1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

Michael F. Ram, SBN #104805

mram@rocklawcal.com

Matt Malone, SBN #221545

mjm@rocklawcal.com

Susan Brown, SBN #287986

RAM, OLSON, CEREGHINO

& KOPCZYNSKI LLP

101 Montgomery Street, Suite 1800

San Francisco, California 94104

Telephone: (415) 433-4949

Facsimile: (415) 433-7311

[Additional Counsel Listed On Signature Page]

Attorneys for Plaintiff and Proposed Classes

UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF CALIFORNIA 

IN RE: YAHOO! INC. CUSTOMER DATA 

SECURITY BREACH LITIGATION

______________________________________/ 

EDWARD MCMAHON, MICHELLE GRECO, 

AND JONATHAN LEVY, individually and on 

behalf of all others similarly situated,

 Plaintiff, 

v.

YAHOO! INC.

 Defendant.

N.D. CA Case No.: 5:16-cv-05466-LHK

Case No. 16-MD-02752-LHK

FIRST AMENDED CLASS ACTION 

COMPLAINT FOR:

1) Breach of Implied Contract

2) Violation of the California Unfair 

Competition Law, Business &

Professions Code § 17200, et seq.

3) Negligence

JURY TRIAL DEMAND

Plaintiffs Edward McMahon, Michelle Greco and Jonathan Levy bring this Class 

Action Complaint against Yahoo! Inc., (“Yahoo” or “Defendant”) on behalf of themselves and 

all others similarly situated, and allege, upon personal knowledge as to their own actions and 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 1 of 28
2

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

their counsel’s investigations, and upon information and belief as to all other matters, as 

follows:

NATURE OF THE ACTION

1. Plaintiffs bring this class action against Yahoo for its failure to secure and 

safeguard its users’ personally identifiable information (“PII”) such as users’ names, email 

addresses, telephone numbers, dates of birth, passwords and, in some cases, security questions

and answers, which Yahoo collected from its users (collectively, “Private Information”), and 

for failing to provide timely, accurate, and adequate notice to Plaintiffs and other Class 

members that their Private Information had been stolen and failing to provide timely, accurate 

and adequate notice of precisely what types of information were stolen. When users establish 

accounts at Yahoo, Yahoo electronically collects and stores this information, making it a 

treasure trove of useful information attractive to hackers who can use the information to profit 

and cause damage, as was done here, to consumers. 

2. This class action involves two separate data breaches, each believed to be the 

largest in history.

3. Beginning in late 2014, hackers stole copies of 500 million Yahoo users’ Private 

Information (the “2014 Data Breach”). While copied, Plaintiff’s and other users’ information 

remains in the possession of Yahoo. 

4. On September 22, 2016, Yahoo announced it sustained the 2014 Data Breach. 

5. On September 22, 2016, Yahoo confirmed that a copy of certain user account 

information was stolen from its systems in late 2014 by what it believes was a state-sponsored 

actor. Yahoo conceded that pilfered Private Information included users’ names, email 

addresses, telephone numbers, dates of birth, passwords and, in some cases, security questions 

and answers. Yahoo likewise stated that the stolen information did not include payment card 

data, or bank account information; as payment card data and bank account information were 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 2 of 28
3

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

not stored in the system that its investigation had found to be affected. Yahoo further believes 

that the hacker is not currently in Yahoo’s network.

6. On September 22, 2016, Yahoo gave notice to users whose Private Information 

was compromised. 

7. On December 14, 2016, nearly three months after this litigation commenced, 

Yahoo disclosed that a second, unrelated, and larger data breach had been discovered (the 2013

Data Breach). Yahoo reported that this second data breach occurred in August of 2013, but was 

not discovered until November of 2016, when law enforcement brought it to Yahoo’s attention.

8. Yahoo further reported that the 2013 Data Breach may have included names, 

email addresses, telephone numbers, dates of birth, “hashed” passwords, and encrypted or 

unencrypted security questions. 

9. On December 4, 2016, Yahoo gave notice of the 2013 Data Breach to users 

whose Private Information was compromised. At that time, Yahoo had not identified the 

source of the intrusion into users’ accounts.

10. At this early stage, it is unknown to Plaintiffs whether Yahoo’s description of 

the breadth of either of the Data Breaches is accurate. However, given that two years passed 

before Yahoo discovered the 2014 Data Breach and more than three years passed before law 

enforcement alerted Yahoo to the 2013 Data Breach, Plaintiffs are rightfully skeptical of 

Yahoo’s self-serving statements. 

11. Yahoo disregarded Plaintiffs’ and Class members’ rights by intentionally, 

willfully, recklessly, or negligently failing to take adequate and reasonable measures to ensure 

that its data systems were protected, failing to take available steps to prevent and stop the 

breach from ever happening, and failing to disclose to its users the material facts that it did not 

have adequate computer systems and security practices to safeguard users’ Private Information. 

Plaintiffs are informed and believe that Plaintiffs’ and Class members’ Private Information was 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 3 of 28
4

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

improperly handled and stored, was unencrypted or inadequately encrypted, and was not kept 

in accordance with applicable, required, and appropriate cyber-security protocols, policies, and 

procedures. As a result, Plaintiffs’ and Class members’ Private Information was compromised 

and stolen. However, as this same information remains stored in Yahoo’s computer systems, 

Plaintiffs and class members have an interest in ensuring that their information is safe, and they 

should be entitled to seek injunctive and other equitable relief, including independent oversight 

of Yahoo’s security systems.

PARTIES

12. Plaintiff Edward McMahon is an individual and resident of New York. Plaintiff 

has maintained a Yahoo email account since about 2012. Since 2014, Plaintiff has detected 

unusual activity on his Yahoo email accounts, such as losing access to some of his 

accounts. He is informed and believes that his account was breached as he has been locked out 

and is unable to access his account. He has very important and sensitive information in his 

emails that he is informed and believes have been accessed. He is informed and believes that 

the hackers have changed his password, which is why he cannot access his account.

13. Plaintiff Jonathan Levy does business as Brimstone & Company, Attorneys and 

Solicitors in Washington DC. He and his associated colleagues work on a variety of legal 

matters with an international focus, including company law, securities, international law and 

human rights. These include highly confidential matters involving human rights claims, 

criminal defense, and asset protection as well as trade secrets and confidential information 

regarding public companies. Plaintiff Levy has paid fees to Yahoo for, and used, Yahoo! Small 

Business (recently renamed Yahoo! Aabaco Small Business) for web hosting and email since 

2009. 

14. Plaintiff Levy’s accounts, and all Yahoo! Aabaco Small Business accounts, are 

in reality Yahoo accounts and are function no differently from other Yahoo accounts except 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 4 of 28
5

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

that they bear the legend “Yahoo! Small Business” on the email interface.

15. Mr. Levy received notice from Yahoo of the two Data Breaches in September 

and December of 2016. As a result, he must now conduct a forensic analysis involving 

hundreds of labor hours to determine the extent of the breaches’ effects. To date, he has 

uncovered missing data and will need to take remedial client measures up to and including 

personally advising clients of the Data Breaches’ potential consequences, particularly 

considering the Yahoo’s statement that a state actor was behind at least one, and possibly both, 

of the Data Breaches.

16. Plaintiff Michelle Greco, is an individual and resident of the State of new Jersey. 

Plaintiff Greco has maintained a Yahoo email account since about 2001. On or about 

December 14, 2016, Yahoo notified Plaintiff Greco that her information had been stolen from 

Yahoo in or about August 2013. As a result of the breach, and the increased risk of identity 

theft caused by the breach, Plaintiff Greco enrolled in identity theft protection services at a cost 

of approximately 109.89 annually. 

17. Yahoo! Inc. is a Delaware corporation with its principle place of business in 

Sunnyvale, California. Yahoo is a technology company, primarily deriving its revenues by 

connecting advertisers with target audiences through streamlined advertising technology. It is a 

guide to digital information discovery, focused on informing, connecting, and entertaining its

users through its search, communications, and digital content products. It creates value for 

advertisers with a streamlined, simple advertising technology stack that leverages Yahoo’s 

data, content, and technology to connect advertisers with their target audiences. Advertisers can 

build their businesses through advertisements targeted to audiences on Yahoo’s online 

properties and services (“Yahoo Properties”) and a distribution network of third-party entities 

(“Affiliates”) who integrate Yahoo’s advertising offerings into their websites or other offerings 

(“Affiliate sites”). Yahoo’s revenue is generated principally from display and search 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 5 of 28
6

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

advertising.

JURISDICTION AND VENUE

18. This Court has jurisdiction over this action under the Class Action Fairness Act, 

28 U.S.C. § 1332(d). The aggregated claims of the individual class members exceed 

$5,000,000.00, exclusive of interest and costs, and this is a class action in which more than 

two-thirds of the proposed plaintiff class, on the one hand, and Yahoo, on the other, are citizens 

of different states.

19. This Court has jurisdiction over Yahoo as it maintains its corporate headquarters 

in this District and for the following reasons: Yahoo makes decisions regarding overall 

corporate governance and management, including the security measures to protect its users’ 

Private Information, in this District; it is authorized to conduct business throughout the United 

States, including California; and it advertises in a variety of media throughout the United 

States, including California. Via its business operations throughout the United States, Yahoo

intentionally avails itself of the markets within this state to render the exercise of jurisdiction 

by this Court just and proper. 

20. Venue is proper in this District pursuant to 28 U.S.C. § 1391(a)(1) because a 

substantial part of the events and omissions giving rise to this action occurred in this District 

and because Yahoo is headquartered in this District.

FACTUAL BACKGROUND

A. Yahoo and Its Private Information Collection Practices

21. Yahoo’s primary driver of engagement across its user offerings is its email 

service, Yahoo Mail. See Yahoo Inc., Form 10-K for 2015 at 6. Yahoo also offers a messaging 

service, Yahoo Messenger, as well as news, financial reporting, and sports content, and a 

microblogging and social networking website, Tumblr. Id. at 6–7. To utilize these offerings,

users must setup user account(s), which requires users to provide Yahoo with Private 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 6 of 28
7

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

Information. 

22. When setting up their accounts, users are required to agree to Additional Terms 

of Service (“ATOS”) that state:

“the substantive law of the State of California governs the interpretation of this ATOS 

and applies to all claims related to it, regardless of conflict of laws principles. You and 

Yahoo! Inc. irrevocably consent to the exclusive jurisdiction and venue of the state 

courts located in Santa Clara County, California or in the Federal Courts located in the 

Northern District of California, USA for all disputes arising out of or relating to this 

ATOS or arising out of or relating to the relationship between you and Yahoo regardless 

of the type of claim.”1

B. Consumers Rely On Yahoo’s Private Information Security Practices

23. Yahoo maintains a privacy policy available on its website (“Privacy Policy”). It 

provides, among other things, that Yahoo is “committed to ensuring your information is 

protected and [it] applies safeguards in accordance with applicable law.”2The Privacy Policy 

further provides:

Yahoo collects personal information3 when you register with Yahoo, 

when you use Yahoo products or services, when you visit Yahoo pages or 

the pages of certain Yahoo partners, and when you enter promotions or 

sweepstakes. Yahoo may combine information about you that we have 

with information we obtain from business partners or other companies.

When you register we ask for information such as your name, email 

address, birth date, gender, ZIP code, occupation, industry, and 

personal interests. For some financial products and services we might 

also ask for your address, Social Security number, and information 

about your assets. When you register with Yahoo and sign in to our 

services, you are not anonymous to us.

Yahoo collects information about your transactions with us and with some 

of our business partners, including information about your use of financial 

 

1

See Yahoo!, Additional Terms of Service, https://policies.yahoo.com/xw/en/yahoo/terms/productatos/comms/index.htm (last visited December 15, 2016).

2

See Yahoo!, Yahoo Privacy Center, https://policies.yahoo.com/us/en/yahoo/privacy/index.htm (Aug. 30, 2016) 

(last visited December 14, 2016). 

3

“Personal information is information about you that is personally identifiable like your name, address, email 

address, or phone number, and that is not otherwise publicly available.” Id. 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 7 of 28
8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

products and services that we offer.

Yahoo analyzes and stores all communications content, including 

email content from incoming and outgoing email.

Yahoo automatically receives and records information from your 

computer and browser, including your IP address, Yahoo cookie 

information, software and hardware attributes, and the page you 

request.

Yahoo uses information for the following general purposes: to customize 

the advertising and content you see, fulfill your requests for products and 

services, improve our services, contact you, conduct research, and provide 

anonymous reporting for internal and external clients.

.... 

Yahoo does not rent, sell, or share personal information about you 

with other people or non-affiliated companies except to provide 

products or services you've requested, when we have your permission, 

or under the following circumstances:

 We provide the information to trusted partners who work on 

behalf of or with Yahoo under confidentiality agreements. 

These companies may use your personal information to help 

Yahoo communicate with you about offers from Yahoo and 

our marketing partners. However, these companies do not have 

any independent right to share this information.

 We have a parent's permission to share the information if the 

user is a child under age 13. See Children's Privacy & Family 

Accounts for more information about our privacy practices for 

children under 13.

 We respond to subpoenas, court orders, or legal process (such 

as law enforcement requests), or to establish or exercise our 

legal rights or defend against legal claims.

 We believe it is necessary to share information in order to 

investigate, prevent, or take action regarding illegal activities, 

suspected fraud, situations involving potential threats to the

physical safety of any person, violations of Yahoo's terms of 

use, or as otherwise required by law.

 We transfer information about you if Yahoo is acquired by or 

merged with another company. In this event, Yahoo will notify 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 8 of 28
9

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

you before information about you is transferred and becomes 

subject to a different privacy policy.

Yahoo displays targeted advertisements based on personal 

information. Advertisers (including ad serving companies) may assume 

that people who interact with, view, or click targeted ads meet the 

targeting criteria—for example, women ages 18-24 from a particular 

geographic area.

 Yahoo does not provide any personal information to the 

advertiser when you interact with or view a targeted ad. 

However, by interacting with or viewing an ad you are 

consenting to the possibility that the advertiser will make the 

assumption that you meet the targeting criteria used to display 

the ad.

 Yahoo advertisers include financial service providers (such as 

banks, insurance agents, stock brokers and mortgage lenders) 

and non-financial companies (such as stores, airlines, and 

software companies).

Yahoo works with vendors, partners, advertisers, and other service 

providers in different industries and categories of business. 

... 

We limit access to personal information about you to employees who 

we believe reasonably need to come into contact with that information 

to provide products or services to you or in order to do their jobs.

We have physical, electronic, and procedural safeguards that comply 

with federal regulations to protect personal information about you.

24. Thus, Yahoo collects and stores massive amounts of PII on its servers and 

utilizes this information to maximize its profits.

25. Consumers place value in data privacy and security, and they consider it when 

making decisions regarding their online behavior, including their choice of email provider. 

Plaintiffs would not have become Yahoo user had they known that Yahoo does not take all 

necessary precautions to secure the personal data given to it by consumers.

26. Yahoo failed to disclose its negligent and insufficient data security practices and 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 9 of 28
10

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

consumers relied on or were misled by this omission into using Yahoo.

27. Yahoo is no stranger to threats against its users’ Private Information. In addition 

to the two Data Breaches at issue in this litigation, in 2012, over 400,000 unencrypted Yahoo

usernames and passwords were stolen and posted on a public website.4 In 2013 Yahoo Japan 

was compromised, exposing 22 million Yahoo Japan email addresses.5 

28. Likewise the technology industry is rife with similar examples of hackers 

targeting users’ PII, including the hacks at Adobe,6LinkedIn, eHarmony,7and Snapchat,8

among many others, all of which pre-date the timeframe Yahoo has identified regarding the 

2014 Data Breach (late 2014), and some of which pre-date the 2013 Data Breach.

C. Stolen Private Information Is Valuable to Hackers and Thieves 

29. It is well known and the subject of many media reports that PII data is highly 

coveted and a frequent target of hackers. PII data is often easily taken because it may be less 

protected and regulated than payment card data. Especially in the technology industry, the issue 

of data security, and threats thereto, is well known, as noted above. Several other online 

companies have experienced data breaches resulting in the disclosure of users’ PII, and as 

identified earlier, a large number of technology companies were the targets of data breaches. 

Despite well-publicized litigation and frequent public announcements of data breaches by 

retailers and technology companies, Yahoo opted to maintain an insufficient and inadequate 

 

4

See, e.g., Charles Arthur, Yahoo Voice Hack Leaks 450,000 Passwords, THE GUARDIAN (July 12, 2012), 

available at https://www.theguardian.com/technology/2012/jul/12/yahoo-voice-hack-attack-passwords-stolen; 

Chenda Ngak, Yahoo Confirms Email Hack In Statement, CBS NEWS (July 12, 2012), available at 

http://www.cbsnews.com/news/yahoo-confirms-email-hack-in-statement/.

5 Graham Cluley, 22 Million User Ids May Be In The Hands Of Hackers, After Yahoo Japan Security Breach, 

NAKED SECURITY (May 20, 2013), available at https://nakedsecurity.sophos.com/2013/05/20/yahoo-japan-hack/; 

BBC Technology, Millions Hit By Yahoo Japan Hack Attack, BBC (May 20, 2013), available at

http://www.bbc.com/news/technology-22594136. 

6

See In re Adobe Sys., Inc. Privacy Litig., 66 F. Supp. 3d 1197 (N.D. Cal. 2014). 

7 CBS News Staff, eHarmony Suffers Password Breach on Heels of LinkedIn, CBS News (June 7, 2012), 

available at http://www.cbsnews.com/news/eharmony-suffers-password-breach-on-heels-of-linkedin/. 

8 Nancy Blair & Brett Molina, Snapchat, Skype Have Security Breach, USA Today (Jan. 2, 2014), available at 

http://www.usatoday.com/story/tech/2014/01/01/snapchat-user-names-leak/4277789/. 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 10 of 28
11

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

system to protect the PII of Plaintiffs and class members.

30. Legitimate organizations and the criminal underground alike recognize the value 

of PII. Otherwise, they wouldn’t aggressively seek or pay for it. For example, in “one of 2013’s 

largest breaches . . . not only did hackers compromise the [card holder data] of three million 

users, they also took registration data from 38 million users.”9Similarly, in the Target data 

breach, in addition to PCI data pertaining to 40,000 credit and debit cards, hackers stole PII 

pertaining to 70,000 users. 

31. Biographical data is also highly sought after by data thieves. “Increasingly, 

criminals are using biographical data gained from multiple sources to perpetrate more and 

larger thefts.” Id. PII data has been stolen and sold by the criminal underground on many 

occasions in the past, and the accounts of theft and unauthorized access have been the subject 

of many media reports. One form of identity theft, branded “synthetic identity theft,” occurs 

when thieves create new identities by combining real and fake identifying information and then 

use those identities to open new accounts. “This is where they’ll take your Social Security 

number, my name and address, someone else's birthday and they will combine them into the 

equivalent of a bionic person," said Adam Levin, Chairman of IDT911, which helps businesses 

recover from identity theft. Synthetic identity theft is harder to unravel than traditional identity 

theft, experts said: “It’s tougher than even the toughest identity theft cases to deal with because 

they can't necessarily peg it to any one person.” In fact, the fraud might not be discovered until 

an account goes to collections and a collection agency researches the Social Security number.

32. Unfortunately, and as is alleged below, despite all of this publicly available 

knowledge of the continued compromises of PII in the hands of third parties, such as 

technology companies, Yahoo’s approach at maintaining the privacy of Plaintiffs’ and Class 

 

9 Verizon 2014 PCI Compliance Report, available at <http://www.nocash.info.ro/wp-content/uploads/2014/02/ 

Verizon_pci-report-2014.pdf> (hereafter “2014 Verizon Report”), at 54 (last visited Sept. 24, 2014).

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 11 of 28
12

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

members’ PII was lackadaisical, cavalier, reckless, or at the very least, negligent.

D. The Data Breaches Will Result In Additional Identity Theft and Identify Fraud

33. Yahoo failed to implement and maintain reasonable security procedures and 

practices appropriate to the nature and scope of the Private Information compromised in both 

Data Breaches.

34. The ramifications of Yahoo’s failure to keep Plaintiffs’ and Class members’ data 

secure are severe.

35. The information Yahoo compromised, including Plaintiffs’ identifying 

information is “as good as gold” to identity thieves, in the words of the Federal Trade

Commission (“FTC”).10 Identity theft occurs when someone uses another’s personal identifying 

information, such as that person’s name, address, credit card number, credit card expiration 

date, and other information, without permission, to commit fraud or other crimes. The FTC 

estimates that as many as 10 million Americans have their identities stolen each year.

36. As the FTC recognizes, once identity thieves have personal information, “they 

can drain your bank account [as occurred to Plaintiff here], run up your credit cards, open new 

utility accounts, or get medical treatment on your health insurance.”11

37. According to Javelin Strategy and Research, “1 in 4 notification recipients 

became a victim of identity fraud.”12 Nearly half (46%) of consumers with a breached debit 

card became fraud victims within the same year. 

38. Identity thieves can use personal information such as that of Plaintiffs and Class 

 

10 FTC Interactive Toolkit, Fighting Back Against Identity Theft, available at

http://www.dcsheriff.net/community/documents/id-theft-tool-kit.pdf (last visited Sept. 24, 2014).

11 FTC, Signs of Identity Theft, available at <http://www.consumer.ftc.gov/articles/ 0271-signs-identity-theft> 

(last visited Sept. 24, 2014).

12 See 2013 Identity Fraud Report: Data Breaches Becoming a Treasure Trove for Fraudsters, available at 

<www.javelinstrategy.com/brochure/ 276> (last visited Sept. 24, 2014) (the “2013 Identity Fraud Report”).

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 12 of 28
13

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

members, which Yahoo failed to keep secure, to perpetrate a variety of crimes that harm 

victims. For instance, identity thieves may commit various types of government fraud such as: 

immigration fraud; obtaining a driver’s license or identification card in the victim’s name but 

with another’s picture; using the victim’s information to obtain government benefits; or filing a 

fraudulent tax return using the victim’s information to obtain a fraudulent refund. Some of this 

activity may not come to light for years. The IRS paid out $43.6 billion in potentially 

fraudulent returns in 2012, and the IRS identified more than 2.9 million incidents of identity 

theft in 2013. The IRS described identity theft as the number one tax scam for 2014. 

39. Among other forms of fraud, identity thieves may get medical services using 

consumers’ compromised personal information or commit any number of other frauds, such as 

obtaining a job, procuring housing, or even giving false information to police during an arrest.

40. It is incorrect to assume that reimbursing a consumer for a financial loss due to 

fraud makes that individual whole again. On the contrary, after conducting a study, the 

Department of Justice’s Bureau of Justice Statistics (“BJS”) found that “among victims who 

had personal information used for fraudulent purposes, 29% spent a month or more resolving 

problems.”13 In fact, the BJS reported, “resolving the problems caused by identity theft [could] 

take more than a year for some victims.” Id. at 11.

E. Annual monetary losses from identity theft are in the billions of dollars. 

41. Javelin Strategy and Research reports that those losses increased to $21 billion 

in 2013.14

42. There may be a time lag between when harm occurs and when it is discovered, 

and also between when PII is stolen and when it is used. According to the U.S. Government 

Accountability Office (“GAO”), which conducted a study regarding data breaches:

 

13 Victims of Identity Theft, 2012 (Dec. 2013) at 10, available at http://www.bjs.gov/content/pub/pdf/vit12. pdf 

(last visited Sept. 24, 2014).

14 See 2013 Identity Fraud Report.

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 13 of 28
14

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

[L]aw enforcement officials told us that in some cases, stolen data may be held 

for up to a year or more before being used to commit identity theft. Further, 

once stolen data have been sold or posted on the Web, fraudulent use of that 

information may continue for years. As a result, studies that attempt to measure 

the harm resulting from data breaches cannot necessarily rule out all future 

harm.15

43. Plaintiffs and Class members now face years of constant surveillance of their 

financial and personal records, monitoring, and loss of rights. The Class is incurring and will 

continue to incur such damages in addition to any fraudulent credit and debit card charges 

incurred by them and the resulting loss of use of their credit and access to funds, whether or not 

such charges are ultimately reimbursed by the credit card companies. 

F. Plaintiffs and Class Members Suffered Damages

44. The Data Breaches were a direct and proximate result of Yahoo’s failure to 

properly safeguard and protect Plaintiffs’ and Class members’ Private Information from 

unauthorized access, use, and disclosure, as required by various state and federal regulations, 

industry practices, and the common law, including Yahoo’s failure to establish and implement 

appropriate administrative, technical, and physical safeguards to ensure the security and 

confidentiality of Plaintiff’s and Class members’ PII to protect against reasonably foreseeable 

threats to the security or integrity of such information.

45. Plaintiffs’ and Class members’ PII is private and sensitive in nature and was left 

inadequately protected by Yahoo. Yahoo did not obtain Plaintiffs’ and Class members’ consent 

to disclose their PII to any other person as required by applicable law and industry standards.

46. As a direct and proximate result of Yahoo’s wrongful action and inaction and 

the resulting Data Breaches, Plaintiffs (as was addressed above) and Class members have been 

placed at an imminent, immediate, and continuing increased risk of harm from identity theft 

and identity fraud, requiring them to take the time and effort to mitigate the actual and potential 

 

15 GAO, Report to Congressional Requesters, at p.33 (June 2007), available at

http://www.gao.gov/new.items/d07737.pdf (emphases added) (last visited Sept. 24, 2014).

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 14 of 28
15

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

impact of the Data Breaches on their lives by, among other things, placing “freezes” and 

“alerts” with credit reporting agencies, contacting their financial institutions, closing or 

modifying financial accounts, and closely reviewing and monitoring their credit reports and 

accounts for unauthorized activity. 

47. Yahoo’s wrongful actions and inaction directly and proximately caused the theft 

and dissemination into the public domain of Plaintiffs’ and Class members’ Private 

Information, causing them to suffer, and continue to suffer, economic damages and other actual 

harm for which they are entitled to compensation, including:

a. theft of their personal and financial information;

b. the imminent and certainly impending injury flowing from potential fraud 

and identify theft posed by their personal information being placed in the 

hands of criminals and already misused via the sale of Plaintiffs’ and Class 

members’ information on the Internet black market;

c. the untimely and inadequate notification of both Data Breaches;

d. the improper disclosure of their Private Information;

e. loss of privacy;

f. ascertainable losses in the form of out-of-pocket expenses and the value of 

their time reasonably incurred to remedy or mitigate the effects of both Data 

Breaches;

g. ascertainable losses in the form of deprivation of the value of their PII, for 

which there is a well-established national and international market;

h. overpayments to Yahoo for products and services purchased during both

Data Breaches in that a portion of the price paid for such products and 

services by Plaintiffs and Class members to Yahoo was for the costs of 

reasonable and adequate safeguards and security measures that would 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 15 of 28
16

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

protect users’ Private Information, which Yahoo did not implement and, as a 

result, Plaintiffs and Class members did not receive what they paid for and 

were overcharged by Yahoo; 

i. deprivation of rights they possess under the California Unfair Competition 

Law (Cal. Bus. & Prof. Code §17200);

48. While the Private Information of Plaintiffs and members of the Class has been 

stolen, the same or a copy of the Private Information continues to be held by Yahoo. Plaintiffs

and members of the Class have an undeniable interest in insuring that this information is 

secure, remains secure, and is not subject to further theft. 

CLASS ACTION ALLEGATIONS

49. Plaintiffs seek relief in their individual capacities and as representatives of all 

others who are similarly situated. Pursuant to Fed. R. Civ. P. 23(a) and (b)(2), (b)(3), and 

(c)(4), Plaintiffs seek certification of two Nationwide classes: 

The 2013 Data Breach National Class: all persons residing in the United 

States whose personal information was disclosed in the Data Breach affecting 

Yahoo in 2013 and disclosed on December 14, 2016. Excluded from each of the 

above Classes are Yahoo, including any entity in which Yahoo has a controlling 

interest, is a parent or subsidiary, or which is controlled by Yahoo, as well as 

the officers, directors, affiliates, legal representatives, heirs, predecessors, 

successors, and assigns of Yahoo. Also excluded are the judges and court 

personnel in this case and any members of their immediate families.

The 2014 Data Breach National Class: all persons residing in the United 

States whose personal information was disclosed in the Data Breach affecting 

Yahoo in 2014 and disclosed on September 22, 2016. Excluded from each of the 

above Classes are Yahoo, including any entity in which Yahoo has a controlling 

interest, is a parent or subsidiary, or which is controlled by Yahoo, as well as 

the officers, directors, affiliates, legal representatives, heirs, predecessors, 

successors, and assigns of Yahoo. Also excluded are the judges and court 

personnel in this case and any members of their immediate families.

50. Numerosity. Fed. R. Civ. P. 23(a)(1). The members of the Class are so 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 16 of 28
17

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

numerous that the joinder of all members is impractical. While the exact number of Class 

members is unknown to Plaintiffs at this time, Yahoo has acknowledged that the Personal 

Information of 500 million users was affected by the 2014 Data Breach and preliminary reports 

indicate that as many as 1 billion accounts were affected by the 2013 Data Breach. 

51. Commonality. Fed. R. Civ. P. 23(a)(2) and (b)(3). There are questions of law 

and fact common to the Class, which predominate over any questions affecting only individual 

Class members. These common questions of law and fact include, without limitation:

a. Whether Yahoo violated the California’s Unfair Competition Law by failing 

to implement reasonable security procedures and practices;

b. Whether Yahoo violated common and statutory law by failing to promptly 

notify class members their personal information had been compromised;

c. Whether class members may obtain injunctive relief against Yahoo under 

California’s privacy laws to require that it safeguard or destroy, rather than 

retain, the Private Information of Plaintiffs and Class members; 

d. Which security procedures and which data-breach notification procedure 

should Yahoo be required to implement as part of any injunctive relief 

ordered by the Court;

e. Whether Yahoo has an implied contractual obligation to use reasonable 

security measures;

f. Whether Yahoo has complied with any implied contractual obligation to use 

reasonable security measures;

g. What security measures, if any, must be implemented by Yahoo to comply 

with its implied contractual obligations;

h. Whether Yahoo violated California’s privacy laws in connection with the 

actions described here; and

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 17 of 28
18

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

i. What the nature of the relief should be, including equitable relief, to which 

Plaintiffs and the Class members are entitled.

52. All members of the proposed Classes are readily ascertainable. Yahoo has 

access to addresses and other contact information for millions of members of the Classes, 

which can be used for providing notice to many Class members.

53. Typicality. Fed. R. Civ. P. 23(a)(3). Plaintiffs’ claims are typical of those of 

other Class members because Plaintiff’s information, like that of every other class member, 

was misused and/or disclosed by Yahoo. 

54. Adequacy of Representation. Fed. R. Civ. P. 23(a)(4). Plaintiffs will fairly and 

adequately represent and protect the interests of the members of the Class. Plaintiffs’ Counsel 

are competent and experienced in litigating class actions, including privacy litigation.

55. Superiority of Class Action. Fed. R. Civ. P. 23(b)(3). A class action is superior 

to other available methods for the fair and efficient adjudication of this controversy since 

joinder of all the members of the Class is impracticable. Furthermore, the adjudication of this 

controversy through a class action will avoid the possibility of inconsistent and potentially 

conflicting adjudication of the asserted claims. There will be no difficulty in the management 

of this action as a class action.

56. Damages for any individual class member are likely insufficient to justify the

cost of individual litigation so that, in the absence of class treatment, Yahoo’s violations of law 

inflicting substantial damages in the aggregate would go un-remedied.

57. Class certification is also appropriate under Fed. R. Civ. P. 23(a) and (b)(2), 

because Yahoo has acted or has refused to act on grounds generally applicable to the Class, so 

that final injunctive relief or corresponding declaratory relief is appropriate as to the Class as a 

whole.

COUNT I

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 18 of 28
19

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

Breach of Implied Contract

(On Behalf of Plaintiffs and the Nationwide Class)

58. Plaintiffs incorporate the substantive allegations contained in Paragraphs 1 

through 48.

59. Yahoo solicited and invited Plaintiffs and Class Members to use its services. 

Plaintiffs and Class members accepted Yahoo’s offers and created user accounts requiring the 

provision of Private Information with Yahoo during the periods of each of the two Data 

Breaches.

60. When Plaintiffs and Class Members used Yahoo services and products, they 

provided their Private Information. In so doing, Plaintiffs and Class Members entered into 

implied contracts with Yahoo pursuant to which Yahoo agreed to safeguard and protect such 

information and to timely and accurately notify Plaintiffs and Class Members if their data had 

been breached and compromised.

61. Each use of a Yahoo service or product made by Plaintiffs and Class Members 

was made pursuant to the mutually agreed-upon implied contract with Yahoo under which 

Yahoo agreed to safeguard and protect Plaintiffs’ and Class Members’ Private Information and 

to timely and accurately notify them if such information was compromised or stolen.

62. Plaintiffs and Class Members would not have provided and entrusted their 

Private Information to Yahoo in the absence of the implied contract between them and Yahoo.

63. Plaintiffs and Class Members fully performed their obligations under the 

implied contracts with Yahoo.

64. Yahoo breached the implied contracts it made with Plaintiffs and Class 

Members by failing to safeguard and protect the Private Information of Plaintiffs and Class 

Members and by failing to provide timely and accurate notice to them that their Private 

Information was compromised in and as a result of the Data Breaches.

65. As a direct and proximate result of Yahoo’s breaches of the implied contracts 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 19 of 28
20

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

between Yahoo and Plaintiffs and Class Members, Plaintiffs and Class Members sustained 

actual losses and damages as described in detail above. 

COUNT II

Negligence

(On Behalf of Plaintiffs and the Nationwide Class)

66. Plaintiffs repeat and fully incorporate the allegations contained in paragraphs 1 

through 48.

67. Upon accepting and storing Plaintiffs’ and Class Members’ Private Information 

in their respective computer database systems, Yahoo undertook and owed a duty to Plaintiffs

and Class Members to exercise reasonable care to secure and safeguard that information and to 

utilize commercially reasonable methods to do so. Yahoo knew, acknowledged, and agreed that 

the Private Information was private and confidential and would be protected as private and 

confidential. 

68. The law imposed an affirmative duty on Yahoo to timely discover and disclose 

the unauthorized access and theft of the Private Information to Plaintiffs and the Class so that 

Plaintiffs and Class Members could take appropriate measures to mitigate damages, protect 

against adverse consequences, and thwart future misuse of their Private Information.

69. Yahoo breached its duty to discover and to notify Plaintiffs and Class Members 

of the unauthorized access by failing to discover and notify Plaintiffs and Class Members of the 

breach until September 2016. To date, Yahoo has not provided sufficient information to 

Plaintiffs and Class Members regarding the extent of the unauthorized access and continues to 

breach its disclosure obligations to Plaintiffs and the Class.

70. Yahoo also breached its duty to Plaintiffs and the Class Members to adequately 

protect and safeguard this information by knowingly disregarding standard information security 

principles, despite obvious risks, and by allowing unmonitored and unrestricted access to 

unsecured Private Information. Furthering its dilatory practices, Yahoo failed to provide 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 20 of 28
21

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

adequate supervision and oversight of the Private Information with which it is entrusted, in 

spite of the known risk and foreseeable likelihood of breach and misuse, which permitted a 

third party to gather Plaintiffs’ and Class Members’ Private Information, misuse the Private 

Information, and intentionally disclose it to others without consent. 

71. Through Yahoo’s acts and omissions described in this Complaint, including 

Yahoo’s failure to provide adequate security and its failure to protect Plaintiffs’ and Class 

Members’ Private Information from being foreseeably captured, accessed, disseminated, stolen, 

and misused, Yahoo unlawfully breached its duty to use reasonable care to adequately protect 

and secure Plaintiffs’ and Class Members’ Private Information during the time it was within 

Yahoo’s possession or control. 

72. Further, through its failure to timely discover and provide clear notification of 

the Data Breaches to consumers, Yahoo prevented Plaintiffs and Class Members from taking 

meaningful, proactive steps to secure their Private Information, including other online accounts. 

73. Upon information and belief, Yahoo improperly and inadequately safeguarded 

the Private Information of Plaintiffs and Class Members in deviation from standard industry 

rules, regulations, and practices at the time of the Data Breaches. 

74. Yahoo’s failure to take proper security measures to protect Plaintiffs’ and Class 

Members’ sensitive Private Information as described in this Complaint, created conditions 

conducive to a foreseeable, intentional criminal act, namely the unauthorized access of 

Plaintiffs’ and Class Members’ Private Information. 

75. Yahoo’s conduct was grossly negligent and departed from all reasonable 

standards of care, including, but not limited to: failing to adequately protect the Private 

Information; failing to conduct adequate regular security audits; failing to provide adequate and 

appropriate supervision of persons having access to Plaintiffs’ and Class Members’ Private 

Information; and failing to provide Plaintiffs and Class Members with timely and sufficient 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 21 of 28
22

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

notice that their sensitive Private Information had been compromised. 

76. Neither Plaintiffs nor the other Class Members contributed to the Data Breaches

and subsequent misuse of their Private Information as described in this Complaint. 

77. As a direct and proximate cause of Yahoo’s conduct, Plaintiffs and the Class 

suffered damages including, but not limited to: damages from identity theft, which may take 

months, if not years, to discover and detect, given the far-reaching, adverse, and detrimental 

consequences of identity theft and loss of privacy. The nature of other forms of economic 

damage and injury may take years to detect and the potential scope can only be assessed after a 

thorough investigation of the facts and events surrounding the theft mentioned above. 

COUNT III

Violation of California’s Unfair Competition Law

Cal. Bus. & Prof. Code §17200 – Unlawful Business Practices

(On Behalf of Plaintiffs and the Nationwide Class)

78. Plaintiffs repeat and fully incorporates the allegations contained in the preceding 

paragraphs.

79. Yahoo has violated Cal. Bus. and Prof. Code §17200 et seq. by engaging in 

unlawful, unfair or fraudulent business acts and practices and unfair, deceptive, untrue or 

misleading advertising that constitute acts of “unfair competition” as defined in Cal. Bus. Prof. 

Code §17200 with respect to the hotel services provided to the Class.

80. Yahoo engaged in unlawful acts and practices with respect to its services by 

establishing the sub-standard security practices and procedures described herein; by soliciting 

and collecting Plaintiffs’ and Class Members’ Private Information with knowledge that the 

information would not be adequately protected; and by storing Plaintiffs’ and Class Members’ 

Private Information in an unsecure electronic environment in violation of California’s data 

breach statute, Cal. Civ. Code § 1798.81.5, which requires Yahoo to take reasonable methods 

of safeguarding the Private Information of Plaintiffs and the Class Members.

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 22 of 28
23

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

81. In addition, Yahoo engaged in unlawful acts and practices with respect to the its

services by failing to discover and then disclose the Data Breaches to Class Members in a 

timely and accurate manner, contrary to the duties imposed by Cal. Civ. Code § 1798.82. To 

date, Yahoo has still not provided such sufficient information to Plaintiffs and the Class 

Members. 

82. As a direct and proximate result of Yahoo’s unlawful practices and acts, 

Plaintiffs and the Class Members were injured and lost money or property, including but not 

limited to the price received by Yahoo for the hotel services, the loss of their legally protected 

interest in the confidentiality and privacy of their Private Information, and additional losses 

described above. 

83. Yahoo knew or should have known that its computer systems and data security 

practices were inadequate to safeguard Class Members’ Private Information and that the risk of 

a data breach or theft was highly likely. Yahoo’s actions in engaging in the above-named 

unlawful practices and acts were negligent, knowing and willful, and/or wanton and reckless 

with respect to the rights of members of the Class. 

84. Class Members seek relief under Cal. Bus. & Prof. Code § 17200, et. seq., 

including, but not limited to, restitution to Plaintiffs and Class Members of money or property 

that Yahoo may have acquired by means of its unlawful, and unfair business practices,

restitutionary disgorgement of all profits accruing to Yahoo because of its unlawful and unfair 

business practices, declaratory relief, attorney’s fees and costs (pursuant to Cal. Code Civ. 

Proc. §1021.5), and injunctive or other equitable relief.

COUNT IV

Violation of California’s Unfair Competition Law

Cal. Bus. & Prof. Code §17200 – Unfair Business Practices

(On Behalf of Plaintiffs and the Nationwide Class)

85. Plaintiffs repeat and fully incorporate the allegations contained in the preceding 

paragraphs.

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 23 of 28
24

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

86. Yahoo engaged in unfair acts and practices with respect to the hotel services by 

establishing the sub-standard security practices and procedures described here; by soliciting 

and collecting Plaintiffs’ and Class Members’ Private Information with knowledge that the 

information would not be adequately protected; and by storing Plaintiffs’ and Class Members’ 

Private Information in an unsecure electronic environment. These unfair acts and practices 

were immoral, unethical, oppressive, unscrupulous, unconscionable, and/or substantially 

injurious to Plaintiffs and Class Members. They were likely to deceive the public into 

believing their Private Information was securely stored, when it was not. The harm these 

practices caused to Plaintiffs and the Class Members outweighed their utility, if any.

87. Yahoo engaged in unfair acts and practices with respect to the provision of its

services by failing to take proper action following either of the Data Breaches to enact adequate 

privacy and security measures and protect Class Members’ Private Information from further 

unauthorized disclosure, release, data breaches, and theft. These unfair acts and practices were 

immoral, unethical, oppressive, unscrupulous, unconscionable, and/or substantially injurious to 

Plaintiffs and Class Members. They were likely to deceive the public into believing their 

Private Information was securely stored, when it was not. The harm these practices caused to 

Plaintiffs and the Class Members outweighed their utility, if any.

88. As a direct and proximate result of Yahoo’s acts of unfair practices and acts, 

Plaintiffs and the Class Members were injured and lost money or property, including but not 

limited to the loss of their legally protected interest in the confidentiality and privacy of their 

Private Information, and additional losses described above. 

89. Yahoo knew or should have known that its computer systems and data security 

practices were inadequate to safeguard Class Members’ Private Information and that the risk of 

a data breach or theft was highly likely. Yahoo’s actions in engaging in the above-named 

unlawful practices and acts were negligent, knowing and willful, and/or wanton and reckless 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 24 of 28
25

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

with respect to the rights of members of the Class. 

90. Class Members seek relief under Cal. Bus. & Prof. Code § 17200, et. seq., 

including, but not limited to, restitution to Plaintiffs and Class Members of money or property 

that the Yahoo may have acquired by means of its unfair business practices, restitutionary 

disgorgement of all profits accruing to Yahoo because of its unfair business practices, 

declaratory relief, attorney’s fees and costs (pursuant to Cal. Code Civ. Proc. §1021.5), and 

injunctive or other equitable relief.

COUNT IV

Violation of California’s Unfair Competition Law

Cal. Bus. & Prof. Code §17200 – Fraudulent/Deceptive Business Practices

(On Behalf of Plaintiffs and the Nationwide Class)

91. Plaintiffs repeat and fully incorporate the allegations contained in the preceding 

paragraphs.

92. Yahoo engaged in fraudulent and deceptive acts and practices with regard to the 

hotel services provided to the Class by representing and advertising that it would maintain 

adequate data privacy and security practices and procedures to safeguard Class Members’ 

Private Information from unauthorized disclosure, release, data breaches, and theft; and 

representing and advertising that it did and would comply with the requirements of relevant 

federal and state laws pertaining to the privacy and security of Class Members’ Private 

Information. These representations were likely to deceive members of the public, including 

Plaintiffs and the Class Members, into believing their Private Information was securely stored, 

when it was not, and that Yahoo was complying with relevant law, when it was not.

93. Yahoo engaged in fraudulent and deceptive acts and practices with regard to the 

hotel services provided to the Class by omitting, suppressing, and concealing the material fact 

of the inadequacy of the privacy and security protections for Class Members’ Private 

Information. At the time that Class members were using Yahoo’s services, Yahoo failed to 

disclose to Class Members that its data security systems failed to meet legal and industry 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 25 of 28
26

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

standards for the protection of their Private Information. Plaintiffs would not have selected 

Yahoo to its services if they had known about its substandard data security practices. These 

representations were likely to deceive members of the public, including Plaintiffs and the Class

Members, into believing their Private Information was securely stored, when it was not, and 

that Yahoo was complying with relevant law and industry standards, when it was not.

94. As a direct and proximate result of Yahoo’s deceptive practices and acts, 

Plaintiffs and the Class Members were injured and lost money or property, including but not 

limited to the loss of their legally protected interest in the confidentiality and privacy of their 

Private Information, and additional losses described above. 

95. Yahoo knew or should have known that its computer systems and data security 

practices were inadequate to safeguard Class Members’ Private Information and that the risk of 

a data breach or theft was highly likely. Yahoo’s actions in engaging in the above-named 

unlawful practices and acts were negligent, knowing and willful, and/or wanton and reckless 

with respect to the rights of members of the Class. 

96. Class Members seek relief under Cal. Bus. & Prof. Code § 17200, et. seq., 

including, but not limited to, restitution to Plaintiffs and Class Members of money or property 

that the Yahoo may have acquired by means of its fraudulent and deceptive business practices, 

restitutionary disgorgement of all profits accruing to Yahoo because of its fraudulent and 

deceptive business practices, declaratory relief, attorney’s fees and costs (pursuant to Cal. Code 

Civ. Proc. §1021.5), and injunctive or other equitable relief.

REQUEST FOR RELIEF

WHEREFORE, Plaintiffs, individually and on behalf of all Class members proposed 

in this Complaint, respectfully requests that the Court enter judgment in his favor and against 

Yahoo as follows:

a. For an Order certifying the Nationwide Classes as defined here, and 

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 26 of 28
27

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

appointing Plaintiffs and his Counsel to represent the Nationwide Classes;

b. For equitable relief enjoining Yahoo from engaging in the wrongful conduct 

complained of here pertaining to the misuse and/or disclosure of Plaintiffs

and Class members’ Private Information, and from refusing to issue prompt, 

complete, and accurate disclosures to the Plaintiffs and Class members;

c. For equitable relief compelling Yahoo to utilize appropriate methods and 

policies with respect to consumer data collection, storage, and safety and to 

disclose with specificity to Class members the type of PII compromised.

d. For equitable relief requiring restitution and disgorgement of the revenues 

wrongfully retained as a result of Yahoo’s wrongful conduct;

e. For an award of actual damages and compensatory damages, in an amount to 

be determined;

f. For restitution of fees paid to Yahoo for email and/or web hosting services;

g. For an award of costs of suit and attorneys’ fees, as allowable by law; and

h. Such other and further relief as this court may deem just and proper.

JURY TRIAL DEMAND

Plaintiff demands a jury trial on all issues so triable.

Dated: December 16, 2016 Respectfully submitted,

RAM, OLSON, CEREGHINO & KOPCZYNSKI LLP

By: /s/ Michael F. Ram, SBN #104805 

Michael F. Ram, SBN #104805

mram@rocklawcal.com

Matt Malone, SBN #221545

mjm@rocklawcal.com

Susan Brown, SBN #287986

sbrown@rocklawcal.com

RAM, OLSON, CEREGHINO & 

KOPCZYNSKI LLP

101 Montgomery Street, Suite 1800

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 27 of 28
28

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

San Francisco, California 94104

Telephone: (415) 433-4949

Facsimile: (415) 433-7311

John A. Yanchunis

[To be admitted Pro Hac Vice]

Florida Bar No. 324681

jyanchunis@ForThePeople.com

MARCIO W. VALLADARES

[To be admitted Pro Hac Vice]

Florida Bar No. 986917

mvalladares@ForThePeople.com

PATRICK A. BARTHLE II

[To be admitted Pro Hac Vice]

Florida Bar No. 99286

pbarthle@ForThePeople.com

MORGAN & MORGAN 

COMPLEX LITIGATION GROUP

201 N. Franklin Street, 7th Floor

Tampa, Florida 33602

Telephone: (813) 223-5505

Facsimile: (813) 223-5402

 

 Michael A. Galpern, Esq.

mgalpern@lockslaw.com

 Andrew P. Bell, Esq.

abell@lockslaw.com

 James A. Barry, Esq.

jbarry@lockslaw.com

LOCKS LAW FIRM, LLC

 801 Kings Hwy. N.

Cherry Hill, NJ 08034

Tel.: (856) 663-8200

Attorneys for Plaintiff and Proposed Classes

Case 5:16-md-02752-LHK Document 3 Filed 12/16/16 Page 28 of 28