaw.com

CASEY GERRY SCHENK FRANCAVILLA

 BLATT & PENFIELD LLP

Gayle M. Blatt (122048)

110 Laurel Street

San Diego, CA 92101

Telephone: 619/238-1811

619/544-9232 (fax)

gmb@cglaw.com

MILBERG TADLER PHILLIPS 

GROSSMAN LLP

Ariana J. Tadler (Admitted Pro Hac Vice)

One Pennsylvania Plaza, 19th Floor

New York, NY 10119

Telephone: 212/594-5300

212/868-1229 (fax)

atadler@milberg.com

LOCKRIDGE GRINDAL NAUEN P.L.L.P.

Karen Hanson Riebel (Admitted Pro Hac Vice)

100 Washington Ave. South, Suite 2200

Minneapolis, MN 55401

Telephone: 612/339-6900

612/339-0981 (fax)

khriebel@locklaw.com

Attorneys for Plaintiffs and Proposed Class Counsel

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA - SAN JOSE DIVISION

IN RE: YAHOO! INC. CUSTOMER DATA 

SECURITY BREACH LITIGATION

)

)

)

)

)

)

)

)

)

)

)

No. 16-md-02752-LHK

PLAINTIFFS’ NOTICE OF MOTION 

AND MEMORANDUM OF POINTS AND 

AUTHORITIES IN SUPPORT OF 

PLAINTIFFS’ MOTION FOR CLASS 

CERTIFICATION 

Date: November 1, 2018

Time: 1:30 p.m.

Courtroom: 8, 4th Floor

Judge: Hon. Lucy H. Koh

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 1 of 50
PLTFS’ NOT. OF MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PLEASE TAKE NOTICE THAT Plaintiffs will and hereby do respectfully move theCourt, 

pursuant to Federal Rule of Civil Procedure 23, to grant Plaintiffs’ Motion for Class Certification in 

connection with the classes specified below under the following causes of action alleged in their 

First Amended Consolidated Class Action Complaint: (i) the California Unfair Competition Law 

(“UCL”) claims for unfair and unlawful business practices (First Claim for Relief and Second Claim 

for Relief); (ii) the breach of contract claim (Fifth Claim for Relief); (iii) the breach of implied 

contract claim (Sixth Claim for Relief); (iv) the breach of the implied covenant of good faith and fair 

dealing claim (Seventh Claim for Relief); (v) the negligence claim (Fourth Claim for Relief); (vi) the 

Consumers Legal Remedies Act (“CLRA”) claim (Eleventh Claim for Relief); (vii) the UCL claim 

for fraudulent business practices (Ninth Claim for Relief); and (viii) the California Customer 

Records Act (“CRA”) claim under Cal Civ. Code §1798.82 (Thirteenth Claim for Relief). Plaintiffs 

also seek appointment of the proposed Class Representatives and Class Counsel, asdescribed below. 

Hearing on this motion will be held on November 1, 2018, at 1:30 p.m. in the Courtroom of

the Honorable Lucy H. Koh, located at the Robert F. Peckham Federal Building & United States 

Courthouse, 280 South First Street, Fourth Floor, San Jose, California. 

I. Plaintiffs’ Proposed Classes1 and Class Representatives

A. Rule 23(b)(2): UCL Injunctive Relief Class

Plaintiffs move to certify, under Rule 23(b)(2), their claims for declaratory and injunctive 

relief under the UCL for unfair acts or practices on behalf of the following class: 

UCL Injunctive Relief Class. All persons who registered for a free Yahoo account(s)

in the United States whose PII was stolen from Yahoo in the 2013 Breach, the 2014 

Breach, and/or the Forged Cookie Breach.

The proposed Class Representatives for the UCL Injunctive Relief Class are Plaintiffs 

Kimberly Heines, Hashmatullah Essar, Paul Dugas, Matthew Ridolfo, and Deana Ridolfo. 

Alternatively, Plaintiffs request that the Court certify the same claims on behalf of the following 

class, to be represented by Plaintiffs Heines and Dugas:

 1 “Classes” collectively refers to the UCL Injunctive Relief Class and the Damages Class and 

Subclasses. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 2 of 50
PLTFS’ NOT. OF MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CA UCL Injunctive Relief Class. All persons who registered for free Yahoo 

account(s) in California, or who are free Yahoo account users residing in California, 

whose PII was stolen from Yahoo through the 2013 Breach, the 2014 Breach, and/or 

the Forged Cookie Breach. 

B. Rule 23(b)(3)

1. The Damages Class and Subclasses

Plaintiffs move to certify the following Class and subclasses under Rule 23(b)(3): 

Damages Class. All persons who registered for any Yahoo or Aabaco account(s) in 

the United States and Israel whose PII was stolen from Yahoo in the 2013 Breach, 

the 2014 Breach, and/or the Forged Cookie Breach.

a. Free Users Subclass. All persons who registered for free Yahoo 

account(s) in the United States or Israel whose PII was stolen from 

Yahoo in the 2013 Breach, the 2014 Breach, and/or the Forged 

Cookie Breach; 

b. Paid Users Subclass. All persons who registered for paid Yahoo 

account(s), excluding Yahoo Small Business or Aabaco accounts, in 

the United States or Israel whose PII was stolen from Yahoo in the 

2013 Breach, the 2014 Breach, and/or the Forged Cookie Breach; 

c. Small Business Users Subclass. All persons who registered for 

Yahoo Small Business or Aabaco account(s) in the United States or 

Israel whose PII was stolen from Yahoo or Aabaco in the 2013 

Breach, the 2014 Breach, and/or the Forged Cookie Breach; and 

d. California Users Subclass. All persons who registered for any Yahoo 

or Aabaco account(s) in California, or who are Yahoo or Aabaco 

account users residing in California, whose PII was stolen from 

Yahoo in the 2014 Breach and/or the Forged Cookie Breach.

The proposed Class Representatives for the Damages Class are Plaintiffs Kimberly Heines, 

Hashmatullah Essar, Paul Dugas, Matthew and Deana Ridolfo, Mali Granot, Yaniv Rivlin, Andrew 

Mortensen, and Brian Neff. The proposed Class Representatives for the Free Users Subclass are 

Plaintiffs Kimberly Heines, Hashmatullah Essar, Paul Dugas, Matthew Ridolfo, Deana Ridolfo, Mali 

Granot, and Yaniv Rivlin. The proposed Class Representative for the Paid Users Subclass is 

Plaintiff Andrew Mortensen. The proposed Class Representative for the Small Business Users 

Sublass is Plaintiff Brian Neff. The proposed Class Representatives for the California Users 

Subclass are Plaintiffs Heines and Dugas. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 3 of 50
PLTFS’ NOT. OF MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2. The Claims

Through the above defined Classes, Plaintiffs seek to litigate the following claims on behalf 

of Class members2: 

On behalf of the Damages Class, with members who registered for free, paid, and small 

business accounts being independently represented through their respective Subclasses, Plaintiffs 

seek to litigate their claims for negligence, breach of express contract, breach of implied contract, 

and breach of the implied covenant of good faith and fair dealing. 

Plaintiff Mortensen further seeks to ligate his claim for unfair and deceptive business 

practices in violation of the CLRA on behalf of the Paid Users Subclass. Should the Court 

determine that Plaintiff Mortensen may not litigate his CLRA claim on behalf of users who 

registered their accounts in, or reside outside of, California, he requests that the Court certify the 

following alternative subclass:

CA Paid Users Subclass. All persons who registered paid Yahoo account(s), 

excluding Yahoo Small Business or Aabaco accounts, in California, or who are paid 

Yahoo account users residing in California, whose PII was stolen from Yahoo 

through the 2013 Breach, the 2014 Breach, and/or the Forged Cookie Breach.

Plaintiff Neff further seeks to litigate his claim for fraudulent business practices in violation 

of the UCL on behalf of the Small Business Users Subclass. Should the Court determine that 

Plaintiff Neff may not litigate his UCL claim on behalf of users who registered their accounts in, or 

reside outside of, California, he requests that the Court certify the following alternative subclass:

CA Small Business Users Subclass. All persons who registered for Yahoo Small 

Business or Aabaco account(s) in California, or who are Yahoo Small Business or 

Aabaco account users residing in California, whose PII was stolen from Yahoo or 

Aabaco through the 2013 Breach, the 2014 Breach, and/or the Forged Cookie 

Breach. 

Plaintiffs Heines and Dugas also seek to litigate their CRA claim on behalf of the California 

Users Subclass. 

 2 “Class members” refers to members of either or both of the UCL Injunctive Relief Class and the 

Damages Class.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 4 of 50
PLTFS’ NOT. OF MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

C. Rule 23(c)(4): Issue Certification for the Damages Class

Should the Court decline to certify the proposed Damages Class as a full class under Rule 

23(b)(3), Plaintiffs request the Court certify the following issues for classwide determination under 

Rule 23(c)(4) to streamline the litigation for all Damages Class members seeking to recover for their 

contract and negligence claims:

• Whether Defendants had a contractual, legal, or statutory duty to safeguard 

users’ PII;

• Whether Defendants failed to adequately safeguard users’ PII;

• Whether affected users’ PII was exfiltrated from Defendants’ systems in the 

Breaches;

• Whether the PII exfiltrated by the Breaches from all affected users’ accounts 

could have caused identity fraud; 

• Whether Defendants’ failure to adequately safeguard users’ PII was a causal 

factor in the exfiltration of affected users’ PII; 

• Whether and when Defendants knew about their inadequate security and the 

Breaches and, if so, whether they failed to timely notify users; 

• Whether the exfiltration of affected users’ PII increased the risk that those 

users will suffer identity theft; 

• Whether paid users and small business users lost the benefit of their bargain 

for secure services and, if so, the amount of that benefit to each group;

• The value of different categories of PII that was stolen by the Breaches; and

• Whether Defendants’ conduct is such that the burden of proof for causation 

should shift to them to show that the Breaches were not the but for cause of 

affected users’ injuries. 

D. Exclusions 

Excluded from all Classes are Defendants, any entity in which Defendants or their successors 

have a controlling interest, and Defendants’ officers, directors, legal representatives, successors, 

subsidiaries, and assigns. Also excluded from all Classes are any judges, justices, or judicial officers 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 5 of 50
PLTFS’ NOT. OF MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

presiding over this matter, the members of their immediate families and judicial staff, and Plaintiffs’ 

counsel. 

II. Plaintiffs’ Proposed Class Counsel

Plaintiffs also seek the appointment of John A. Yanchunis of Morgan & Morgan, Gayle M. 

Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP, Karen Hanson Riebel of Lockridge 

Grindal Nauen P.L.L.P., Ariana H. Tadler of Milberg Tadler Phillips Grossman LLP, and Stuart A. 

Davidson of Robbins Geller Rudman & Dowd LLP as Class Counsel. 

Plaintiffs base their Motion for Class Certification on: Plaintiffs’ Notice of Motion and 

Motion for Class Certification; Memorandum of Points and Authority in Support of Plaintiffs’ 

Motion for Class Certification; Declaration of John Yanchunis, including Record Evidence 

Submitted in Support of Plaintiffs’ Motion for Class Certification, Report of Mary Frantz, Report of 

Jim Van Dyke, Declaration of Gary Parilis, and Declaration of Ian Ratner; First Amended 

Consolidated Class Action Complaint; and all other records and papers on file in this action and all 

other matters properly before the Court. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 6 of 50
TABLE OF CONTENTS 

Page

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - i -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I. STATEMENT OF ISSUES TO BE DECIDED ..................................................................1

II. STATEMENT OF FACTS DEVELOPED THROUGH DISCOVERY .............................1

A. Yahoo’s Services and Representations Concerning Data Security ..........................1

B. The 2013 Breach, 2014 Breach, and Forged Cookie Breach ...................................2

C. Yahoo’s Inadequate Information Security Was Ongoing and Pervasive and 

Negatively Impacted All Yahoo Users ....................................................................3

1. Yahoo’s Information Security Was Woefully Inadequate ...........................3

2. Yahoo Failed to Meet Industry Standards and Federal Regulations ............5

3. Yahoo Knew Its Data Security Measures Were Grossly Inadequate ..........7

D. Senior Executives Had Contemporaneous Knowledge of the 2014 Breach ..........10

E. Yahoo’s Information Security Is Still Inadequate .................................................12

III. ARGUMENT .....................................................................................................................13

A. Rule 23 Was Designed to Aggregate Common Issues ..........................................13

B. The Proposed Classes Meet the Requirements of Rule 23(a) ................................13

1. Numerosity .................................................................................................13

2. Commonality..............................................................................................14

3. Typicality ...................................................................................................15

a. UCL Injunctive Relief Class ..........................................................15

b. Damages Class and Subclasses ......................................................16

4. Adequacy of Representation ......................................................................17

a. Plaintiffs Are Adequate Class Representatives ..............................18

b. Plaintiffs Have Selected Adequate Class Counsel .........................19

C. Rule 23(b)(2) Certification of the UCL Injunctive Relief Class Is 

Appropriate ............................................................................................................19

D. Rule 23(b)(3) Certification of the Damages Class and Subclasses Is Proper ........21

1. Common Questions of Law and Fact Predominate ...................................22

a. Common Evidence Proves Plaintiffs’ Claims................................22

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 7 of 50
CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - ii -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(1) Plaintiffs’ Contract Claims ................................................22

(2) Plaintiffs’ Negligence Claim ..............................................24

(3) Plaintiffs’ CRA Claim for Failure to Notify ......................24

(4) Plaintiffs’ UCL and CLRA Claims ....................................25

b. Damages Can Be Established with Common Proof and 

Calculated with Common Methodologies .....................................26

(1) Benefit of the Bargain and Restitution...............................27

(2) Lost Value of PII ................................................................27

(3) Identity Theft Losses..........................................................30

(4) Punitive Damages ..............................................................32

2. A Class Action Is Superior to Millions of Expensive Trials .....................32

E. Certification of Issues Under Rule 23(c)(4) Is Also Appropriate ..........................33

1. The Court Has Broad Discretion to Certify Issues ....................................34

2. Issue Certification Will Significantly Advance Resolution .......................35

IV. CONCLUSION ..................................................................................................................35

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 8 of 50
TABLE OF AUTHORITIES 

CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - iii -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Amgen Inc. v. Conn. Ret. Plans & Tr. Funds,

568 U.S. 455 (2013) ...........................................................................................................13, 26 

Backhaut v. Apple Inc.,

2015 U.S. Dist. LEXIS 107519 (N.D. Cal. Aug. 13, 2015).....................................................35 

Bockrath v. Aldrich Chem. Co.,

21 Cal. 4th 71 (1999) ...............................................................................................................28

Brazil v. Dole Packaged Foods, LLC,

2014 WL 2466559 (N.D. Cal. May 30, 2014) .........................................................................20 

Briseno v. ConAgra Foods, Inc.,

844 F.3d 1121 (9th Cir. 2017), cert. denied, 138 S. Ct. 313 (2017) ........................................33 

Britz Fertilizers, Inc. v. Bayer Corp.,

665 F. Supp. 2d 1142 (E.D. Cal. 2009)....................................................................................27 

Butler v. Sears, Roebuck & Co.,

727 F.3d 796 (7th Cir. 2013) ...................................................................................................34

Careau & Co. v. Security Pac. Bus. Credit, Inc.,

222 Cal. App. 3d 1371 (1990) .................................................................................................24

Daniel v. Ford Motor Co.,

806 F.3d 1217 (9th Cir. 2015) .................................................................................................26

Davidson v. Apple,

2018 WL 2325426 (N.D. Cal. May 7, 2018) .....................................................................22, 35 

Deane v. Fastenal Co.,

2012 WL 12552238 (N.D. Cal. Sept. 26, 2012) ......................................................................34 

Ehret v. Uber Techs., Inc.,

148 F. Supp. 3d 884, 901-02 (N.D. Cal. 2015) ........................................................................25 

Ellis v. Costco Wholesale Corp.,

657 F.3d 970 (9th Cir. 2011) .............................................................................................13, 14

Ellsworth v. U.S. Bank, N.A.,

2014 WL 2734953 (N.D. Cal. June 13, 2014) .........................................................................22 

Fitzhenry-Russell v. Dr. Pepper Snapple Grp., Inc.,

2018 WL 3126385 (N.D. Cal. June 26, 2018) .........................................................................27 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 9 of 50
CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - iv -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Friedman v. AARP,

855 F.3d 1047 (9th Cir. 2017) .................................................................................................25

Giroux v. Essex Prop. Tr., Inc.,

2018 WL 2463107 (N.D. Cal. June 1, 2018) ...........................................................................24 

Haft v. Lone Palm Hotel,

3 Cal. 3d 756 (1970) ................................................................................................................31

Hanlon v. Chrysler Corp.,

150 F.3d 1101 (9th Cir. 1998) ...........................................................................................15, 17

Huu Nguyen v. Nissan N. Am., Inc.,

2018 WL 1831857 (N.D. Cal. Apr. 9, 2018) ...........................................................................35 

Ileto v. Glock Inc.,

349 F.3d 1191 (9th Cir. 2003) .................................................................................................24

In re Anthem, Inc. Data Breach Litig.,

2016 WL 3029783 (N.D. Cal. May 27, 2016) .........................................................................30 

In re Deepwater Horizon,

739 F.3d 790 (5th Cir. 2014) ...................................................................................................34

In re Estate of Marcos Human Rights Litig.,

910 F. Supp. 1460 (D. Haw. 1995), aff’d sub nom. Hilao v. Estate of Marcos,

103 F.3d 767 (9th Cir. 1996) ...................................................................................................29

In re LDK Solar Sec. Litig.,

255 F.R.D. 519 (N.D. Cal. 2009) .............................................................................................18

In re Lenovo Adware Litig.,

2016 WL 6277245 (N.D. Cal. Oct. 27, 2016) ..........................................................................21 

In re San Jose Airport Hotel, LLC,

2018 WL 1426702 (N.D. Cal. Mar. 22, 2018) .........................................................................27 

In re Target Corp. Customer Data Sec. Breach Litig.,

892 F.3d 968 (8th Cir. 2018) ...................................................................................................18

In re Whirlpool Corp. Front-Loading Washer Prods. Liab. Litig.,

722 F.3d 838 (6th Cir. 2013) ...................................................................................................34

In re Yahoo Mail Litig.,

308 F.R.D. 577 (N.D. Cal. 2015) ...........................................................................13, 19, 20, 21 

In re Zappos.com, Inc.,

888 F.3d 1020 (9th Cir. 2018) .................................................................................................30

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 10 of 50
CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - v -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Jimenez v. Allstate Ins. Co.,

2012 WL 1366052 (C.D. Cal. Apr. 18, 2012) .........................................................................29 

Jimenez v. Allstate Ins. Co.,

765 F.3d 1161 (9th Cir. 2014) ...........................................................................................33, 34

Just Film, Inc. v. Buono,

847 F.3d 1108 (9th Cir. 2017) ...........................................................................................22, 33

Kamakahi v. Am. Soc’y for Reprod. Med.,

305 F.R.D. 164 (N.D. Cal. 2015) .............................................................................................34

Kumar v. Salov N. Am. Corp.,

2016 WL 3844334 (N.D. Cal. 2016) .......................................................................................25 

Lanovaz v. Twinings N. Am., Inc.,

2014 WL 1652338 (N.D. Cal. Apr. 24, 2014) .........................................................................26 

Liberty Surplus Ins. Corp. v. Ledesma & Meyer Constr. Co., Inc.,

5 Cal.5th 216, 418 P.3d 400 (Cal. 2018) .................................................................................28 

Lilly v. Jamba Juice Co.,

308 F.R.D. 231 (N.D. Cal. 2014) .............................................................................................25

Loritz v. Exide Techs., Inc.,

2015 WL 6790247 (N.D. Cal. July 21, 2015) ..........................................................................35 

Marsh v. First Bank of Del.,

2014 WL 554553 (N.D. Cal. Feb. 7, 2014) .............................................................................24 

Martinez v. Pacific Bell,

225 Cal. App. 3d 1557 (1990) .................................................................................................24

McLeod v. Bank of America, N.A.,

2017 WL 6373020 (N.D. Cal. Dec. 13, 2017) .........................................................................29 

Mitchell v. Gonzales,

54 Cal. 3d 1041 (1991) ............................................................................................................27

Mullins v. Premier Nutrition Corp.,

2016 WL 1535057 (N.D. Cal. Apr. 15, 2016) .......................................................15, 17, 25, 26 

Northstar Fin. Advisors Inc. v. Schwab Inv.,

779 F.3d 1036 (9th Cir. 2015) .................................................................................................23

Opperman v. Path, Inc.,

2016 WL 3844326 (N.D. Cal. July 15, 2016) ..........................................................................32 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 11 of 50
CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - vi -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Parsons v. Bristol Dev. Co.,

62 Cal. 2d 861 (1965) ..............................................................................................................23

Parsons v. Ryan,

754 F.3d 657 (9th Cir. 2014) ...................................................................................................21

Pulaski & Middleman, LLC v. Google, Inc.,

802 F.3d 979 (9th Cir. 2015), cert. denied, 136 S. Ct. 2410 (2016) ........................................27 

Rannis v. Recchia,

380 F. App’x 646 (9th Cir. 2010) ............................................................................................14

Rutherford v. Owens-Illinois, Inc.,

16 Cal. 4th 953 (1997) .............................................................................................................27

Sali v. Corona Reg’l Med. Ctr.,

889 F.3d 623 (9th Cir. 2018) ...................................................................................................13

Smith v. Triad of Alabama, LLC,

2017 WL 1044692 (M.D. Ala. Mar. 17, 2017), aff’d on reconsideration, 2017 

WL 3816722 (M.D. Ala. Aug. 31, 2017).....................................................................24, 31, 32 

Soares v. Flowers Foods, Inc.,

320 F.R.D. 464 (N.D. Cal. 2017) .............................................................................................32

Stollenwerk v. Tri-West Health Care Alliance,

254 F. App’x 664 (9th Cir. 2007) ............................................................................................30

Tasion Commc’ns, Inc. v. Ubiquiti Networks, Inc.,

308 F.R.D. 630 (N.D. Cal. 2015) .............................................................................................34

Tyson Foods, Inc. v. Bouaphakeo,

136 S. Ct. 1036 (2016) .......................................................................................................29, 33 

Valentino v. Carter-Wallace, Inc.,

97 F.3d 1227 (9th Cir. 1996) .............................................................................................13, 34

Vaquero v. Ashley Furniture Indus., Inc.,

824 F.3d 1150 (9th Cir. 2016) .................................................................................................30

Villalpando v. Exel Direct Inc.,

2016 WL 1598663 (N.D. Cal. Apr. 21, 2016) .........................................................................29 

Walters v. Reno,

145 F.3d 1032 (9th Cir. 1998) .................................................................................................19

Werdebaugh v. Blue Diamond Growers,

2014 U.S. Dist. LEXIS 173789 (N.D. Cal. Dec. 15, 2014) .....................................................35 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 12 of 50
CASES PAGE

MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - vii -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Williams v. Gerber Prods. Co.,

552 F.3d 934 (9th Cir. 2008) ...................................................................................................25

Zinser v. Accufix Research Institute, Inc.,

253 F.3d 1180 (9th Cir. 2001) .................................................................................................32

STATUTES, RULES AND REGULATIONS 

California Business & Professions Code 

§17200.............................................................................................................................. passim

§17203......................................................................................................................................19

§17204......................................................................................................................................19

California Civil Code 

§1550........................................................................................................................................22

§1798.82...................................................................................................................................24

§1750................................................................................................................................ passim

Federal Rule of Civil Procedure

Rule 23 ............................................................................................................................. passim

SECONDARY AUTHORITIES 

Restatement (Second) of Torts §448..............................................................................................28

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 13 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Plaintiffs move this Honorable Court for an order certifying their claims1 against 

Defendants Yahoo! Inc. (“Yahoo”) and Aabaco Small Business, LLC (“Aabaco”) (collectively, 

“Defendants”)2

 under Rule 23 of the Federal Rules of Civil Procedure, and appointing 

themselves and their counsel as Class Representatives and Class Counsel, respectively. The 

common questions of law and fact raised by Defendants’ inadequate data security practices 

predominate, both in significance and in ability to move the case toward adjudication, over any 

individual questions, making this action ideal for class treatment.

I. STATEMENT OF ISSUES TO BE DECIDED 

The issue to be decided is whether Plaintiffs’ claims satisfy the requirements for class 

certification under Federal Rule of Civil Procedure 23(b)(2), (b)(3), and (c)(4). 

II. STATEMENT OF FACTS DEVELOPED THROUGH DISCOVERY 

A. Yahoo’s Services and Representations Concerning Data Security 

 Yahoo provides comprehensive internet services. Yahoo’s core service is Yahoo Mail, a 

free email service. 

3

 Ex. 3 at 939-941. 

 Ex. 3 at 941 

Anyone creating a Yahoo account in the United States or Israel agrees to Yahoo’s Terms 

of Service (“Yahoo TOS”). Ex. 4. Each time the Yahoo TOS was revised, users were required to 

1

 A chart of Plaintiffs’ proposed classes and claims is attached as Ex. 1 to the Declaration of John 

Yanchunis in Support of Plaintiffs’ Motion for Class Certification (“Yanchunis Dec.). 

References to “Ex.” or “Exs.” shall reference those exhibits attached to the Yanchunis Dec.

2

 In June 2017, Yahoo’s operating business and assets were acquired by Verizon 

Communications, Inc. (“Verizon”), who, through its subsidiary Oath Holdings, Inc. (“Oath”), 

continues to operate all Yahoo services, while all remaining assets were renamed Altaba, Inc. 

(“Altaba”). Ex. 2, ¶¶1-3; Ex. 5. Oath and Altaba have stipulated to the Court’s jurisdiction, as if 

an order had been issued substituting them as real parties in interest under Rule 25(c). Ex. 2, ¶¶5-

6.

3

 Yahoo Mail Pro is Yahoo’s premium email service. From October 2013 to June 2017 it was 

called Yahoo Ad-Free Mail, and prior to October 2013, it was called Yahoo Mail Plus. 

4

 Since November 2015, Aabaco, a wholly owned and controlled subsidiary of Yahoo, has 

provided services to Yahoo’s small business owners. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 14 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

accept its new terms. ECF No. 220 ¶39. The Yahoo TOS incorporated a “Privacy Policy,” which 

describes the types of personal information collected from users, and touted: “We have physical, 

electronic, and procedural safeguards that comply with federal regulations to protect personal 

information about you.” Ex. 6. On the “Security at Yahoo” web page linked to the Privacy 

Policy, Yahoo represented: “We deploy industry standard physical, technical, and procedural 

safeguards that comply with relevant regulations to protect your personal information.” Ex. 7. 

Aabaco made similar, uniform representations in the Yahoo Small Business or Aabaco Terms of 

Service (“Aabaco TOS”) (Ex. 8)5

 and incorporated Privacy Policy (Ex. 9) throughout 2011-2016.

B. The 2013 Breach, 2014 Breach, and Forged Cookie Breach 

 In 2016, Yahoo made repeated public confessions that its users’ Personally Identifiable 

Information (“PII”) had been stolen in a series of massive data breaches – i.e., the 2013 Breach, 

2014 Breach, and Forged Cookie Breach (collectively, “Breaches”). First, in September 2016, 

Yahoo revealed that PII “associated with at least 500 million user accounts was stolen” from its 

user database (“UDB”) in late 2014 (“2014 Breach”). Ex. 10. The stolen PII “included names, 

email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with 

bcrypt) and, in some cases, encrypted or unencrypted security questions and answers.” Id.

 (Ex. 11 at 919),

 Ex. 12 at 9. 

A few months later, Yahoo revealed that “an unauthorized third party . . . stole PII 

associated with more than one billion user accounts” in August 2013 (“2013 Breach”). Ex. 14. 

Ten months later, Yahoo announced the 2013 Breach affected all three billion existing accounts. 

Ex. 13. (Ex. 11 at 919), 

 Ex. 12 at 7. 

Around the same time the 2013 Breach was announced, Yahoo confirmed that “an 

5

 The Yahoo TOS and Aabaco TOS are collectively referred to as the “TOS.” 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 15 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

unauthorized third party accessed the company’s proprietary code to learn how to forge cookies,” 

and that 

 Ex. 14; Ex. 11 at 918. 

 (Ex. 11 at 919), 

 Ex. 12 at 10.

C. Yahoo’s Inadequate Information Security Was Ongoing and 

Pervasive and Negatively Impacted All Yahoo Users 

1. Yahoo’s Information Security Was Woefully Inadequate 

 Yahoo’s story is one of flagrant inattention to data security, where upper management 

continually starved for resources the “Paranoids,” the group “primarily responsible for the 

protection of Yahoo information and systems,” including the safety of user data. Ex. 11 at 909.

 Yahoo’s first Chief Information Security Officer (“CISO”), Justin Somaini, was hired in 

2011. Ex. 15 at 22:06-09.6

 The paltry budget Yahoo gave Somaini was far under what he asked 

for (and felt was needed). Id. at 121:07-123:05, 125:11-126:04. 

.

Ex. 15 at 275:04-276:16; 280:10-281:16; Ex. 16. 

 Ex. 17. 

. Ex. 16; Ex. 18. 

 Ex. 15 at 166:21-

174:07; 236:12-237:19, 288:10-290:19; Exs. 16-19; Ex. 20 at 991. Ramses Martinez, Senior 

Director of Threat Response, aptly described information security as “deplorable” when he was 

6

 Before then, “there were no functional roles and definitions” in the Paranoids “that you would 

find in a typical security organization.” Id. at 24:05-18, 29:10-23. 

Id. at 29:24-30:09, 148:15-25.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 16 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

hired in September 2011. Ex. 21 at 108:03-109:04. According to Martinez, the Paranoids 

“needed more resources” and “had a lot of work to do.” Id. at 134:13-136:21. 

Id. at 104:25-106:07. 

Ex. 22 at 428, 449. 

. Ex. 23 at 289. 

From April 2011 to January 2013, Yahoo had five different CEOs. Ex. 15 at 50:05-14. 

. Ex. 24 at 74:12-75:05. 

 Ex. 25 at 635, 659. From January 2013 until March 2014 – while the 2013 

Breach was happening (undetected) and the stage was being set for the 2014 Breach and Forged 

Cookie Breach – Yahoo had no permanent, full-time CISO. Yahoo abruptly fired Somaini in 

January 2013 without a succession plan, and did not have another permanent CISO until 14 

months later when Stamos was hired. Ex. 15 at 60:12-64:11; Ex. 21 at 36:10-37:09. 

Unsurprisingly, Martinez confirmed that “not having a CISO at the helm [during that period] was 

extremely detrimental to the [Paranoids] team.”7

 But a new CISO was no panacea.

In February 2015, Stamos told Yahoo’s Executive Vice President Jay Rossiter: “As a 

result of [planned staffing] cuts we will be well below what I consider the minimum staffing 

7

 Ex. 21 at 109:09-110:09 (many important projects initiated by Somaini stopped when he left, 

and many Paranoids team leaders left Yahoo at that same time). 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 17 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

necessary to protect Yahoo in the current threat environment.”8 9 Ex. 26. Martinez confirmed 

that “the security team was underfunded,” and “[w]e never seemed to be able to get enough to 

staff up, as I felt, and most of the folks I worked with felt was adequate. [W]e always had . . . 

more work to do than . . . we really had the resources to handle.” Ex. 21 at 135:16-136:21, 

138:20-139:06, 153:21-154:11. 

 (Ex. 25 at 645, 659), 

 Ex. 28 at 758. 

. Ex. 17; Ex. 

15 at 38:20-41:03, 110:06-14, 184:14-193:11. 

 Ex. 17. When Martinez left in August 2015, the information security organization “was 

nowhere near where [it] needed to be.” Ex. 21 at 134:13-136:21; see also Ex. 93 at 4-8. 

2. Yahoo Failed to Meet Industry Standards and Federal Regulations 

 Class members’10

 Ex. 29 at 5971; Ex. 21 at 127:21-128:15. 

 Ex. 30.

 Ex. 31 at 802, 

8 See also Ex. 27 at 53:12-54:22, 64:04-20, 83:09-22 (staffing and funding was inadequate 

throughout his tenure as CISO). 

9

 Emphasis is added, and citations are omitted throughout unless otherwise noted. 

10 “Class members” refers to members of either or both of the UCL Injunctive Relief Class and 

the Damages Class, which together with their Subclasses are referred to as the “Classes.” 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 18 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 6 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

806 (emphasis in original). 

Ex. 29 at 973.

. Ex. 29 at 973. 

Since at least 2008, Yahoo’s Privacy Policy represented that “[w]e limit access to 

personal information about you to employees who we reasonably believe need to come into 

contact with that information.” Ex. 6. 

Ex. 29 at 980; Ex. 33. 

. Ex. 21 at 113:15-115:08, 171:10-173:06.

 (Ex. 27 at 111:16-113:09, 116:20-117:23) – 

 (Ex. 34 at 271-77). 

Until late 2013, Yahoo continued to “hash” user passwords using the outdated and 

insecure MD5 algorithm. Research, well-known since early 2009, stated that MD5 was 

“cryptographically broken and unsuitable for further use.” Ex. 35. 

 Ex. 21 at 610:16-612:11. Yahoo knew this, and by 

2011, considered switching to a more secure mechanism called “bcrypt.” Ex. 15 at 198:06-

204:19; Ex. 21 at 611:20-612:01. 

 Ex. 32 at 341. 

11 Ex. 11 at 

11 See also Ex. 21 at 229:05-24

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 19 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 7 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

919.

 Ex. 21 at 167:21-168:11. 

 Ex. 11 

at 919. 

. Id.

 Ex. 36; Ex. 24 at 25:01-32:13, 77:17-81:11. 

 Ex. 24 at 77:17-81:11. 

 Ex. 3 at 958. 

3. Yahoo Knew Its Data Security Measures Were Grossly Inadequate 

Well before the Breaches, Yahoo knew about severe vulnerabilities in its networks and 

deficiencies in its security capabilities. 

 Ex. 37. 

. Ex. 27 at 128:19-129:20; Ex. 38 at 588:15-593:09. 

 Ex. 39. 

(Ex. 40 at 060; Ex. 41 at 527-33) – 

 Ex. 41 at 525. 

Ex. 40 at 061. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 20 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 8 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Ex. 42 at 332. 

Ex. 43 

at 166. 

 Ex. 24 at 74:12-75:05; Ex. 27 at

84:18-85:11.

 One glaring deficiency was the lack of an intrusion detection system (“IDS”). 

 Ex. 21 at 104:25-105:15, 150:05-15; see also Ex. 44; Ex. 30. 

 Ex. 21 at 150:19-151:25; Ex. 45 at 171:23-176:07; Ex. 24 at 142:14-145:04. 

 Ex. 46 at 7-11. 

(Ex. 47 at 365; Ex. 29 at 6001)

Ex. 48. Ex. 49 at 677. 

 Inadequate logging was another pervasive problem.

 Ex. 21 at 147:01-150:04. 

 Ex. 50. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 21 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 9 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. Ex. 51 at 587. 

12

 Ex. 38 at 533:14-534:06; Ex. 54 at 16:03-

23, 29:03-30:12. 

 Ex. 55. 

 Ex. 56. 

.

13 Ex. 52 at 176:16-

180:09, 283:10-285:06, 367:15-25; Ex. 57.

 Ex. 59 at 341. 

 Ex. 

60 at 262; Ex. 21 at 209:10-25. 

 Ex. 21 at 206:22-207:25; see also Ex. 93 at 20-23.

12 Ex. 52 at 100:05-101:22

 Ex. 53 

13 See also Ex. 58 at 404

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 22 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 10 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

D. Senior Executives Had Contemporaneous Knowledge of the 2014 Breach 

 In late 2014 or early 2015, Yahoo’s CISO Stamos, EVP Rossiter, General Counsel Ron 

Bell, CEO Mayer, and its Board were all informed that the attackers in the 2014 Breach had 

exfiltrated PII for hundreds of millions of user accounts from Yahoo’s UDB.

. Ex. 61 at 009; Ex. 62 at 407; Ex. 60 at 258; Ex. 46. 

 Ex. 61 at 6008-09; Ex. 62 at 407. 

 Ex. 60 at 258; Ex. 63 at 131; Ex. 61 at 6008-09. 

 Ex. 63 at 131; Ex. 64. Martinez briefed Stamos daily throughout 

late 2014, and Stamos informed Rossiter about the investigation and response. Ex. 45 at 87:10-

89:12, 117:14-121:09; Ex. 24 at 36:03-37:12, 44:11-45:01, 104:12-105:10. Stamos also met 

regularly with Ron Bell. Ex. 24 at 50:04-52:25. 

. Ex. 65; Ex. 66.

 Ex. 60 at 257. 

 Ex. 67 at 425; Ex. 63 at 131; Ex. 61 at 

010; Ex. 45 at 57:18-59:05. 

 Ex. 67 at 425; Ex. 63 at 131; Ex. 61 at 010. 

 Ex. 68 at 560; Ex. 63 

at 131; Ex. 24 at 61:15-62:17. 

 Ex. 63 at 131-32; Ex. 68 at 560; Ex. 69. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 23 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 11 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Ex. 63 at 136; Ex. 21 at 229:25-231:05.

.

14

 Ex. 67 at 426; 

Ex. 61 at 010; Ex. 45 at 57:05-59:05. 

. Ex. 68 at 560; Ex. 72; Ex. 38 at 482:03-20. 

. Ex. 68 at 

560; Ex. 73. But, Yahoo sent no notifications to the hundreds of millions of users whose PII was 

stolen from the UDB, and it would not do so until September 22, 2016 – almost two years later.

 Ex. 74; Ex. 75; Ex. 24 at 139:06-155:25.

 Ex. 24 at 105:18-108:15, 150:12-152:14; Ex. 76; Ex. 21 at 

256:14-257:21; Ex. 27 at 278:10-282:02 and its Exhibits 11 and 12. 

. Ex. 77; Ex. 68 at 553. In March 2017, 

Yahoo disclosed the SCRC’s findings, which conceded Yahoo’s information security team’s 

contemporaneous understanding of the severity of the 2014 Breach, but questioned the extent to 

which that understanding “was effectively communicated and understood outside the information 

security team,” and found that “the 2014 Security Incident was not properly investigated and 

analyzed at the time, and the Company was not adequately advised with respect to the legal and 

business risks associated with the 2014 Security Incident.” Ex. 78. 

 Martinez strongly disagreed with any notion that the 2014 Breach was “not properly 

14 Ex. 68 at 560; Ex. 70; Ex. 71; Ex. 27 at 171:07-179:11, 254:12-262:05, 266:23-267:16, 

272:17-275:08, and its Exhibit 11. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 24 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 12 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

investigated or analyzed,” stating: “That’s bullshit. Right. It was thoroughly investigated for 

months. So that is false.” Ex. 45 at 165:05-24. Martinez testified that the Paranoids also 

effectively communicated all relevant facts to Yahoo senior management, including “wide 

dissemination of the facts” about the user data exfiltration. Ex. 45 at 167:02-169:18, 171:14-19. 

Stamos likewise testified that it was “definitely not true” that the Paranoids were the only ones 

with contemporaneous knowledge of the UDB exfiltration; the data exfiltration “was understood 

. . . by multiple people that we had briefed on it above me,” including Rossiter, Mayer, Bell, the 

Board Committee, and Filo. Ex. 24 at 82:17-83:12, 89:07-91:05; Ex. 27 at 446:10-452:11. 

According to Stamos, his team “communicated everything we knew [about the 2014 Breach] to 

upper management,” and he had “no doubt” that the information was communicated to Mayer 

and Filo in December 2014. Ex. 24 at 92:22-95:21. 

E. Yahoo’s Information Security Is Still Inadequate 

Yahoo’s history of repeated, un-remedied security failures strongly suggests its systems 

remain inadequate to secure users’ PII. In responding to Plaintiffs’ Interrogatory No. 3, regarding 

“what, if any, security measures pertaining to Users’ PII have been implemented at Oath 

following Verizon’s acquisition of Yahoo,” Yahoo directed Plaintiffs to pages in its CID 

Responses. Ex. 12 at 5-6. 

 Ex. 3 at 5957-960, 5962-965; Ex. 79 at 0590-593.

. Ex. 93 at 6, 10, 25. Evidence 

collected to date shows users’ PII is still in Yahoo’s possession and control. According to 

Frantz’s analysis of that evidence: 

Id. at 6. 

 Ex. 32 at 343. The risk to users of additional 

intrusions and exfiltration continues unabated. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 25 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 13 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

III. ARGUMENT 

A. Rule 23 Was Designed to Aggregate Common Issues 

 The requirements of Federal Rule of Civil Procedure 23 are well known: numerosity, 

commonality, typicality, and adequacy, and satisfaction of the requirements for one of the class 

types defined in Rule 23(b). Ellis v. Costco Wholesale Corp., 657 F.3d 970, 979-80 (9th Cir. 

2011). To certify a Rule 23(b)(2) class, the plaintiff must show that “the party opposing the class 

has acted or refused to act on grounds that apply generally to the class, so that final injunctive 

relief or corresponding declaratory relief is appropriate respecting the class as a whole.” Fed. R. 

Civ. P. 23(b)(2). Certification under Rule 23(b)(3) requires that “‘questions of law or fact 

common to class members predominate over any questions affecting only individual members, 

and that a class action is superior to other available methods for fairly and efficiently 

adjudicating the controversy.’” Sali v. Corona Reg’l Med. Ctr., 889 F.3d 623, 629 (9th Cir. 

2018). Rule 23(c)(4) provides a court with discretion to certify a class to resolve particular 

issues, such that “[e]ven if the common questions do not predominate over the individual 

questions,” a court may “isolate the common issues . . . and proceed with class treatment of these 

particular issues.” Valentino v. Carter-Wallace, Inc., 97 F.3d 1227, 1234 (9th Cir. 1996). 

 While a “‘rigorous analysis’” is required, In re Yahoo Mail Litig., 308 F.R.D. 577, 586 

(N.D. Cal. 2015), this does not equate to “a mini-trial.” Sali, 889 F.3d at 631. A “district court is 

not limited to considering only admissible evidence in evaluating whether Rule 23’s 

requirements are met.” Id. at 632. Where the merits are probed, they may be so only to the extent 

“that they are relevant to determining whether the Rule 23 prerequisites for class certification are 

satisfied.” Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 U.S. 455, 466 (2013). Plaintiffs 

meet their burden under Rule 23, such that certification of the proposed Classes is warranted. 

B. The Proposed Classes Meet the Requirements of Rule 23(a) 

1. Numerosity 

 The Classes number in the hundreds of thousands and, in some cases, the millions. The 

Court “may consider reasonable inferences drawn from the facts before it” in determining 

whether numerosity exists. Yahoo Mail, 308 F.R.D. at 589-90. Based on the number of user 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 26 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 14 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

accounts in the United States, Israel, and California impacted by the Breaches, including free, 

paid, and small business accounts, and the number of accounts impacted worldwide, the 

proposed Classes are sufficiently numerous. Rannis v. Recchia, 380 F. App’x 646, 651 (9th Cir. 

2010) (noting numerosity usually met with at least 40 class members). 

2. Commonality

 Rule 23(a)(2) requires “questions of law or fact common to the class.” A single common 

question is sufficient. See Ellis, 657 F.3d at 981. Here, each of the claims Plaintiffs seek to 

advance turn on the question of whether Defendants’ security protocols and policies were 

adequate to protect Class members’ PII. This involves examining related questions that are also 

common across all Classes and Subclasses, including what steps Defendants took (or did not 

take) to identify and respond to security threats, whether Defendants complied with industry 

norms and applicable regulations, and whether and when Defendants knew or should have 

known of the Breaches. Further, discovery reveals that the Breaches were part of a single course 

of conduct that gives rise to the legal rights Plaintiffs seek to enforce under California law.

 As set forth in the operative complaint and discussed herein, additional questions of law 

and fact arise from Defendants’ course of conduct that are common to Damages Class members, 

such as: (1) whether Plaintiffs and Damages Class members’ accounts were governed by valid 

and binding contracts; (2) whether the TOS required Defendants to adequately safeguard 

Plaintiffs and Damages Class members’ PII; (3) whether Defendants breached the TOS by 

failing to adequately safeguard PII; (4) whether Defendants owed a duty to exercise due care in 

collecting, storing, and safeguarding PII; (5) whether Defendants breached that duty; (6) whether 

Defendants knew about the Breaches and the state of their security (and when); (7) whether 

Defendants failed to timely notify Plaintiffs and Damages Class members of the Breaches; and 

(8) whether Plaintiffs and Damages Class members are entitled to punitive damages. 

 Questions common to the UCL Injunctive Relief Class include whether Yahoo’s 

provision of inadequate security was (1) an unfair business practice under either the tethering or 

balancing tests, or (2) an unlawful business practice. Additional common questions for the Paid 

Users Subclass and Small Business Users Subclass include: (1) whether Yahoo and/or Aabaco 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 27 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 15 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

had a duty to disclose the inadequacy of its security; and (2) whether Plaintiffs Mortensen and 

Neff and Subclass members would have been aware and would have acted differently had 

Defendants disclosed those facts (i.e., whether they were material to a reasonable person). 

 Last, the inadequacy of Yahoo’s security protocols and procedures also resulted in the 

same fundamental injury to each Damages Class member – compromise of their PII – causing all 

Damages Class members to lose value in their PII. Members of the Paid Users Subclass and 

Small Business Users Subclass also suffered the lost benefit of their bargain. Moreover, the same 

legal theories and facts giving rise to claims for lost value of PII and benefit of the bargain 

damages give rise to Damages Class members’ claims for losses related to identity fraud. 

3. Typicality 

 Rule 23(a)(3)’s typicality standard is permissive. “[C]laims are ‘typical’ if they are 

reasonably co-extensive with those of absent class members.” Hanlon v. Chrysler Corp., 150 

F.3d 1101, 1020 (9th Cir. 1998). “[T]hey need not be substantially identical.” Id.

 Plaintiffs and Class members were injured through Defendants’ pattern of misconduct. 

Plaintiffs’ claims and legal theories, both in their individual and representative capacities, arise 

under this same factual predicate. Mullins v. Premier Nutrition Corp., 2016 WL 1535057, at *4 

(N.D. Cal. Apr. 15, 2016) (“Putative class members’ claims are usually typical if their claims 

arise[] from the same course of events, and each class member makes similar legal arguments to 

prove the defendant’s liability.”). The elements Plaintiffs must prove for negligence, breach of 

express or implied contract, and breach of the implied covenant of good faith and fair dealing, 

and for their claims under California’s Unfair Competition Law, Cal. Bus. & Prof. Code §17200, 

et seq. (“UCL”), Consumers Legal Remedies Act, Cal. Civ. Code § 1750, et seq. (“CLRA”), and 

Customer Records Act, Cal. Civ. Code §1798.80, et seq. (“CRA”) are identical to what absent 

Class members would need to prove, and there are no defenses unique to Plaintiffs. 

a. UCL Injunctive Relief Class 

 Plaintiffs Heines, Essar, Dugas, and the Ridolfos are typical of the UCL Injunctive Relief 

Class because each signed up for a free Yahoo account pursuant to the Yahoo TOS, and, as 

required by Yahoo, each provided their PII. Yahoo maintained their PII in its UDB. Plaintiffs 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 28 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 16 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

suffered the access, compromise, or theft of their PII by the Breaches as a result of Yahoo’s 

unfair and unlawful practices of inadequately safeguarding that PII and failing to timely identify, 

investigate, and remediate security threats or to notify users of the Breaches, and all suffered lost 

money or property as a result. Indeed, all Class members suffered a loss in the value of their PII 

maintained on the UDB when the intrusion occurred, and when that PII was used to access Class 

members’ accounts, the loss of value extended to their PII contained therein. Not only did each 

Class member lose the value of their PII, each is also now at an increased risk of future harm. 

That risk of future harm persists because their PII remains in Yahoo’s possession and because 

Yahoo has not yet adequately remediated its security policies and practices. Thus, their PII is not 

adequately safeguarded from future unauthorized intrusions into the UDB. 

b. Damages Class and Subclasses 

 Plaintiffs and Damages Class members’ accounts were governed by nearly identical 

contracts. Free Users Subclass members, including Plaintiffs Heines, Essar, Dugas, the Ridolfos, 

Granot, and Rivlin,15 and Paid Users Subclass members, including Plaintiff Mortensen, signed up 

for accounts governed by the Yahoo TOS. Small Business Users Subclass members, including 

Plaintiff Neff, similarly signed up for Yahoo small business or Aabaco accounts and agreed to 

the Aabaco TOS. The TOS contain parallel terms regarding privacy protections, choice of law 

and venue, and limitations on Defendants’ liability, which have all remained materially 

unchanged during the relevant time period. Each time Defendants updated the TOS, Plaintiffs 

and Damages Class members were required to agree to their revised terms. Accordingly, the 

same principles of contract formation, and the same material terms, apply across the Damages 

Class. To the extent there is variation, either in the formation or interpretation of the governing 

TOS, or in damages sought, those differences are universal across each Subclass. Either the 

governing TOS are valid, or they are not. Either the TOS imposed an implied covenant of good 

faith and fair dealing or they did not. If the TOS are not express contracts, then each Damages 

Class member’s creation of a user account either gave rise to an implied contract or did not. 

15 Plaintiff Rivlin’s deposition is being taken concurrent with the filing of Plaintiffs’ Motion, on 

July 13, 2018, and so citation to his testimony is not possible. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 29 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 17 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Similarly, to the extent that Defendants owed Plaintiffs and members of the Damages 

Class a legal duty to exercise due care in safeguarding their PII, that duty is identical across all 

Damages Class members. Either Defendants owed a duty to Plaintiffs and members of the 

Damages Class, or they did not. Either Defendants breached that legal duty, or they did not. 

Plaintiffs and Damages Class members all suffered the access, compromise, and theft of their PII 

by the Breaches, resulting from Yahoo’s uniform failures to adequately safeguard their PII. Their 

contract and negligence claims clearly arise from the same course of conduct. 

 Plaintiff Mortensen is also typical of Paid Users Subclass members because he was a 

consumer who purchased Yahoo premium email services and whose PII was stolen in the 

Breaches. The course of conduct underlying his claim and that of all Paid Users Subclass 

members is the same: Yahoo’s withholding of material information regarding the safeguarding of 

their PII and the 2014 Breach and Forged Cookie Breach. Mortensen, like all Paid Users 

Subclass members, has suffered a loss of value in his PII and is an increased risk of future harm. 

Plaintiff Neff is typical of Small Business Users Subclass members because he was exposed to 

the same small business advertising (and fraudulent omissions) to which all such members were 

exposed when they created their accounts. Neff is also seeking the same relief to which all Small 

Business Users Subclass members are entitled – restitution of the price paid minus the actual 

value of the small business services for which he received. Mullins, 2016 WL 1535057, at *6. 

Plaintiffs Heines and Dugas are typical of the California Users Subclass because they were both 

residents of California when the 2014 and Forged Cookie Breaches occurred, both suffered the 

exfiltration of their PII, and neither was notified until years after the fact. 

4. Adequacy of Representation 

 Rule 23(a)(4) requires the representatives to “fairly and adequately protect the interests of 

the class.” Fed. R. Civ. P. 23(a)(4). Adequacy involves a two-part inquiry: “(1) do the named 

plaintiffs and their counsel have any conflicts of interest with other class members and (2) will 

the named plaintiffs and their counsel prosecute the action vigorously on behalf of the class?” 

Hanlon, 150 F.3d at 1020. Plaintiffs and proposed Class Counsel satisfy these requirements. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 30 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 18 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

a. Plaintiffs Are Adequate Class Representatives 

 Plaintiffs have no conflicts of interests with absent Class members, as they “‘possess the 

same interest and suffer[ed] the same injury as the class members.’” In re LDK Solar Sec. Litig.,

255 F.R.D. 519, 532 (N.D. Cal. 2009). Indeed, their claims flow from the same underlying 

conduct, all suffered the compromise of their accounts and theft of their PII, and now suffer an 

increased risk of harm. Plaintiffs’ and Class members’ interests are indisputably aligned.16

 Second, Plaintiffs have each demonstrated their unwavering commitment to the Classes 

they seek to represent in their vigorous prosecution of this case. Plaintiffs’ sworn deposition 

testimony and the actions they have undertaken in this litigation demonstrate that they 

understand the role and obligations of class representatives.1718 The record shows that Plaintiffs 

have actively participated in the prosecution of this action on behalf of the Classes and have 

monitored their experienced counsel at every step. Plaintiffs have reviewed numerous documents 

and pleadings in the case, and each has participated in in-person meetings with their attorneys 

and regularly communicates with them regarding litigation strategy, the status of the litigation, 

and major case developments.19 Plaintiffs have responded to Defendants’ discovery requests, 

producing documents, including, for instance, through the imaging and examination of their 

personal computers, responding to interrogatories, and giving informed testimony.20

16 That only some Class members suffered identity theft does not create an “intraclass conflict.” 

See In re Target Corp. Customer Data Sec. Breach Litig., 892 F.3d 968, 973 (8th Cir. 2018).

17 Ex. 80 at 11:24-25, 21:2-9; Ex. 81 at 224:25-225:10; Ex. 82 at 257:23-258:13; Ex. 83 at 21:5-

12, 23:21-24:5, 119:21-23, 246:9-247:25; Ex. 84 at 250:14-252:5; Ex. 85 at 13:18-14:5, 18:18-

22:24; Ex. 86 at 94:8-95:7, 96:15-97:4; Ex. 87 at 143:21-145:25, 208:10-209:11.

18 Plaintiff Rivlin’s deposition is being taken concurrently with the filing of Plaintiffs’ Motion, 

and therefore, his testimony is not yet available for citation.

19 Ex. 80 at 36:17-37:25, 186:4-9, 184:25-185:6, 191:19-192:2; Ex. 81 at 23:19-24:11, 25:15-17, 

27:1-17, 138:7-20, 142:1-9; Ex. 82 at 23:1-17, 24:16-25:20, 57:10-60:6, 219:6-220:10; Ex. 83 at 

27:3-28:5, 160:22-162:1, 169:7-171:9; Ex. 84 at 252:1-255:12; Ex. 85 at 283:8-284:2; Ex. 86 at 

18:2-23, 106:11-25; Ex. 87 at 23:11–24:17, 153:5-155:3, 158:8-19, 216:13-217:22. 

20 Ex. 80 at 61:6-23, 119:14-23, 313:16-314:24, 318:8-17; Ex. 81 at 27:18-28:3, 142:24-145:2; 

Ex. 82 at 57:10-60:6, 259:5-260:11; Ex. 83 at 80:18-81:6, 267:11-16; Ex. 84 at 22:12-23:12, 

227:20-228:7; Ex. 85 at 283:8-284:2; Ex. 87 at 23:24-24:17, 153:5-155:3, 158:8-19, 216:13-

217:22.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 31 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 19 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

b. Plaintiffs Have Selected Adequate Class Counsel 

Plaintiffs have selected competent counsel with no conflicts of interest. Class Counsel are 

experienced class action litigators that regularly prosecute and obtain significant victories for 

injured consumers. See Exs. 88-92. This Court previously appointed this same slate of attorneys 

as Lead Counsel and Plaintiffs’ Executive Committee. ECF No. 58. Since their appointment, 

Plaintiffs’ proposed Class Counsel have litigated this action vigorously, including by: (1) 

successfully opposing two motions to dismiss; (2) reviewing and analyzing over 9 million pages 

of documents produced by Defendants; (3) uncovering key documents in discovery; (4) 

reviewing and producing 13,856 pages of Plaintiff-related documents; (5) taking a lengthy, 2-day 

30(b)(6) deposition, as well as the depositions of numerous persons with personal knowledge of 

the facts alleged in the case; (6) propounding discovery requests on key non-parties; and (7) 

working with experts to study and explain issues for the factfinders in this litigation. There is no 

reason to doubt their adequacy.

C. Rule 23(b)(2) Certification of the UCL Injunctive Relief Class Is Appropriate 

 As provided under the UCL,21 Plaintiffs request certification of the UCL Injunctive 

Relief Class for the specific declaratory and injunctive relief outlined in the report of Plaintiffs’ 

information security expert. Ex. 93 at 10-14. UCL Injunctive Relief Class members’ claims arise 

under two prongs of the UCL: (1) unlawful, for violating the CRA, §5(a) of the Federal Trade 

Commission Act, 15 U.S.C. §45(a), Cal. Bus. & Prof. Code §22576 (as a result of Yahoo failing 

to comply with its own posted privacy policies), and the CLRA; and (2) unfair, for failing to 

employ adequate safeguards to protect users’ PII. 

 Under Rule 23(b)(2), it is “sufficient if class members complain of a pattern or practice 

that is generally applicable to the class as a whole.” Yahoo Mail, 308 F.R.D. at 598 (citing

Walters v. Reno, 145 F.3d 1032, 1047 (9th Cir. 1998)). “Even if some class members have not 

been injured by the challenged practice, a class may nevertheless be appropriate.” Id. “Unlike 

21 “Any person who engages, has engaged, or proposes to engage in unfair competition may be 

enjoined in any court of competent jurisdiction.” Cal. Bus. & Prof. Code §17203. Any person 

who has suffered injury in fact and lost money or property as a result of unfair competition “may 

pursue representative claims or relief on behalf of others.” Id.; see also id. at §17204. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 32 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 20 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Rule 23(b)(3), a plaintiff does not need to show predominance of common issues or superiority 

of class adjudication to certify a Rule 23(b)(2) class.” Yahoo Mail, 308 F.R.D. at 587; see also 

Brazil v. Dole Packaged Foods, LLC, 2014 WL 2466559, at *10 (N.D. Cal. May 30, 2014) 

(“Ordinarily, it follows that there is no need [in evaluating a Rule 23(b)(2) class] ‘to undertake a 

case-specific inquiry into whether class issues must predominate or whether class action is the 

superior method of adjudicating the dispute . . . .’”). 

 Plaintiffs challenge a pattern or practice that is generally applicable to all UCL Injunctive 

Relief Class members.22 Plaintiffs contend all users provided PII to Yahoo when registering for 

accounts, and that PII, in turn, provided access to the additional PII found in their emails. As 

previously discussed, Yahoo failed to adequately safeguard that PII, and continues to do so.23

Specifically, Yahoo maintains and stores U.S. users’ PII in the UDB and has failed to take the 

steps necessary to prevent and stop unauthorized access to that UDB.

 As the record evidence in this case makes clear, from at least 2011, Yahoo had a uniform 

practice of: (1) understaffing and underfunding its departments charged with securing user data; 

(2) failing to provide or pay for industry standard core competency training for its information 

security personnel; (3) failing to ensure that its security personnel consistently used Yahoo’s 

tools for detecting and monitoring adverse security events; (4) failing to implement industry 

standard protocols or to employ best practices, thus failing to properly encrypt user data, harden 

Yahoo’s internal network, and prevent unauthorized external access into the Yahoo environment; 

and (5) ignoring and blatantly erasing documentation of known and persistent security 

deficiencies. See, e.g., Ex. 93 at 4-10, 14-15, 20-25. Discovery in this case shows these failings 

were uniform across the Class, persistent throughout the relevant time period, and directly 

impacted the security of all UCL Injunctive Relief Class members’ PII, which was stored in the 

UDB.

22 Because the applicable TOS for all Class members includes a choice of law provision 

specifying California law shall apply regardless of California’s conflict of law principles (ECF 

No. 196, ¶¶174, 177, 178), the application of the UCL to all Class members’ claims is proper. 

23 As noted above, evidence thus far shows that Oath still has possession of all of the UCL 

Injunctive Relief Class members’ PII, and Plaintiffs believe many of Yahoo’s unsafe data 

security practices are being continued by Oath, making injunctive relief appropriate.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 33 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 21 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

.

24

 Because Yahoo’s company-wide policies and failures were uniform and persistent 

through the entire relevant time period, and continue to significantly increased the risk of harm to 

all UCL Injunctive Relief Class members, Rule 23(b)(2) certification is particularly apt. See

Parsons v. Ryan, 754 F.3d 657, 688 (9th Cir. 2014) (affirming certification seeking injunction of 

systemic deficiencies in policies and practices that put all plaintiffs at substantial risk of harm). 

Yahoo Mail is instructive on this point. There, the plaintiffs asked this Court to certify a class of 

non-Yahoo mail subscribers to enjoin Yahoo from intercepting and scanning non-Yahoo mail 

subscribers’ emails to Yahoo users. Though the same policy applied to all non-Yahoo mail 

subscribers, Yahoo argued that the issue of whether individualized users consented to the 

interception precluded Rule 23(b)(2) certification. This Court rejected Yahoo’s argument, noting 

the focus of a Rule 23(b)(2) analysis is “not on the claims of individual class members, but rather 

whether [defendant] engaged in a ‘common policy.’” Yahoo Mail, 308 F.R.D. at 599.

 Likewise, Plaintiffs challenge Yahoo’s practice of inadequately safeguarding UCL 

Injunctive Relief Class members’ PII and, therefore, “‘seek uniform relief from a practice 

applicable to’ the entire class.” Id. at 600. Rule 23(b)(2) certification is appropriate even if some 

UCL Injunctive Relief Class members do not ultimately have viable UCL claims. See id. And, as 

in Yahoo Mail, because the equitable relief Plaintiffs seek is identical across the UCL Injunctive 

Relief Class, it may be properly sought through a Rule 23(b)(2) class. Id. at 600.

D. Rule 23(b)(3) Certification of the Damages Class and Subclasses Is Proper

 There is “‘clear justification for handling the dispute on a representative . . . basis if 

common questions present a significant aspect of the case and they can be resolved for all 

members of the class in a single adjudication.’” In re Lenovo Adware Litig., 2016 WL 6277245, 

at *17 (N.D. Cal. Oct. 27, 2016). They do so here, as demonstrated below. 

24 See Ex. 21 at 150:05-151:25; Ex. 45 at 171:23-176:07; Ex. 24 at 142:14-145:04; Ex. 44; Ex. 

30; Ex. 46 at 7-11; Ex. 48.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 34 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 22 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. Common Questions of Law and Fact Predominate 

 “The predominance analysis under Rule 23(b)(3) focuses on ‘the relationship between the 

common and individual issues’ in the case, and ‘tests whether proposed classes are sufficiently 

cohesive to warrant adjudication by representation.’” Just Film, Inc. v. Buono, 847 F.3d 1108, 

1120 (9th Cir. 2017); see also Davidson v. Apple, 2018 WL 2325426, at *14 (N.D. Cal. May 7, 

2018) (articulating five-principle approach to predominance analysis). 

a. Common Evidence Proves Plaintiffs’ Claims 

 A predominance analysis generally begins with an examination of the elements 

underlying a plaintiff’s causes of action. Ellsworth v. U.S. Bank, N.A., 2014 WL 2734953, at *19 

(N.D. Cal. June 13, 2014). “In determining whether common questions predominate, the Court 

identifies the substantive issues related to plaintiff’s claims (both the causes of action and 

affirmative defenses); then considers the proof necessary to establish each element of the claim 

or defense; and considers how these issues would be tried.” Id.

(1) Plaintiffs’ Contract Claims 

 Plaintiffs will use common evidence to prove the elements of their breach of contract 

claim, applying California law: (1) formation; (2) Damages Class members’ performance; (3) 

Defendants’ breach; and (4) resulting appreciable and actual damages. ECF No. 132 at 75. 

 First, whether the TOS created express contracts will be determined on the face of the 

documents and on common facts. Elements “essential to the existence of a contract” are 

“[p]arties capable of contracting,” “consent,” a “lawful object,” and “sufficient cause or 

consideration.” Cal. Civ. Code §1550. When Damages Class members created their accounts, 

they were required to agree to the TOS in an identical manner, through an adhesion agreement 

presented at registration, and each time Defendants modified terms, Damages Class members 

were required to accept, as is, or lose access to their accounts. In consideration, Defendants 

agreed to provide members of the Free Users, Paid Users, and Small Business Users Subclasses 

with promised services. In exchange, members of those Subclasses provided their PII and agreed 

to either a payment for, e.g., ad-free or small business services, and/or to the inclusion of 

advertisements and other communications from Defendants. The determination of whether these 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 35 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 23 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

facts establish the formation of an express contract do not vary among Damages Class members. 

These same facts will also demonstrate the formation of implied contracts between Damages 

Class members and Defendants, in the alternative to express contracts. Northstar Fin. Advisors 

Inc. v. Schwab Inv., 779 F.3d 1036, 1050-51 (9th Cir. 2015) (“An implied-in-fact contract 

requires proof of the same elements necessary to evidence an express contract: mutual assent or 

offer and acceptance, consideration, legal capacity and lawful subject matter.”). 

 Second, common proof will demonstrate that Damages Class members performed under 

the governing TOS. Defendants admit all Damages Class members “accepted Defendants’ terms 

of service when they registered to use Defendants’ services.” ECF No. 220, ¶¶173, 176, 178. 

According to both the Yahoo TOS and Aabaco TOS, a user’s breach or violation was cause for 

termination of the account. By definition, all Damages Class members continued to maintain 

accounts when one or more of the Breaches occurred and, thus, had not been terminated. 

 Third, whether Defendants breached their contracts with Damages Class members will be 

judged by universal facts. Plaintiffs will prove that Defendants’ Privacy Policies, including the 

incorporated and hyperlinked “Security at Yahoo” page, is part of their contracts. Each TOS 

version has language expressly incorporating the Privacy Policies, which are identical in their 

promises to safeguard users PII consistent with industry standards and applicable regulations. 

The interpretation of these provisions does not turn on extrinsic evidence; it is solely a judicial 

function. Parsons v. Bristol Dev. Co., 62 Cal. 2d 861, 865 (1965).

 Common proof will also establish Defendants’ breach of the TOS by failing to provide 

“physical, electronic, and procedural safeguards that comply with federal regulations” and failing 

to “deploy industry standard physical, technical, and procedural safeguards that comply with 

relevant regulations” to protect Damages Class members’ PII. This evidence will include 

deposition testimony, Defendants’ admissions and discovery responses, investigative reports of 

government agencies and security consultants, and Defendants’ own documents. Common 

evidence will also demonstrate Defendants’ breach of the implied covenant of good faith and fair 

dealing, by showing Defendants deliberately ignored the warnings of their security personnel and 

outside consultants to implement measures to safeguard Damages Class members’ PII after the 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 36 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 24 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2013 Breach (and earlier incidents) and the 2014 Breach, and that Defendants knowingly failed 

to notify Damages Class members of the 2014 Breach. Thus, a jury will be able to answer, at 

once, whether Defendants committed a conscious and deliberate act, unfairly frustrating the 

agreed common purpose of the contract, as to all Damages Class members. Careau & Co. v. 

Security Pac. Bus. Credit, Inc., 222 Cal. App. 3d 1371, 1394 (1990).

(2) Plaintiffs’ Negligence Claim 

 Classwide application of California law moots many of the predominance concerns 

nationwide negligence classes often raise. See Marsh v. First Bank of Del., 2014 WL 554553, at 

*16 (N.D. Cal. Feb. 7, 2014) (certifying negligence class under California law). All Damages 

Class members must prove the same elements to prevail on their negligence claim: (1) a duty; (2) 

breach of that duty; (3) causation; and (4) a cognizable injury. Ileto v. Glock Inc., 349 F.3d 1191, 

1203 (9th Cir. 2003) (citing Martinez v. Pacific Bell, 225 Cal. App. 3d 1557, 275 (1990)).

 In a case such as this, where the operative conduct giving rise to both the duty and breach 

is uniform, Plaintiffs’ negligence claim is appropriate for classwide resolution. See Giroux v. 

Essex Prop. Tr., Inc., 2018 WL 2463107, at *4 (N.D. Cal. June 1, 2018). Each Damages Class 

member was a Yahoo or Aabaco user, each alleges their PII was stolen, each alleges injury as a 

result of that theft, and each suffered the same general type of damages – lost value of PII and 

the foreseeable losses stemming from identity theft. Thus, questions of legal duty and 

Defendants’ breach of that duty – like the questions of the existence and breach of a contract – 

are common issues susceptible to common proof. See, e.g., Smith v. Triad of Alabama, LLC,

2017 WL 1044692, at *13 (M.D. Ala. Mar. 17, 2017) (certifying negligence class in data breach 

suit against hospital where “each class member was a non-hospital patient at Flowers, each class 

member alleges injury as a result of Millender’s records heist, . . . each class member suffered 

the same general type of damages,” and class members’ claims were subject to a single state’s 

law), aff’d on reconsideration, 2017 WL 3816722 (M.D. Ala. Aug. 31, 2017).

(3) Plaintiffs’ CRA Claim for Failure to Notify 

 Cal. Civ. Code §1798.82 requires timely notice to Californians of a data breach. Using 

Yahoo’s own admissions, the September 2016 notice, and evidence already on record, Plaintiffs 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 37 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 25 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Heines and Dugas will establish that Yahoo violated the CRA as to all members of the California 

Users Subclass. Common evidence shows Yahoo knew about the 2014 Breach as it was 

happening and failed to notify compromised users for two years.25 The September 2016 notice 

details the data points that were stolen – including, notably, PII specifically covered under the 

CRA statute that was operative during and after the 2014 Breach. Ex. 10. This is the same 

evidence every California Users Subclass member would use in proving liability. 

(4) Plaintiffs’ UCL and CLRA Claims 

 Plaintiff Neff asserts a claim for omissions in the small business advertisements, and 

Plaintiff Mortensen asserts a CLRA claim based on Yahoo’s material omissions of fact regarding 

the true state of its security and the Breaches. Those Plaintiffs may seek to bring their claims on 

behalf of the Small Business Users Subclass and Paid Users Subclass,26 because their Subclass 

members’ reliance is established under an objective standard. 

 Though both the UCL and CLRA “require plaintiffs to prove members of the public are 

likely to be deceived by the defendant’s business practices,” Williams v. Gerber Prods. Co., 552 

F.3d 934, 938 (9th Cir. 2008), the burden of proof is modest. Friedman v. AARP, 855 F.3d 1047, 

1055 (9th Cir. 2017). It is subject only to an objective “reasonable consumer standard,” id., and 

does not implicate individual issues specific to each consumer. Lilly v. Jamba Juice Co., 308 

F.R.D. 231, 242 (N.D. Cal. 2014); see Kumar v. Salov N. Am. Corp., 2016 WL 3844334, at *7 

n.9 (N.D. Cal. 2016) (“Claims under the UCL . . . do not require[] individualized proof of 

reliance, deception, or causation.”); Ehret v. Uber Techs., Inc., 148 F. Supp. 3d 884, 901-02 

(N.D. Cal. 2015) (reliance for CLRA “can be determined relative to the class as a whole”). 

 “[A]n inference of common reliance arises if representations are material.” Lilly, 308 

F.R.D. at 242. The test for materiality is whether “‘a reasonable man would attach importance to 

its existence or nonexistence in determining his choice of action in the transaction.’” Mullins,

25 See, ECF No. 220, ¶8; Ex. 78 at p. 47; Ex. 11 at 923. 

26 Plaintiffs Neff and Mortensen seek to bring their respective claims on behalf of nationwide 

classes. Alternatively, Neff and Mortensen request the Court certify additional subclasses 

consisting of California users only, as defined in the Notice of Motion and Motion, and allow 

Neff and Mortensen to proceed as Class Representatives on behalf of those subclasses. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 38 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 26 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2016 WL 1535057, at *5. “As materiality is an objective inquiry, no individualized examination 

of materiality is necessary.” Lanovaz v. Twinings N. Am., Inc., 2014 WL 1652338, at *4 (N.D. 

Cal. Apr. 24, 2014). “As a general rule, materiality may be established by common proof.” 

Mullins, 2016 WL 1535057, at *5; see also Amgen Inc, 568 U.S. at 459 (“materiality of alleged 

misrepresentations and omissions is a question common to all members of the class”). 

 Plaintiffs are not required to “‘produce a consumer survey or similar extrinsic evidence to 

prevail on a claim that the public is likely to be misled by a representation.’” Mullins, 2016 WL 

1535057, at *5. However, the report of Plaintiffs’ expert Jim Van Dyke demonstrates that 

reasonable consumers place and extremely high value on security. Ex. 94 at ¶¶79, 92. Thus, 

Defendants’ omissions regarding the true state of their security were material and caused 

members of the Paid Users and Small Business Users Subclasses to pay more than they 

otherwise would have. “‘While a plaintiff must show that the misrepresentation was an 

immediate cause of the injury-producing conduct, the plaintiff need not demonstrate it was the 

only cause.’” Mullins, 2016 WL 1535057, at *5. 

 Last, the classwide exposure element of reliance under the UCL and CLRA is easily 

established here, where all Small Business Users Subclass members were exposed to 

Defendants’ omissions in the small business advertisements they were required to view when 

creating their accounts. Mullins, 2016 WL 1535057, at *2. Paid Users Subclass members’ 

exposure to Yahoo’s omissions can be inferred from the scope and force of the public outcry 

once Yahoo revealed the truth. Daniel v. Ford Motor Co., 806 F.3d 1217, 1226 (9th Cir. 2015).

b. Damages Can Be Established with Common Proof and 

Calculated with Common Methodologies 

 Plaintiffs’ and Damages Class members’ alleged losses are cognizable injuries in fact. 

ECF No. 132 at 22-28. Plaintiffs will use common proof to establish that Damages Class 

members suffered these injuries as a result of Defendants’ conduct and common methodologies 

to calculate the amount of those losses. Specifically, Plaintiffs will use expert testimony to 

establish that: (1) all members of the Small Business Users Subclass and Paid Users Subclass 

lost the benefit of their bargain and are entitled to restitution; (2) all members of the Damages 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 39 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 27 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Class suffered the lost value of their PII and an increased risk of future harm; (3) many members 

of the Damages Class suffered additional losses from identity theft; and (4) there is a logical and 

foreseeable causal connection between Defendants’ failures and these injuries. Any 

individualized issues going to causation are minimal in comparison to the common questions that 

stretch across the Damages Class. Further, that some or all of Damages Class members’ damages 

may ultimately require individual calculation, does not defeat class certification. Pulaski & 

Middleman, LLC v. Google, Inc., 802 F.3d 979, 988 (9th Cir. 2015), cert. denied, 136 S. Ct. 2410 

(2016) (“differences in damage calculations do not defeat class certification”). 

(1) Benefit of the Bargain and Restitution 

 Choice-based conjoint analysis has become a widely accepted tool for determining 

benefit of the bargain damages. See Fitzhenry-Russell v. Dr. Pepper Snapple Grp., Inc., 2018 

WL 3126385, at *17-*18 (N.D. Cal. June 26, 2018) (supporting predominance). Plaintiffs’ 

expert, Gary Parilis, proposes a conjoint analysis to determine the amount of money Damages 

Class members overpaid for Defendants’ services because of the concealed security 

inadequacies. That analysis involves the surveying of consumers to determine how much value 

they place on security when selecting an email service, and as Parilis demonstrates, that value 

can be isolated and calculated through mathematical analyses of the survey results. See Ex. 95. 

(2) Lost Value of PII 

 Plaintiffs may establish classwide causation for the lost value of Damages Class 

members’ PII by showing Defendants’ conduct meets California’s “substantial factor” test. See

Mitchell v. Gonzales, 54 Cal. 3d 1041, 1044 n.2, 1052 (1991) (negligence); In re San Jose 

Airport Hotel, LLC, 2018 WL 1426702, at *5 (N.D. Cal. Mar. 22, 2018) (contract). “The 

substantial factor standard . . . has been embraced as a clearer rule of causation – one which 

subsumes the ‘but for’ test while reaching beyond it to satisfactorily address other situations, 

such as those involving independent or concurrent causes in fact.” Rutherford v. Owens-Illinois, 

Inc., 16 Cal. 4th 953, 968-69 (1997). Under this standard, a cause in fact is something that is a 

substantial factor in bringing about the injury. Mitchell, 54 Cal. 3d at 1052-53; see also Britz 

Fertilizers, Inc. v. Bayer Corp., 665 F. Supp. 2d 1142, 1172 (E.D. Cal. 2009).

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 40 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 28 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 A defendant’s conduct “must be more than a remote or trivial factor.” Judicial Council Of 

California Civil Jury Instruction (“CACI”) 430 (2018). However, even “a very minor force that 

[] cause[s] harm is a substantial factor.” Bockrath v. Aldrich Chem. Co., 21 Cal. 4th 71, 79 

(1999). And, it “does not have to be the only cause of the harm.” CACI 430. A defendant’s 

conduct can be a substantial factor even where harm is caused by a third party. See Liberty 

Surplus Ins. Corp. v. Ledesma & Meyer Constr. Co., Inc., 5 Cal.5th 216, 418 P.3d 400, 404-05 

(Cal. 2018) (a company’s negligent hiring could be a substantial factor in sexual molestation by 

one of its employees). See also Restatement (Second) of Torts §448. 

 Plaintiffs will use the expert testimony of Mary Frantz and Jim Van Dyke, as well as the 

evidence gathered to date, to show that Defendants’ inadequate safeguarding of Plaintiffs’ PII 

was a substantial factor causing them to lose the value of their PII. Specifically, Plaintiffs will 

show that Defendants’ inadequate security compromised the entire UDB and was a substantial 

factor in causing the Breaches. See Ex. 93 at 4-9. Plaintiffs will also use the notices sent by 

Defendants, expert testimony, and common evidence to prove that their PII was exfiltrated 

during the Breaches. Next, Plaintiffs will use expert testimony to prove that the data stolen in the 

Breaches is different in breadth and value than that stolen in many other breaches. See Ex. 93 at 

6,9; Ex. 94 at ¶¶ 19-35. 

 Ex. 93 at 9; Ex. 94 at ¶¶19-

35. Thus, Damages Class members’ PII is inherently more valuable than singular data points.

 Plaintiffs will also show that Damages Class members’ PII was stolen by “unauthorized 

malicious actors” specifically seeking to use their PII to cause them harm. Ex. 93 at 9. Hackers 

deliberately targeted, and exfiltrated, the entire UDB, and they were able to and did harvest 

users’ PII for years before Damages Class members were notified. The length of delayed notice 

precluded Damages Class members from taking necessary remedial precautions in monitoring 

credit and bank accounts, exposing even more valuable PII to would-be thieves.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 41 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 29 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Plaintiffs propose two models to calculate the aggregate lost value of PII through the use 

of statistical sampling, an accepted method for determining aggregate damages on a classwide 

basis. See Villalpando v. Exel Direct Inc., 2016 WL 1598663, at *14 (N.D. Cal. Apr. 21, 2016) 

(“‘[R]epresentative testimony, surveys, and statistical analysis all are available as tools to render 

manageable determinations of the extent of liability.’”); see also In re Estate of Marcos Human 

Rights Litig., 910 F. Supp. 1460, 1464 (D. Haw. 1995) (“The use of aggregate procedures, with 

the help of an expert in the field of inferential statistics, for the purpose of determining class 

compensatory damages is proper.”), aff’d sub nom. Hilao v. Estate of Marcos, 103 F.3d 767 (9th 

Cir. 1996). Here, the methods of calculating damages are tied to Plaintiffs’ theory of liability and 

the representative evidence is “reliable and the inferences to be drawn . . . [are] just and 

reasonable in light of the facts of this case.” McLeod v. Bank of America, N.A., 2017 WL 

6373020, at *17 n.24 (N.D. Cal. Dec. 13, 2017); see also Tyson Foods, Inc. v. Bouaphakeo, 136 

S. Ct. 1036, 1047 (2016) (holding statistical evidence can be used to fill in evidentiary gaps 

created by defendants’ own misconduct). Statistical sampling techniques will allow Class 

members to protect their rights while freeing the Court of the specter of unmanageability. And 

while Plaintiffs, through their experts, have met their burden of demonstrating that statistical 

sampling is appropriate here, any perceived shortcoming does not defeat certification. See

Jimenez v. Allstate Ins. Co., 2012 WL 1366052, at *15 (C.D. Cal. Apr. 18, 2012) (“Jimenez I”).

 Plaintiffs’ identity theft expert, Jim Van Dyke, proposes to use statistical sampling to 

determine the PII in an average users’ account and the value of that PII in order to calculate 

aggregate damages. The methodology consists of surveying consumers as to the type of PII they 

have emailed and applying a pricing analysis for particular types of PII in order to determine an 

aggregate lost value for the Damages Class. See Ex. 94 at ¶¶67-77. Plaintiffs’ damages expert, 

Ian Ratner, proposes a market-based approach to determine Class members’ damages resulting 

from the diminution of value of their PII as a result of the Data Breaches. Under this approach, 

sources of market-based transactions are analyzed to value the PII based on comparable 

transactions involving similar, or in some cases, the same PII. As detailed by Ratner, through 

additional analysis of the Damages Class’ composition and value Verizon allocated to the Yahoo 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 42 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 30 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

user base, the market-based approach can be used to calculate Class-wide damages. See Ex. 96.

 Plaintiffs’ proposed models afford Defendants an adequate opportunity to litigate their 

affirmative defenses by attacking the representativeness and reliability of the statistical models, 

rather than through cross-examining individual Class members. Vaquero v. Ashley Furniture 

Indus., Inc., 824 F.3d 1150, 1150 (9th Cir. 2016).

(3) Identity Theft Losses 

 It is undisputed that data breaches can cause identity theft. See Stollenwerk v. Tri-West 

Health Care Alliance, 254 F. App’x 664, 668 (9th Cir. 2007) (“theft of a computer hard drive 

[containing PII] certainly can result in an attempt by a thief to access the contents for purposes 

of identity fraud”) (emphasis in original). This Court also has concluded that it is plausible a data 

breach is the casual factor in injuries related to identity theft. ECF No. 132 at 29-32; In re 

Anthem, Inc. Data Breach Litig., 2016 WL 3029783, at *16 (N.D. Cal. May 27, 2016); see also 

In re Zappos.com, Inc., 888 F.3d 1020, 1027 (9th Cir. 2018). 

 Plaintiffs can establish both a temporal and a logical connection between the Breaches 

and Damages Class members’ injuries. Temporally, the identity theft must follow the Breach in 

which a Damages Class members’ PII was taken. This point can be addressed through a basic 

claims process. Whether the common PII stolen was the same kind needed to commit the identity 

theft suffered by any Class member is “a matter of common knowledge from which a jury could 

reasonably draw inferences regarding its probative value in establishing causation.” Stollenwerk,

254 F. App’x at 667. Taken together with the facts that are common to all Damages Class 

members, discussed here and above, these data points go well beyond loose, merely temporal 

connections and establish a logical connection between the Breaches and Damages Class 

members’ harms. All Damages Class members’ PII was actually stolen by thieves who 

specifically targeted their PII, and who have sold and resold that PII on the dark web to other bad 

actors, who bought it for the explicit purpose of causing the harm Damages Class members 

suffered. In this context, and in the light of their significantly increased risk of future harm, 

Damages Class members’ purchases of credit mitigation services were the logical and 

foreseeable results of the Breaches, as were their losses suffered through identity theft. 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 43 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 31 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

This case differs markedly from other data breach class actions where the individualized 

nature of causation defeated predominance. Here, the PII taken was broader in scope, easier to 

obtain, use, and re-use (for years), and unchangeable – giving thieves the simplest, most effective 

way to commit fraud. As Plaintiffs’ two experts explain, there is a very close connection between 

the Breaches and Class Members’ identity theft. See Ex. 93 at 9; Ex. 94 at ¶¶ 38-48. Also, the 

length of time between the Breaches and their notice has eviscerated much, if not all, of the 

evidence Defendants will claim is needed to show individual causation for every Damages Class 

member. Thus, Plaintiffs offer the same causation proof that Damages Class members would 

need to offer. To the extent more is needed, it is Defendants’ burden to disprove causation, given 

that their negligence precludes Plaintiffs’ ability to offer additional proof. See Haft v. Lone Palm 

Hotel, 3 Cal. 3d 756, 774 n.19 (1970). Defendants cannot meet this burden as to any Damages 

Class member. It took Yahoo over three years to determine that PII from all users had been 

exfiltrated in the 2013 Breach, and Defendants claim to still be unable to determine how the 

exfiltration occurred. Notwithstanding, any attempt to disprove causation would not defeat 

predominance because such an affirmative defense would be a common question. 

Thus, the same evidence showing a causal connection between Defendants’ conduct, the 

Breaches, and Damages Class members’ lost value of PII also establishes Defendants’ conduct as 

a substantial factor causing Damages Class members’ other damages. While it is possible that a 

particular Damages Class member’s claim for losses stemming from identity theft will require 

more individual determination, these instances are likely to be isolated and few and, therefore, do 

not defeat predominance. See Smith, 2017 WL 1044692, at *13 (common issues of duty and 

breach in data breach case were “pivotal to the resolution of the litigation, and therefore 

predominate[d] despite individualized questions of causation and damages”). As with lost value 

of PII, statistical evidence can be used to determine the aggregate damages relating to identity 

theft by calculating the average user’s out of pocket costs and required hours for identity fraud 

resolution during the applicable risk period. Plaintiffs’ expert, Jim Van Dyke, demonstrates how 

data on costs and resolution for 2012 through 2016 can be obtained from industry leading Javelin 

Strategy & Research, and then used to compute averages for those data points. Ex. 94 at ¶50.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 44 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 32 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(4) Punitive Damages 

 Plaintiffs’ request for punitive damages under their negligence claim is appropriately 

determined on a classwide basis. Opperman v. Path, Inc., 2016 WL 3844326, at *16 (N.D. Cal. 

July 15, 2016) (“‘Because the purpose of punitive damages is not to compensate the victim, but 

to punish and deter the defendant, any claim for such damages hinges, not on facts unique to 

each class member, but on the defendant’s conduct toward the class as a whole.’”). 

2. A Class Action Is Superior to Millions of Expensive Trials

 Certification of Plaintiffs’ contract, negligence, and CLRA claims would be “superior to 

other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 

23(b)(3). Indeed, this is the kind of case for which the class action procedure was created. First, 

any Class member’s individual recovery, even in cases of actual identity fraud, would be 

dwarfed by the cost of proving the predominating issues in this litigation. Soares v. Flowers 

Foods, Inc., 320 F.R.D. 464, 485 (N.D. Cal. 2017) (Rule 23(b)(3)(A) “only weighs against class 

certification where individual damages ‘run high’ such that individual class members have a 

strong interest ‘in making individual decisions on whether and when to settle’”). Second, 

because only one other case is currently pending in the United States, Rule 23(b)(3)(B) does not 

weigh against certification. Zinser v. Accufix Research Institute, Inc., 253 F.3d 1180, 1191 (9th 

Cir. 2001). Third, the TOS dictate all litigation must be in this forum or in California. 

 Fourth, the issues presented in this class litigation are manageable. See Fed. R. Civ. P. 

23(b)(3)(D). Though individualized determinations of causation and damages may be necessary 

in some limited circumstances, the class action device still presents far fewer management 

difficulties than individually litigating the claims of millions of users. Smith, 2017 WL 1044692, 

at *14 (“burden of corralling . . . run of mini-trials [on causation and damages linked to data 

theft] shrinks in comparison to the burden of conducting a full-blown trial on every issue 

contained in every cause of action, for every class member”). A class action provides the benefits 

of single adjudication, economies of scale, and comprehensive supervision by a single court. 

Individualized litigation would create a potential for inconsistent or contradictory judgments on 

the issues Plaintiffs seek to certify here (including, most notably, whether Defendants’ internal 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 45 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 33 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

policies and security protocols were adequate to safeguard its users’ PII), and would increase the 

delay and expense to all parties and the court system. 

 “Courts retain discretion to shape the proceedings and could ultimately choose an option 

such as the use of individual claim forms or the appointment of a special master, which plainly 

would allow [d]efendants to raise any defenses they may have to individual claims.” Jimenez v. 

Allstate Ins. Co., 765 F.3d 1161, 1168-69 (9th Cir. 2014) (“Jimenez II”) (finding “statistical 

analysis [was] capable of leading to a fair determination of [defendant’s] liability” and 

individualized damages hearings “preserved the rights of [defendant] to present its damages 

defenses on an individual basis”). Here, damages can be calculated through a simple claims 

process whereby Class members submit receipts for identity theft related losses and testify as to 

the PII stolen from their accounts. See Just Film, 847 F.3d at 1120-21. Even so, the common 

liability questions are sufficient to support class certification. Tyson Foods, 136 S. Ct. at 1045.

 Notice should not be cumbersome. Each Damages Class member can be contacted 

directly by email using Defendants’ records (in the same way notification of the Breaches was 

eventually sent), or by publication for Damages Class members who no longer have their 

accounts. Further, because the Breaches have been highly publicized around the world (they are 

still the largest Breaches in history), a public notice in the U.S. and Israel would be effective. 

Last, because Damages Class members can easily be verified using data maintained by 

Defendants – who have already identified compromised user accounts and sent notices to the 

Damages Class members who own them – the claims process will be straightforward. Id. Thus, 

while ascertainability is not a requirement in the Ninth Circuit, Briseno v. ConAgra Foods, Inc.,

844 F.3d 1121, 1133 (9th Cir. 2017), cert. denied, 138 S. Ct. 313 (2017), the manageability 

problems that often plague certification do not exist here.

E. Certification of Issues Under Rule 23(c)(4) Is Also Appropriate 

 Should the Court determine the individualized issues of causation or damages for certain 

of Class members’ injuries overwhelms common questions, Plaintiffs request that the Court 

certify the issues listed in its Notice of Motion and Motion.

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 46 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 34 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. The Court Has Broad Discretion to Certify Issues 

 “When appropriate,” Rule 23(c)(4) allows a court great discretion to certify an action “as 

a class action with respect to particular issues.” Fed. R. Civ. P. 23(c)(4). It does not prescribe 

elements that representatives must show in order to maintain an issue class, but courts recognize 

its value in resolving cases where, though common questions may not predominate, denying 

certification of common issues would all but strip class members of their right to seek relief. 

 The Ninth Circuit has endorsed the use of issue certification. Valentino, 97 F.3d at 1234. 

So have many other circuit courts. See In re Deepwater Horizon, 739 F.3d 790, 817 (5th Cir. 

2014); Butler v. Sears, Roebuck & Co., 727 F.3d 796, 800 (7th Cir. 2013); In re Whirlpool Corp. 

Front-Loading Washer Prods. Liab. Litig., 722 F.3d 838, 860 (6th Cir. 2013); see also Jimenez 

II, 765 F.3d at 1168 (noting Butler, Whirlpool, and Deepwater Horizon “are compelling . . . 

[a]nd their reasoning is consistent with our circuit precedent”). 

 As explained above, basic liability questions predominate for Plaintiffs’ contract, 

negligence, consumer, and CRA claims. However, if the Court determines that Damages Class 

members’ lost value of PII or losses from identity theft require a more specific showing of 

causation, and defeat predominance, it may still allow Plaintiffs to proceed under Rule 23(c)(4). 

Tasion Commc’ns, Inc. v. Ubiquiti Networks, Inc., 308 F.R.D. 630, 633 (N.D. Cal. 2015) (Rule 

23(c)(4) issues class “must still meet the requirements of Rule 23(a) and (b) (except for the 

predominance requirement of Rule 23(b)(3))”). The Court may certify issues under Rule 23(c)(4) 

if it materially advances the litigation as a whole, with the focus being “‘judicial economy and 

efficiency.’” Kamakahi v. Am. Soc’y for Reprod. Med., 305 F.R.D. 164, 193 (N.D. Cal. 2015). 

Importantly, the analysis focuses only on the issues to be certified. See Deane v. Fastenal Co.,

2012 WL 12552238, at *7 (N.D. Cal. Sept. 26, 2012). 

 Here, the issues Plaintiffs propose to certify are key elements of their contract and 

negligence claims – claims that can be brought by all U.S. and Israeli users under a single state’s 

law. They are costly and complicated issues to litigate, and the answers to the questions posed by 

those issues will be the same for every Class member. If the answer to one or more of the 

questions is “No,” then the litigation ends. If the answers are “Yes,” then all remaining issues are 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 47 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 35 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

capable of adjudication through a streamlined process that is far superior to requiring users to 

independently establish what Defendants did (or did not) do to safeguard their PII and what 

Defendants knew and when. Thus, their answers would help to efficiently resolve the litigation. 

2. Issue Certification Will Significantly Advance Resolution 

 Plaintiffs acknowledge that this Court has recently denied several requests for Rule 23 

(c)(4) issue certification.27 This case differs significantly. In those cases, plaintiffs provided no 

rationale for how the individualized issues that defeated predominance would otherwise be 

resolved, once the certified issues had been decided, and in several instances more than one issue 

remained to be addressed (i.e., reliance and a workable damages methodology). Plaintiffs here 

provide expert testimony showing how benefit of the bargain damages can be calculated and two 

viable methods for determining lost value of PII, once liability is determined. 

 But, even if the Court ultimately finds fault with Plaintiffs’ models on an aggregate level, 

expert testimony demonstrates that users’ damages for lost value of their PII and identity theft 

losses costs can still be calculated individually, which “at this time is sufficient to allow the 

Court to conclude that resolution of the common issues would materially advance this case’s 

disposition as a whole.” Loritz v. Exide Techs., Inc., 2015 WL 6790247, at *24 (N.D. Cal. July 

21, 2015). Plaintiffs’ expert’s declarations show that individual pieces of PII, including the 

common PII taken from all Damages Class members, have value. Ex. 94 at ¶¶67-77; Ex. 96 at 

¶¶17-33. Thus a claims process can be used to calculate lost value of non-common PII, as well as 

identity theft losses. The only substantive issue to be resolved after the certified issues are 

answered would be causation, and more specifically, whether the PII necessary to cause a user’s 

injuries may have come from a source other than the Breaches. 

IV. CONCLUSION 

For the foregoing reasons, Plaintiffs respectfully request that the Court grant Plaintiffs’ 

Motion for Class Certification.

27 See Davidson, 2018 WL 2325426, at *26; Huu Nguyen v. Nissan N. Am., Inc., 2018 WL 

1831857, at *8 (N.D. Cal. Apr. 9, 2018); Backhaut v. Apple Inc., 2015 U.S. Dist. LEXIS 107519, 

at *9-*11 n.3 (N.D. Cal. Aug. 13, 2015); Werdebaugh v. Blue Diamond Growers, 2014 U.S. 

Dist. LEXIS 173789, at *49 n.9 (N.D. Cal. Dec. 15, 2014). 

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 48 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 36 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DATED: July 13, 2018 MORGAN & MORGAN 

COMPLEX LITIGATION GROUP

John A. Yanchunis 

s/John A. Yanchunis

 John A. Yanchunis 

201 N. Franklin Street, 7th Floor 

Tampa, FL 33602 

Telephone: 813/223-5505 

813/223-5402 (fax) 

ROBBINS GELLER RUDMAN 

 & DOWD LLP 

Stuart A. Davidson 

s/Stuart A. Davidson 

 Stuart A. Davidson

120 East Palmetto Park Road, Suite 500 

Boca Raton, FL 33432 

Telephone: 561/750-3000 

561/750-3364 (fax) 

CASEY GERRY SCHENK FRANCAVILLA 

 BLATT & PENFIELD LLP 

Gayle M. Blatt 

110 Laurel Street 

San Diego, CA 92101 

Telephone: 619/238-1811 

619/544-9232 (fax) 

MILBERG TADLER PHILLIPS

GROSSMAN LLP 

Ariana J. Tadler 

One Pennsylvania Plaza, 19th Floor 

New York, NY 10119 

Telephone: 212/594-5300 

212/868-1229 (fax) 

LOCKRIDGE GRINDAL NAUEN P.L.L.P.

Karen Hanson Riebel 

100 Washington Ave. South, Suite 2200 

Minneapolis, MN 55401 

Telephone: 612/339-6900 

612/339-0981 (fax) 

Attorneys for Plaintiffs and Proposed Class 

Counsel

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 49 of 50
MEMO ISO PLTFS’ MOTION FOR CLASS CERTIFICATION - 16-md-02752-LHK - 37 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CERTIFICATE OF SERVICE 

I hereby certify under penalty of perjury that on July 13, 2018, I authorized the electronic 

filing of the foregoing with the Clerk of the Court using the CM/ECF system which will send 

notification of such filing to all ECF participants. 

s/Stuart A. Davidson

 STUART A. DAVIDSON 

ROBBINS GELLER RUDMAN 

 & DOWD LLP 

120 East Palmetto Park Road, Suite 500 

Boca Raton, FL 33432 

Telephone: 561/750-3000 

561/750-3364 (fax) 

E-mail: sdavidson@rgrdlaw.com

Case 5:16-md-02752-LHK Document 246 Filed 07/13/18 Page 50 of 50