Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

JORDAN ETH (CA SBN 121617)

JEth@mofo.com 

JUDSON E. LOBDELL (CA SBN 146041) 

JLobdell@mofo.com 

MORRISON & FOERSTER LLP 

425 Market Street 

San Francisco, California 94105-2482 

Telephone: 415.268.7000 

Facsimile: 415.268.7522 

Attorneys for Defendants 

ALTABA INC. (F.K.A. YAHOO! INC.) and MARISSA 

MAYER 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

SAN JOSE DIVISION 

IN RE YAHOO! INC. SECURITIES 

LITIGATION 

THIS DOCUMENT RELATES TO: ALL 

ACTIONS 

Case No. 17-CV-00373 (LHK) 

YAHOO! INC. AND MARISSA 

MAYER’S NOTICE OF MOTION 

AND MOTION TO DISMISS 

PLAINTIFFS’ SECOND AMENDED 

CLASS ACTION COMPLAINT; 

SUPPORTING MEMORANDUM OF 

POINTS AND AUTHORITIES 

Date: May 3, 2018 

Time: 1:30 PM 

Place: Courtroom 8, 4th Floor 

Judge: Hon. Lucy H. Koh

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 1 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT i

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

NOTICE OF MOTION AND MOTION 

TO ALL PARTIES AND THEIR COUNSEL OF RECORD: 

PLEASE TAKE NOTICE that on May 3, 2018, at 1:30 p.m., or as soon thereafter as the 

matter may be heard, in the Courtroom of the Honorable Lucy H. Koh, located at 280 South 1st 

Street, San Jose, California, Altaba Inc., formerly known as Yahoo! Inc. (“Yahoo” or the 

“Company”), and Marissa Mayer (collectively with Ronald Bell and Alexander Stamos, the 

“Individual Defendants,” with Yahoo, the “Defendants”), will, and hereby do, move pursuant to 

Federal Rules of Civil Procedure 8, 9(b), and 12(b)(6), and the Private Securities Litigation 

Reform Act of 1995 (the “Reform Act”) to dismiss the Second Amended Class Action Complaint 

for Violations of the Federal Securities Laws (the “SAC”), ECF No. 70-1. 

This Motion is based on this Notice; the accompanying Memorandum of Points and 

Authorities; Yahoo! Inc. and Marissa Mayer’s Request for Judicial Notice in Support of Motion 

to Dismiss Plaintiffs’ Second Amended Class Action Complaint (the “Request for Judicial 

Notice”); the Declaration of Judson E. Lobdell in Support of Yahoo! Inc. and Marissa Mayer’s 

Motion to Dismiss Plaintiffs’ Second Amended Class Action Complaint (the “Lobdell Decl.”) 

and the exhibits attached thereto; the papers and pleadings on file with the Court; and such other 

written or oral argument and other materials as may be presented before the Court takes this 

Motion under submission. 

ISSUES TO BE DECIDED 

1. Failure to Plead Falsity: Whether Plaintiffs’ claims arising under Section 10(b) 

of the Securities Exchange Act of 1934 (the “Exchange Act”) should be dismissed on the ground 

that Plaintiffs have failed to plead particularized facts showing that any Defendant made a 

materially false or misleading statement. 

2. Failure to Plead Scienter: Whether Plaintiffs’ Section 10(b) claims should be 

dismissed on the additional independent ground that Plaintiffs have failed to plead particularized 

facts giving rise to a strong inference that any Defendant acted with scienter when making a 

materially false or misleading statement. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 2 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT ii

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

3. Failure to Plead Loss Causation and Damages: Whether Plaintiffs’ Section 

10(b) claims should be dismissed on the additional independent grounds that Plaintiffs have failed 

to plead the elements of loss causation and damages. 

4. Failure to Plead Control-Person Liability: Whether Plaintiffs’ control-person 

claims under Section 20(a) of the Exchange Act should be dismissed on the grounds that (1) 

Plaintiffs have failed to plead an underlying Section 10(b) claim; and (2) Plaintiffs have failed to 

plead facts establishing the element of control. 

Dated: March 2, 2018 MORRISON & FOERSTER LLP 

By: /s/ Judson E. Lobdell

JUDSON E. LOBDELL 

Attorneys for Defendants 

YAHOO! INC. and MARISSA MAYER

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 3 of 45
TABLE OF CONTENTS 

Page

Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT iii

sf-3868679 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

INTRODUCTION .......................................................................................................................... 1

PROCEDURAL BACKGROUND ................................................................................................. 2

THE SECOND AMENDED COMPLAINT’S ALLEGATIONS .................................................. 3

ARGUMENT .................................................................................................................................. 8

I. Plaintiffs must satisfy exacting pleading requirements to survive a motion to 

dismiss. ................................................................................................................................ 8

II. Plaintiffs’ Section 10(b) Claim Should Be Dismissed. ....................................................... 9

A. Plaintiffs’ Mismanagement Allegations Fail to State a Section 10(b) Claim. ........ 9

B. Plaintiffs’ Omission Theory Fails to State a Section 10(b) Claim. ....................... 10

C. Plaintiffs Fail to Plead False or Misleading Statements........................................ 12

1. Plaintiffs do not show how Yahoo’s statements were rendered false 

or misleading by the Security Incidents. ................................................... 12

2. Challenged statements that are not “objectively verifiable” are not 

actionable. ................................................................................................. 19

3. Statements not made in connection with the purchase or sale of 

securities are not actionable. ..................................................................... 20

D. Plaintiffs Fail to Plead Particularized Facts Giving Rise to a “Strong 

Inference” of Scienter. .......................................................................................... 21

1. The 2013 Security Incident ....................................................................... 22

2. The 2014 Security Incident ....................................................................... 23

E. Plaintiffs’ Claims Should Also Be Dismissed for Failure to Plead Loss 

Causation and Damages. ....................................................................................... 30

1. Maher has not pled loss causation. ............................................................ 30

2. Sutton View’s claim is barred by the Reform Act’s damages 

limitation. .................................................................................................. 32

3. Talukder’s claim is barred by the Reform Act’s damages limitation. ...... 33

III. The Section 20(a) claims should be dismissed. ................................................................ 34

CONCLUSION ............................................................................................................................. 35

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 4 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT iv

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

TABLE OF AUTHORITIES 

 Page(s) 

Cases 

Ashcroft v. Iqbal, 

556 U.S. 662 (2009) ....................................................................................................................8 

Basic Inc. v. Levinson, 

485 U.S. 224 (1988) ..................................................................................................................10 

Bell Atl. Corp. v. Twombly, 

550 U.S. 544 (2007) ....................................................................................................................8 

Bien v. LifeLock Inc., 

No. CV-14-00416-PHX-SRB, 2015 WL 12819154 (D. Ariz. July 21, 2015) ..........................16 

Bonato v. Yahoo Inc., 

No. C 11-02732 CRB, 2012 U.S. Dist. LEXIS 113036 (N.D. Cal. Aug. 10, 

2012) .........................................................................................................................................15 

Brodsky v. Yahoo! Inc., 

592 F. Supp. 2d 1192 (N.D. Cal. 2008) ....................................................................................20 

Brody v. Transitional Hosps. Corp., 

280 F.3d 997 (9th Cir. 2002) ...................................................................................10, 12, 13, 16 

Cent. Bank of Denver, N.A. v. First Interstate Bank, N.A., 

511 U.S. 164 (1994) ..................................................................................................................29 

Chiarella v. United States, 

445 U.S. 222 (1980) ..................................................................................................................10 

In re ChinaCast Educ. Corp. Sec. Litig., 

809 F.3d 471 (9th Cir. 2015) .....................................................................................................29 

City of Dearborn Heights Act 345 Police & Fire Ret. Sys. v. Align Tech., Inc., 

856 F.3d 605 (9th Cir. 2017) .....................................................................................................25 

City of Dearborn Heights Act 345 Police & Fire Ret. Sys. v. Waters Corp., 

632 F.3d 751 (1st Cir. 2011) .........................................................................................23, 28, 29 

City of Westland Police and Fire Ret. Sys. v. Sonic Solutions, 

No. C 07-0111 CW, 2009 U.S. Dist. LEXIS 33339 (N.D. Cal. Apr. 6, 2009) .........................35 

In re Cutera Sec. Litig., 

610 F.3d 1103 (9th Cir. 2010) .............................................................................................19, 20 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 5 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT v

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Dura Pharm., Inc. v. Broudo, 

544 U.S. 336 (2005) ......................................................................................................30, 32, 33 

Ernst & Ernst v. Hochfelder, 

425 U.S. 185 (1976) ..............................................................................................................1, 21 

In re Foundry Networks, Inc. Secs. Litig., 

No. C00-4823 MMC, 2002 U.S. Dist. LEXIS 28070 (N.D. Cal. June 6, 2002) .......................17 

Gaines v. Haughton, 

645 F.2d 761 (9th Cir. 1981) .......................................................................................................9 

Glazer Capital Mgmt., LP v. Magisti, 

549 F.3d 736 (9th Cir. 2008) ...............................................................................................18, 25 

In re Galena Biopharma, Inc. Sec. Litig., 

117 F. Supp. 3d 1145 (D. Or. 2015) .........................................................................................35 

In re GlenFed, Inc. Sec. Litig., 

42 F.3d 1541 (9th Cir. 1994) .......................................................................................................8 

Hanon v. Dataproducts Corp., 

976 F.2d 497 (9th Cir. 1992) .....................................................................................................18 

In re Heartland Payment Sys., Inc. Sec. Litig., 

No. 09-1043, 2009 U.S. Dist. LEXIS 114866 (D.N.J. Dec. 7, 2009) .................................13, 15 

Howard v. Hui, 

No. C92-3742 CRB, 2001 U.S. Dist. LEXIS 15443 (N.D. Cal. Sept. 24, 2001) ......................34 

In re Impac Mortg. Holdings, Inc. Sec. Litig., 

554 F. Supp. 2d 1083 (C.D. Cal. 2008) ....................................................................................34 

In re Impax Labs., Inc. Sec. Litig., 

No. C 04-04802 JW, 2008 U.S. Dist. LEXIS 104485 (N.D. Cal. Apr. 17, 2008) ....................34 

In re Int’l Rectifier Corp. Sec. Litig., 

No. CV 07-02544-JFW, 2008 U.S. Dist. LEXIS 44872 (C.D. Cal. May 23, 

2008) .........................................................................................................................................29 

In re Invensense, Inc. Sec. Litig., 

No. 15-cv-00084-JD, 2016 U.S. Dist. LEXIS 40607 (N.D. Cal. Mar. 28, 2016) .....................34 

Janus Capital Grp., Inc. v. First Derivative Traders, 

564 U.S. 135 (2011) ..................................................................................................................21 

In re LeapFrog Enters., Inc. Sec. Litig., 

527 F. Supp. 2d 1033 (N.D. Cal. 2007) ..............................................................................17, 20 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 6 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT vi

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

In re LifeLock, Inc., 

690 Fed. App’x 947 (9th Cir. 2017) ....................................................................................21, 29 

Lipton v. Pathogenesis Corp., 

284 F.3d 1027 (9th Cir. 2002) ...................................................................................................23 

Livid Holdings Ltd. v. Salomon Smith Barney, Inc., 

416 F.3d 940 (9th Cir. 2005) .......................................................................................................9 

Loos v. Immersion Corp., 

762 F.3d 880 (9th Cir. 2014) .................................................................................................9, 30 

Matrixx Initiatives, Inc. v. Siracusano, 

563 U.S. 27 (2011) ................................................................................................................1, 10 

McGann v. Ernst & Young, 

102 F.3d 390 (9th Cir. 1996) .....................................................................................................20 

In re Mego Fin. Corp. Sec. Litig., 

213 F.3d 454 (9th Cir. 2000) ...............................................................................................32, 33 

Metzler Inv. GmbH v. Corinthian Colls., 

540 F.3d 1049 (9th Cir. 2008) .......................................................................................12, 22, 31

Mineworkers’ Pension Scheme v. First Solar, Inc., 

881 F.3d 750 (9th Cir. 2018) ..............................................................................................30, 32

Neborsky v. Valley Forge Composite Techs., Inc., 

No. 13-CV-2307-MMA (BGS), 2014 U.S. Dist. LEXIS 104681 (S.D. Cal. July 

29, 2014) ...................................................................................................................................35 

Nordstrom, Inc. v. Chubb & Son, Inc., 

54 F.3d 1424 (9th Cir. 1995) .....................................................................................................29 

In re NVIDIA Corp. Sec. Litig., 

768 F.3d 1046 (9th Cir. 2014) ........................................................................................... passim

In re Oak Tech. Sec. Litig., 

No. 96-20552 SW, 1997 U.S. Dist. LEXIS 18503 (N.D. Cal. Aug. 1, 1997)...........................35 

Okla. Firefighters Pension & Ret. Sys. v. Ixia, 

50 F. Supp. 3d 1328 (C.D. Cal. 2014) ......................................................................................30 

In re Oracle Corp. Sec. Litig., 

627 F.3d 376 (9th Cir. 2010) .....................................................................................................30

Or. Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 

774 F.3d 598 (9th Cir. 2014) .....................................................................................9, 19, 20, 31

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 7 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT vii

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Paracor Fin., Inc. v. GE Capital Corp., 

96 F.3d 1151 (9th Cir. 1996) .....................................................................................................33 

Petrie v. Elec. Game Card, Inc., 

SACV10-00252 DOC (RNBx), 2011 WL 13130015 (C.D. Cal. Oct. 19, 2011) ......................29 

Police Ret. Sys. of St. Louis v. Intuitive Surgical, Inc., 

759 F.3d 1051 (9th Cir. 2014) .......................................................................................23, 27, 28

In re Read-Rite Corp., 

335 F.3d 843 (9th Cir. 2003) .....................................................................................................13 

Retail Wholesale & Dep’t Store Union Local 338 Ret. Fund v. Hewlett-Packard 

Co., 

845 F.3d 1268 (9th Cir. 2017) ........................................................................................... passim

Richardson v. Oppenheimer & Co. Inc., 

No. 2:11-cv-02078-GMN-PAL, 2014 U.S. Dist. LEXIS 43419 (D. Nev. Mar. 

31, 2014) ...................................................................................................................................35 

In re Rigel Pharm., Inc. Sec. Litig., 

697 F.3d 869 (9th Cir. 2012) ............................................................................................. passim

Ronconi v. Larkin, 

253 F.3d 423 (9th Cir. 2001) .........................................................................................12, 13, 22 

Roots P’ship v. Lands’ End, Inc., 

965 F.2d 1411 (7th Cir. 1992) ...................................................................................................34 

Santa Fe Industries, Inc. v. Green, 

430 U.S. 462 (1977) ................................................................................................................1, 9 

In re Silicon Graphics, Inc. Sec. Litig., 

183 F.3d 970 (9th Cir. 1999) .....................................................................................................21 

In re Silicon Storage Tech., 

No. C 05-0295 PJH, 2006 U.S. Dist. LEXIS 14790 (N.D. Cal. Mar. 10, 2006) ........................9 

Southland Sec. Corp. v. INSpire Ins. Solutions Inc., 

365 F.3d 353 (5th Cir. 2004) .....................................................................................................30 

In re Stac Elecs. Sec. Litig., 

89 F.3d 1399 (9th Cir. 1996) ...................................................................................................5, 8 

Stoneridge Inv. Partners v. Scientific-Atlanta, 

552 U.S. 148 (2008) ............................................................................................................12, 29 

Tellabs, Inc. v. Makor Issues & Rights Ltd., 

551 U.S. 308 (2007) ....................................................................................................5, 9, 21, 22 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 8 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT viii

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

In re U.S. Aggregates, Inc. Sec. Litig., 

235 F. Supp. 2d 1063 (N.D. Cal. 2002) ..............................................................................25, 27 

In re Union Exploration Partners Sec. Litig., 

No. CV-90-3125, 1992 U.S. Dist. LEXIS 9013 (C.D. Cal. June 18, 1992) .............................11 

In re Vantive Corp. Sec. Litig., 

283 F.3d 1079 (9th Cir. 2002) .........................................................................................9, 13, 25 

In re Veritas Software Corp. Sec. Litig., 

496 F.3d 962 (9th Cir. 2007) .....................................................................................................32 

In re Vivendi Universal, S.A. Sec. Litig., 

123 F. Supp. 3d 424 (S.D.N.Y. 2015) .................................................................................32, 33 

In re Volkswagen “Clean Diesel” Mktg., Sales Practices, & Prods. Liab. Litig., 

MDL No. 2672 (JSC), 2017 U.S. Dist. LEXIS 1109 (N.D. Cal. Jan. 4, 2017) ..................34, 35 

Warth v. Seldin, 

422 U.S. 490 (1975) ..................................................................................................................34 

Weiss v. Amkor Tech., Inc., 

527 F. Supp. 2d 938 (D. Ariz. 2007) .........................................................................................29

Zucco Partners, LLC v. Digimarc Corp., 

552 F.3d 981 (9th Cir. 2009) ...............................................................................9, 21, 22, 26, 34 

Statutes 

15 U.S.C. § 78u-4 .................................................................................................................... passim

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 9 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 1

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

INTRODUCTION 

In 2013 and 2014, hackers breached Yahoo’s cybersecurity systems, resulting in the theft 

of account information from Yahoo user accounts (the “Security Incidents”). The hackers 

responsible for the 2014 Security Incident were working at the direction of the Russian 

government’s Federal Security Service (the “FSB”). Those responsible for the 2013 attack still 

have not been identified. 

In this action, Plaintiffs seek to dress up a state-sponsored cybersecurity breach as a 

securities fraud on the theory that Yahoo’s CEO, General Counsel, and Chief Information 

Security Officer (“CISO”) covered up the Security Incidents in order to artificially inflate 

Yahoo’s stock price and defraud Yahoo’s investors. Plaintiffs’ Second Amended Complaint 

(“SAC”), however, falls far short of pleading the elements of a Section 10(b) claim. 

Much of the SAC consists of allegations that Yahoo failed to adequately safeguard its 

users’ data. As the Supreme Court held in Santa Fe Industries, Inc. v. Green, 430 U.S. 462, 479-

80 (1977)—and has repeated many times since—such allegations of mismanagement (even if 

true, and here they are not) do not give rise to a Section 10(b) claim. 

Plaintiffs also decry what they describe as Yahoo’s “brazen failure to disclose” the 

breaches to users and investors, insisting that “Yahoo was required to timely and accurately 

disclose all of its security vulnerabilities.” (¶¶ 36-61.1

) These allegations—in addition to being 

inaccurate—are irrelevant because the private right of action under Section 10(b) covers false or 

misleading statements, not failures to disclose. Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 

27, 44-45 (2011). 

When Plaintiffs eventually get around to challenging Defendants’ statements—seventyfive pages into the SAC—the statements they identify are not actionable for multiple reasons. 

Most of the statements concern Yahoo’s aspirational “commitment” to user privacy, its efforts to 

increase network security, and its warnings that these efforts had not always succeeded in the 

 

1

 Unless otherwise noted, all “¶” references are to the SAC and all Exhibit references are to the 

Declaration of Judson E. Lobdell in Support of Yahoo! Inc. and Marissa Mayer’s Motion to 

Dismiss Plaintiffs’ Second Amended Class Action Complaint (“Lobdell Decl.”). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 10 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 2

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

past, and might not succeed in the future. Nothing in the SAC shows these statements were false. 

In any event, unverifiable expressions of optimism do not give rise to a private right of action 

under Section 10(b) and the act of enumerating risk factors does not give rise to a duty of 

elaboration. 

Additionally, Plaintiffs fail to plead facts establishing the required “strong inference of 

scienter”—a “mental state embracing intent to deceive, manipulate, or defraud,” Ernst & Ernst v. 

Hochfelder, 425 U.S. 185, 193 n.12 (1976)—on the part of any Defendant. The context and 

content of the statements Plaintiffs challenge undermine any inference of scienter. The facts 

Plaintiffs allege do not support a strong inference that the Individual Defendants made any of the 

challenged statements with an intent to deceive investors. 

Finally, the SAC should also be dismissed because it does not plead loss causation or 

recoverable damages on the part of any Plaintiff. Lead Plaintiff Maher never held Yahoo stock—

only stock options—and sold all these options before either Security Incident was disclosed. The 

claims of Lead Plaintiff Sutton View Partners LP (“Sutton View”) and named plaintiff Nafiz 

Talukder are barred by the Reform Act’s 90-day “bounce back” provision, which imposes a 

statutory limit on recoverable damages. 

PROCEDURAL BACKGROUND 

This litigation commenced on January 24, 2017, with the filing of the first of two 

complaints asserting claims under Sections 10(b) and 20(a) of the Exchange Act based on the 

Security Incidents. (ECF No. 1.) On April 24, 2017, this Court consolidated the two actions 

under the caption In re Yahoo! Inc. Securities Litigation, and appointed Ben Maher (“Maher”) 

and Sutton View as Lead Plaintiffs. On June 7, 2017, Lead Plaintiffs filed their First Amended 

Class Action Complaint, including Nafiz Talukder as a “named plaintiff” (with Lead Plaintiffs, 

“Plaintiffs”). (“FAC”). 

On July 28, 2017, Yahoo and Ms. Mayer filed their Motion to Dismiss Plaintiffs’ FAC 

(ECF No. 46), joined by Messrs. Bell and Stamos (ECF Nos. 48-49), with a hearing set for 

October 19, 2017. The hearing on Defendants’ motion to dismiss the FAC was postponed due to 

ongoing settlement discussions between the parties. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 11 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 3

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

On November 22, 2017, the Court sua sponte granted Plaintiffs leave to amend the FAC, 

denied without prejudice as moot the Defendants’ pending motion to dismiss, and set a briefing 

schedule for any motions to dismiss the SAC. (ECF No. 65.) 

On January 23, 2018, the Parties informed the Court that Lead Plaintiff Sutton View and 

named Plaintiff Nafiz Talukder had reached a settlement agreement with Defendants on behalf of 

the class, subject to formal documentation and Court approval. (ECF No. 68.) The Parties 

further informed the Court that Maher had not agreed to the settlement and that they intended to 

file a motion by March 2, 2018, requesting that the Court enter an order granting preliminary 

approval of a class-wide settlement in this Action and the Parties requested that, in light of the 

settlement, the Court vacate the deadlines set in its November 22, 2017 Order. (Id.) The Court 

denied this request. (ECF No. 69.) 

As ordered by the Court, Plaintiffs filed the SAC on February 2, 2018. (ECF No. 70.) 

THE SECOND AMENDED COMPLAINT’S ALLEGATIONS 

I. THE PARTIES 

A. Plaintiffs and the Plaintiff Class 

Lead Plaintiffs Maher and Sutton View purport to have purchased Yahoo securities 

between May 2, 2014, and April 15, 2016. (Ex. 27.) Maher’s purported purchases of Yahoo 

securities during this period consisted solely of options. Maher’s first option purchase took place 

on May 2, 2014, and all of Maher’s options were sold or expired by February 19, 2016. (See 

Ex 27 at 13-3, pp. 1-6; ¶ 13.) Plaintiff Talukder purports to have purchased Yahoo securities 

between November 4, 2014 and August 26, 2016. (Ex. 28.) 

Plaintiffs seek to represent a class consisting of all those who purchased or otherwise 

acquired Yahoo common shares between April 30, 2013, and December 14, 2016 (the “Class 

Period”), and were damaged upon the revelation of the alleged corrective disclosures. (¶ 418.) 

B. Defendants 

1. Yahoo 

Defendant Yahoo! Inc. (“Yahoo”) was, throughout the Class Period, a Delaware 

corporation headquartered in Sunnyvale, California. Yahoo provided a variety of internet search, 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 12 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 4

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

communication, and entertainment services to users around the world. (¶ 19.) Its most valuable 

assets, however, were not its operating business, but rather its significant equity stakes in the 

Chinese internet company Alibaba Group Holdings Limited (“Alibaba”) and the Japanese internet 

company Yahoo Japan Corporation (collectively, the “Asian Equity Investments”). (Ex. 14 at 

Annex 1-1, the “Proxy”.) 

On July 25, 2016, Yahoo announced that it had entered into an agreement to sell its 

operating business to Verizon Communications, Inc. (“Verizon”), leaving Yahoo as an 

investment company holding the Asian Equity Investments (the “Sale Transaction”). (¶ 359.) 

The Sale Transaction closed on June 13, 2017, whereupon which Yahoo renamed itself Altaba 

Inc. (Ex. 15.) 

Throughout the Class Period, Yahoo’s stock traded on the NASDAQ. Yahoo’s stock 

price increased from $24.73 per share on the first day of the Class Period to $40.91 per share on 

the final day of the Class Period.2

 During the 90-day period following Plaintiffs’ final alleged 

corrective disclosure, see 15 U.S.C. § 78u-4(e), Yahoo’s stock price increased from $41.23 per 

share on January 6, 2017, to $46.23 per share on April 4, 2017. 

2. The Individual Defendants 

Defendant Marissa A. Mayer served as CEO of Yahoo for the entire Class Period and 

remained CEO until the Sale Transaction closed. (¶ 15.) Defendant Ronald S. Bell served as 

General Counsel and Secretary of Yahoo from August 13, 2012, until March 1, 2017. (¶ 16.) 

Defendant Alexander Stamos served as Yahoo’s CISO from March 10, 2014, to approximately 

June 30, 2015, when he left Yahoo to join Facebook. (¶ 17.) 

II. FACTUAL BACKGROUND 

The facts set out below are derived from the SAC, the documents cited in and 

incorporated by reference into the SAC, and other judicially noticeable documents. See Request 

for Judicial Notice. 

 

2

 Yahoo’s stock prices during the Class Period are charted in the Lobdell Declaration, Ex. 16. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 13 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 5

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

A. The 2014 Security Incident 

Beginning in 2014, FSB officers directed hackers to gain unauthorized access to the 

networks of companies providing internet-related services and to steal user information from 

those networks. (Ex. 173 at ¶ 1.) Yahoo was one of the targeted companies. (Id. at ¶ 2.) 

In October 2014, the hackers attempted to obtain user account information by attacking 

Yahoo’s Account Management Tool (“AMT”), which they used to access user account 

information of twenty-six specifically targeted users. (¶ 204; Ex.17 at ¶ 26.) Following 

discovery of the AMT hack, Yahoo consulted with law enforcement and notified the twenty-six 

targeted users. (¶ 204.) 

In November and December 2014, these hackers broadened their attack by seeking to steal 

user information stored in Yahoo’s user database (“UDB”). (Ex. 17 at ¶ 25.) The information 

stored in the UDB included account user names, phone numbers, and certain security information 

tied to user accounts. (Id. at ¶ 22.) The hackers were eventually able to steal files from a backup 

copy of the UDB and exfiltrate (that is, transfer off of Yahoo’s network) the UDB backup files to 

computers under their control. (Id. at ¶ 25.) The first incident of data exfiltration allegedly 

occurred on November 10, 2014. (¶ 142.) Combining control of the stolen UDB files with access 

to the AMT, the hackers could search the UDB files and identify specific accounts of interest to 

the FSB. (Ex. 17 at ¶¶ 33-34.) Yahoo later determined that the exfiltrated UDB backup files 

contained certain user account information for at least 500 million users. The exfiltrated data did 

not include user payment card data or bank account information. (¶ 185.) 

On July 25, 2016, Yahoo and Verizon publicly announced the Sale Transaction, subject to 

approval by Yahoo’s shareholders. Shortly thereafter, Yahoo learned of posts on the “dark web” 

offering to sell Yahoo user credential data. (¶ 169.) After investigating with an outside forensic 

 

3

 Plaintiffs’ allegations reference the Justice Department’s March 2017 criminal indictment at 

length throughout the SAC. (E.g., ¶¶ 109-22.) Plaintiffs’ express reliance on allegations in the 

indictment results in the contents of the indictment being incorporated by reference into the SAC 

as if fully set forth therein. See Tellabs, Inc. v. Makor Issues & Rights Ltd., 551 U.S. 308, 322 

(2007); In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1051 (9th Cir. 2014); In re Stac Elecs. 

Sec. Litig., 89 F.3d 1399, 1405 n.4 (9th Cir. 1996). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 14 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 6

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

expert, the Company could not substantiate the claims.4 (¶ 203.) 

Following the investigation, Yahoo intensified an ongoing broader review of the 

Company’s network and data security. (Id.) On September 22, 2016, based on its review and 

further investigation by outside forensic experts, Yahoo disclosed that a copy of certain user 

account information for at least 500 million user accounts was stolen from Yahoo’s network in 

late 2014. (Id. ¶¶ 185, 371; Ex. 19.) 

Following Yahoo’s disclosure of the 2014 Security Incident, Verizon and Yahoo 

discussed the potential impact of the 2014 Security Incident on Yahoo’s operating business. 

(Ex. 14 at 56.) On November 8, 2016, representatives of Yahoo and Verizon reached a 

preliminary understanding whereby the Sale Transaction would proceed with no price reduction 

and the two companies would split certain liabilities arising out of the 2014 Security Incident. 

(Id. at 57.) 

On November 9, 2016, Yahoo disclosed that its Board had formed an Independent 

Committee to investigate, among other things, the scope of knowledge within the Company 

regarding the 2014 Security Incident, the extent to which certain user account information had 

been accessed, and other issues related to the Company’s data security measures. (¶ 203.) 

On March 1, 2017, Yahoo filed its FY 2016 Form 10-K, which provided a summary of the 

conclusions of the Independent Committee’s investigation:5

 “[T]he Company’s information security team had contemporaneous knowledge of the 2014 

compromise of user accounts.” (¶ 204.) 

 In late 2014, senior executives and relevant legal staff were aware that a state-sponsored 

actor had accessed twenty-six user accounts by exploiting the Company’s AMT. (¶ 204.) 

 “[A]s of December 2014, the information security team understood that the attacker had 

exfiltrated copies of user database backup files containing the personal data of Yahoo users 

but it is unclear whether and to what extent such evidence of exfiltration was effectively 

communicated and understood outside the information security team.” (¶ 204.) 

 

4

 According to the Motherboard article cited by Plaintiffs (¶ 171), the hacker responsible for the 

dark web advertisement stated that the records were “from 2012 most likely.” (Ex. 18.) 

5

 In the same filing, Yahoo also disclosed that, based on additional technical investigation, the 

Company believed that approximately 32 million user accounts had been the victim of a “cookie 

forging” attack by the same Russian government-sponsored hackers. (Ex. 20 at 45.) 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 15 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 7

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 The “relevant legal team had sufficient information to warrant substantial further inquiry in 

2014, and they did not sufficiently pursue” the issue. (Ex. 20 at 47.) 

 Yahoo’s Board and Audit Committee “were not adequately informed of the full severity, 

risks, and potential impacts of the 2014 Security Incident and related matters.” (Id. at 47.) 

 There was no finding of “an intentional suppression of relevant information.” (Id. at 47.) 

The SAC disputes certain of these conclusions and alleges that “all material facts” 

concerning the 2014 Security Incident were reported to members of Yahoo’s senior management 

throughout late 2014 and 2015. (¶¶ 147-51.) The SAC also alleges that Mr. Stamos and his 

colleague, Ramses Martinez, told Yahoo’s Audit and Finance Committee “everything they knew” 

about the 2014 Security Incident in April and June 2015. (¶¶ 152-63.) 

B. The 2013 Security Incident 

On November 9, 2016, Yahoo disclosed that its outside forensic experts were 

investigating new data files that were provided to Yahoo by law enforcement and were claimed 

by a third party to contain Yahoo user account data. (Ex. 21 at 40.) On December 2, 2016, 

Verizon advised Yahoo that it would defer completion of the Sale Transaction until Yahoo had 

made further progress in the investigation of these data files. (Ex. 14 at 57.) 

On December 14, 2016, Yahoo disclosed its belief, based on analysis of the data files, that 

an unauthorized party had exfiltrated data associated with more than one billion user accounts in 

August 2013 (i.e., the 2013 Security Incident). (¶ 102.) Despite its investigation, Yahoo was 

unable to identify the source of the intrusion in the 2013 Security Incident, but did conclude that 

the 2013 Security Incident was likely distinct from the 2014 Security Incident. (¶ 408.) 

On February 20, 2017, Yahoo and Verizon executed a series of amendments to the Sale 

Transaction Agreement that provided, among other things, that: (1) the purchase price contained 

in the original Sale Transaction Agreement would be reduced by $350 million to $4.475 billion; 

(2) Verizon would release certain claims related to the Security Incidents; and (3) Yahoo and 

Verizon would split responsibility (50/50) for certain post-closing liabilities related to the 

Security Incidents. (Ex. 14 at 60, Exhibits A-2, C.) 

On October 3, 2017, Verizon announced that “[s]ubsequent to Yahoo’s acquisition by 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 16 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 8

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Verizon, and during integration, [Verizon] recently obtained new intelligence and now believes, 

following an investigation with the assistance of outside forensic experts, that all Yahoo user 

accounts were affected by the August 2013 theft,” i.e., the 2013 Security Incident. (Ex. 22.) 

C. Plaintiffs’ Allegations of False and Misleading Statements 

Plaintiffs assert securities fraud claims against all Defendants under Section 10(b), and 

control-person claims against Ms. Mayer, Mr. Bell, and Mr. Stamos under Section 20(a). Much 

of the SAC is based on the allegation that Yahoo’s cybersecurity defenses were inadequate and 

that these alleged inadequacies and the Security Incidents were not contemporaneously disclosed. 

Plaintiffs also list approximately sixty-two statements made between April 30, 2013, and 

September 22, 2016, which they allege were misleading in light of the alleged cybersecurity 

inadequacies and the Security Incidents. (¶¶ 244-372.) For the Court’s convenience, the 

challenged statements are set out in the Chart of Statements Alleged To Be False or Misleading in 

the Second Amended Class Action Complaint, attached hereto as Appendix A (the “Statement 

Chart”). Plaintiffs allege that, starting on May 18, 2015, and continuing through January 5, 2017, 

the “truth” about the Security Incidents was “revealed” to the market through twenty alleged 

corrective disclosures. (¶¶ 373-412.) 

ARGUMENT 

I. PLAINTIFFS MUST SATISFY EXACTING PLEADING REQUIREMENTS 

TO SURVIVE A MOTION TO DISMISS. 

To survive a motion to dismiss, Plaintiffs must meet the pleading requirements of Rule 8, 

Rule 9(b), and the Reform Act with respect to each element of their securities fraud claims. First, 

the allegations must meet the plausibility standard of Rule 8. Bell Atl. Corp. v. Twombly, 550 U.S. 

544, 555 (2007). Under this standard, although factual allegations are assumed to be true, the 

Court must not indulge “unwarranted inferences.” Stac Elecs., 89 F.3d at 1403. Further, 

allegations that are conclusory or speculative should be disregarded. Ashcroft v. Iqbal, 556 U.S. 

662, 663 (2009); Twombly, 550 U.S. at 555. 

Second, Plaintiffs must also satisfy the requirements of Rule 9(b), which “requires 

particularity as to the circumstances of the fraud,” including the “time, place, persons, statements 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 17 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 9

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

made, [and] explanation of why or how such statements are false or misleading.” In re GlenFed, 

Inc. Sec. Litig., 42 F.3d 1541, 1547 n.7 (9th Cir. 1994). 

Third, Plaintiffs must satisfy the “exacting pleading requirements” imposed by the Reform 

Act, which requires a plaintiff to plead falsity, scienter, and loss causation “with particularity.” 

Tellabs, 551 U.S. at 313; 15 U.S.C. § 78u-4(b)(1)-(2); Zucco Partners, LLC v. Digimarc Corp., 

552 F.3d 981 (9th Cir. 2009); Or. Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 605 

(9th Cir. 2014). “The purpose of this heightened pleading requirement was generally to eliminate 

abusive securities litigation and particularly to put an end to the practice of pleading fraud by 

hindsight.” In re Vantive Corp. Sec. Litig., 283 F.3d 1079, 1084-85 (9th Cir. 2002). 

II. PLAINTIFFS’ SECTION 10(b) CLAIM SHOULD BE DISMISSED. 

To state a claim under Section 10(b) of the Exchange Act, a complaint must allege facts 

sufficient to establish (1) that the defendant made a materially false or misleading statement; (2) 

that the defendant did so with scienter; (3) that the statement was made in connection with the 

purchase or sale of a security; (4) that the plaintiff relied upon the statement; (5) that the fraud 

caused the plaintiff economic loss; and (6) that the plaintiff is entitled to recover damages. Loos v. 

Immersion Corp., 762 F.3d 880, 886-87 (9th Cir. 2014); Livid Holdings Ltd. v. Salomon Smith 

Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The SAC fails to plead these elements. 

A. Plaintiffs’ Mismanagement Allegations Fail to State a Section 10(b) 

Claim. 

Much of the SAC is devoted to allegations that the Individual Defendants and others 

mismanaged Yahoo by “refus[ing] to invest” in data security and by employing “outdated,” 

“substandard,” “poor,” “broken and unsuitable” security measures. (E.g., ¶¶ 2, 62-95.) This 

theory fails to state a Section 10(b) claim. 

The Supreme Court has repeatedly held that “Congress by [enacting] § 10(b) did not seek 

to regulate [conduct] which constitute[s] no more than internal corporate mismanagement.” 

Santa Fe Indus., 430 U.S. at 479-80. Allegations that the Defendants should have done more to 

secure the Company’s networks are simply allegations “of fiduciary misconduct and internal 

mismanagement,” which are not “sufficient to trigger liability under the Exchange Act.” In re 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 18 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 10

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Silicon Storage Tech., 2006 U.S. Dist. LEXIS 14790, at *66 (N.D. Cal. Mar. 10, 2006); see also 

Gaines v. Haughton, 645 F.2d 761, 779 n.33 (9th Cir. 1981) (federal securities laws do not 

provide a cause of action for corporate mismanagement). 

At most, the SAC’s allegations show that, like many technology companies, Yahoo was 

under constant attack from cybercriminals who were, on occasion, successful.6 (¶ 85.) That is 

why, as discussed in more detail below, Yahoo warned of the risk of cyberattacks and informed 

investors that “[s]ecurity breaches or unauthorized access have resulted in and may in the future 

result in a combination of significant legal and financial exposure.”7 (See, e.g., ¶ 308 (emphasis 

added).) 

B. Plaintiffs’ Omission Theory Fails to State a Section 10(b) Claim. 

Plaintiffs also assert that Defendants engaged in securities fraud through a “brazen failure 

to disclose” the Security Incidents. (¶ 2; see generally ¶¶ 36-61.) It is black letter law, however, 

that a plaintiff cannot state a Section 10(b) claim by alleging that a defendant simply omitted 

material information. Brody v. Transitional Hosps. Corp., 280 F.3d 997, 1006 (9th Cir. 2002). 

“[A]bsent a duty to disclose, an omission does not give rise to a cause of action under § 10(b) and 

Rule 10b-5.” Retail Wholesale & Dep’t Store Union Local 338 Ret. Fund v. Hewlett-Packard 

Co., 845 F.3d 1268, 1278 (9th Cir. 2017) (citing Basic Inc. v. Levinson, 485 U.S. 224, 239 n.17 

(1988)); Matrixx, 563 U.S. at 43-46. Under these principles, a plaintiff can state an omissions 

claim under Section 10(b) only where disclosure is “necessary ‘to make . . . statements made . . . 

not misleading,’” Matrixx, 563 U.S. at 44, or in particular circumstances (absent here) where a 

“relationship of trust and confidence between parties to a transaction” requires disclosure of the 

information. Chiarella v. U.S., 445 U.S. 222, 230 (1980). 

Plaintiffs assert that Yahoo was under a duty to disclose the Security Incidents by virtue of 

 

6

 Plaintiffs’ allegations related to Yahoo Japan (¶ 83) in May 2013 are irrelevant to this action. 

Yahoo Japan is an entirely separate company from Yahoo—it was not part of the SPA and 

remains publicly traded on the Tokyo Stock Exchange. 

7

 Moreover, in many instances, the SAC acknowledges that attacks on Yahoo’s networks were 

publicly disclosed. Plaintiffs concede that Yahoo publicly discussed with the popular media a 

July 2012 security incident (¶¶ 67-72). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 19 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 11

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

guidance released by the staff of the SEC’s Corporation Finance Division regarding disclosures 

relating to cybersecurity risks and incidents. (¶ 40.) That is incorrect. The guidance Plaintiffs 

cite is largely an interpretation of Regulation S-K. (Ex. 23 at 1, n.4-8.) Regulation S-K, however, 

does not give rise to a private right of action for failure to disclose under Section 10(b). NVIDIA, 

768 F.3d at 1054-56. A fortiori, staff guidance concerning the regulation does not do so.8 

Plaintiffs also assert that state law requirements to notify users of data breaches created a 

duty to disclose under Section 10(b). (¶ 36.) Plaintiffs, however, have not pled facts that show 

any state law violation. Their allegations in this regard are entirely conclusory (see id.) and 

should, therefore, be disregarded. In any event, allegations of state law violations do not state a 

private right of action under Section 10(b). Plaintiffs cannot simply point to notification 

obligations owed to individual consumers and attempt to “dress them up as federal securities 

violations by including phrases such as ‘Defendants failed to disclose.’” In re Union Expl. 

Partners Sec. Litig., 1992 U.S. Dist. LEXIS 9013, at *10 (C.D. Cal. June 18, 1992) (rejecting 

claim based on alleged violation of duties under state law). Rather, a “duty to disclose must be 

separately shown according to the principles set forth by the Supreme Court in Basic and Matrixx 

Initiatives.” NVIDIA, 768 F.3d at 1056. 

Plaintiffs cite Yahoo’s policies relating to disclosing software “security vulnerabilities” on 

its security-focused Tumblr page (¶¶ 44-45) and Yahoo’s user-facing notification policy relating 

to account targeting by state-sponsored actors (¶ 39), asserting that they create an actionable duty 

under Section 10(b). They do not. Yahoo’s security vulnerability disclosure policy was not 

directed to investors. (Ex. 24.) Rather, it was designed to disclose vulnerabilities to “peers in the 

Internet community who may also be affected by” security vulnerabilities in “software that Yahoo 

ha[d] written [and] in the common open-source and commercial products that [Yahoo] use[d] on 

[its] network.” (Id.) Similarly, Yahoo’s user notification policy said nothing about disclosure to 

investors, but rather states that Yahoo will notify an individual user—not the public—if the 

 

8

 Plaintiffs also allege that SEC Form 8-K imposes a duty to disclose all material events. (¶ 42.) 

Form 8-K contains no such requirement. See SEC Form 8-K, available at 

https://www.sec.gov/files/form8-k.pdf. In any event, as stated above, violations of SEC rules do 

not give rise to a private right of action under Section 10(b). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 20 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 12

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Company “strongly suspect[s] that [the user’s] account may have been targeted by a statesponsored actor.” (¶ 39; Ex. 25.) In fact, the discussion of this policy expressly stated that “[i]n 

order to prevent the actors from learning our detection methods, we do not share any details 

publicly about these attacks.” (Ex. 25 (emphasis added).) 

Allowing investors to enforce state consumer notification laws and consumer-directed 

company policies in a private securities fraud class action would be an unprecedented and 

impermissible expansion of the implied private right of action under Section 10(b), well beyond 

the boundaries established by Congress. Cf. Stoneridge Inv. Partners v. Scientific-Atlanta, 552 

U.S. 148, 165 (2008) (courts may not extend the implied right of action under Section 10(b) 

beyond its current reach). 

C. Plaintiffs Fail to Plead False or Misleading Statements. 

1. Plaintiffs do not show how Yahoo’s statements were rendered 

false or misleading by the Security Incidents. 

Plaintiffs identify the statements they challenge as false or misleading in paragraphs 

243-372 of the SAC. None of Plaintiffs’ challenged statements—each of which is set out in the 

Statement Chart—is actionable under Section 10(b), for the reasons set out below. 

To plead falsity under the Reform Act, a plaintiff must “specify each statement alleged to 

have been misleading [and] the reason or reasons why the statement is misleading.” Metzler Inv. 

GmbH v. Corinthian Colls., 540 F.3d 1049, 1061 (9th Cir. 2008) (quoting 15 U.S.C. 

§ 78u-4(b)(1)). Further, a plaintiff must plead “contemporaneous statements or conditions” 

showing the “misleading nature of the statements when made.” Ronconi v. Larkin, 253 F.3d 423, 

432 (9th Cir. 2001). 

As discussed above, a plaintiff cannot meet this burden merely by identifying information 

omitted from a challenged statement and claiming the omission rendered the statement 

incomplete. “As long as the omissions do not make the actual statements misleading, a company 

is not required to disclose [the omitted information] . . . even if investors would consider the 

omitted information significant.” In re Rigel Pharm., Inc. Sec. Litig., 697 F.3d 869, 880 n.8 (9th 

Cir. 2012); see Hewlett-Packard, 845 F.3d at 1278; Brody, 280 F.3d at 1006; NVIDIA, 768 F.3d 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 21 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 13

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

at 1054. Pleading falsity thus requires alleging “contemporaneous statements or conditions” that 

are “necessarily inconsistent” with a challenged statement. In re Read-Rite Corp., 335 F.3d 843, 

846, 848 (9th Cir. 2003) (emphasis added); accord Brody, 280 F.3d at 1006; Ronconi, 253 F.3d at 

432 (rejecting an allegation that a statement was misleading at the time made when a certain fact 

was not necessarily inconsistent with the defendant’s statement); see Vantive, 283 F.3d at 1089 

(interpreting Ronconi). Plaintiffs fail to meet this burden for any of the challenged statements. 

a. Statements of policy and commitment 

Many of the statements Plaintiffs attack set out Yahoo’s general commitment to its users’ 

privacy and security. For example: “we take the security of our users very seriously” (¶ 254; 

Stmt. No. 5), and “Yahoo is committed to gaining your trust” (¶¶ 345, 364; Stmt. Nos. 49, 58). 

Additional statements in this category are set out in the Statement Chart under Tab A.9 

The fact that Yahoo was the victim of a security breach sponsored by Russian intelligence 

agents is not “necessarily inconsistent” with the Company taking “the security of [its] users very 

seriously.” And the statement that “Yahoo is committed to gaining your trust” did not signify that 

Yahoo never experienced security incidents.10 See Hewlett-Packard, 845 F.3d at 1276 (rejecting 

allegations challenging ethics policy). As courts analyzing similar claims have found, “[t]he fact 

that a company has suffered a security breach does not demonstrate that the company did not 

‘place significant emphasis on maintaining a high level of security.’” In re Heartland Payment 

Sys., Inc. Sec. Litig., 2009 U.S. Dist. LEXIS 114866, at *14-19 (D.N.J. Dec. 7, 2009). 

Similar allegations were rejected in Hewlett-Packard. There, the plaintiffs challenged 

statements by HP and its CEO touting HP’s corporate code of conduct (the “SBC”), alleging that 

the statements were misleading because the CEO failed to disclose that he was violating the code. 

Hewlett-Packard, 845 F.3d at 1275-78. The Ninth Circuit affirmed dismissal on the ground that 

the “promotion of ethical conduct at HP did not reasonably suggest that there would be no 

violations of the SBC by the CEO or anyone else.” Id. at 1278. These statements did not, 

 

9

 Stmt. Nos. 1, 4, 5, 7-9, 13-16, 18-24, 26-32, 34, 36-40, 42, 44, 46-47, 49-51, 53-54, 58-60. 

10 In fact, the risk of security breaches is one that Yahoo specifically disclosed in SEC filings that 

Plaintiffs reference in the SAC. (See, e.g., ¶¶ 268, 313.) 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 22 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 14

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

therefore, “affirmatively create an impression of a state of affairs that differs in a material way 

from the one that actually exists.” Id. at 1278. 

The claims here are significantly weaker than those in Hewlett-Packard, including 

because Yahoo consistently warned throughout the Class Period that the Company “may be 

unable to anticipate [hacking] techniques or implement adequate preventative measures” and that 

“[s]ecurity breaches or unauthorized access have resulted in and may in the future result in a 

combination of significant legal and financial exposure.” (See, e.g., ¶¶ 268, 313; Stmt. Nos. 11, 

35 (emphasis added).) 

Plaintiffs also repeatedly argue that Defendants deceived investors by stating Yahoo had 

“physical, electronic, and procedural safeguards that comply with federal regulations to protect 

personal information” about users. (¶¶ 2, 5, 22, 244, 302, 345, 364; see also ¶¶ 347, 366; Stmt. 

Nos. 1, 29, 49, 51, 58, 60.) But the SAC does not identify any federal regulation on these topics 

that Yahoo allegedly violated; much less plead particularized facts showing such a violation. 

Indeed, the only specific security deficiency alleged in the SAC is that Yahoo employed 

MD5 encryption in 2013. (¶ 86.) But the documents the SAC relies upon state that Yahoo 

discontinued use of MD5 “[i]n the summer of 2013,” shortly after the start of the Class Period. 

(Ex. 26.) Plaintiffs do not allege that MD5 violated “federal regulations,” nor that Yahoo misled 

investors with respect to its use of MD5 in the four challenged statements made before use of this 

encryption method was discontinued. (Stmt. Nos. 1-4.)

b. Statements about unrelated cybersecurity topics 

Plaintiffs also challenge statements addressing cybersecurity issues with no apparent 

connection to the Security Incidents. (See Statement Chart at Tab B.11) For example, Plaintiffs 

claim that Defendants misled investors by stating that: 

 “We successfully block the vast majority of malicious or deceptive advertisements with 

which bad actors attack our network, and we always strive to defeat those who would 

compromise our customers’ security.” (¶ 286; Stmt. No. 20 (emphasis added).) 

 “[S]omething that works really well for [Yahoo] is that the leaders of all our business units 

have a real-time dashboard to see how many bugs are han[g]ing over them and our CEO 

 

11 Stmt. Nos. 5, 7, 10, 13, 15-16, 20-21, 23, 26-27, 30-31, 34, 36-37, 39, 42, 44-45, 50-51, 54, 

58-60. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 23 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 15

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

every week confronts that number.” (¶ 298; Stmt. No. 27.) 

 “[W]e continue to protect our mail users with new investments in spam and phishing 

detection.” (¶ 329; Stmt. No. 42.) 

Plaintiffs plead no facts showing that any of these statements was necessarily inconsistent 

with the unrelated Security Incidents. (Ex. 17 at ¶¶ 21-23 (explaining technical methods of 

access).) Juxtaposing the Security Incidents with these unrelated issues does not plead falsity. 

See, e.g., Bonato v. Yahoo Inc., 2012 U.S. Dist. LEXIS 113036, at *30-34 (N.D. Cal. Aug. 10, 

2012) (rejecting claim that a disclosure relating to value of one business group created duty to 

disclose value of an unrelated business group), aff’d, Pension Trust Fund for Operating Eng’rs v. 

Yahoo! Inc., 611 Fed. App’x 387 (9th Cir. Cal. 2015); Heartland, 2009 U.S. Dist. LEXIS 114866, 

at *16-17 (finding that “general observations concerning trends in encryption standards . . . [and] 

adopt[ion] [of] new technology” had “nothing to do with” the cyberattack underlying plaintiffs’ 

securities fraud claim). 

Plaintiffs cannot establish falsity through conclusory allegations that Yahoo’s 

“information security protocols were inadequate” or that Yahoo failed to utilize an “up-to-date 

and secure encryption scheme.” (¶ 243.) These allegations do not conflict with Yahoo’s 

statements, which accurately discuss specific improvements to the Company’s network and 

information security systems. See Heartland, 2009 U.S. Dist. LEXIS 114866, at *17-19 

(descriptions of how company’s security systems function do not imply that company “had never 

experienced any security problems”). Aside from Plaintiffs’ concession that Yahoo discontinued 

use of MD5 in the summer of 2013 (¶ 86; Ex. 26), the SAC pleads no facts relating these 

statements to the methods Yahoo used to encrypt user account information in its user database or 

to the Security Incidents. Nor does the SAC plead any facts showing that Yahoo’s efforts to 

combat spam and scams were not industry-leading at the time. Further, statements concerning 

Yahoo’s ongoing efforts to improve security (e.g. “currently working to bring all Yahoo sites up 

to this standard”; “work hard to deploy the best possible technology”; “encouraging our partners 

to ensure that any data running on our network is secure, and improving the security of the 

overall web ecosystem”) are also not contradicted by the SAC’s allegations. (Stmt. Nos. 13, 14, 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 24 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 16

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

24 (emphasis added).) 

Plaintiffs’ claims all boil down to the argument that, by discussing issues under the 

umbrella of cybersecurity, Yahoo thereby imposed a duty upon itself to disclose everything under 

that umbrella, including the Security Incidents. That is not the law. “[A] company is not required 

to disclose every safety-related [issue], even if the company discloses some safety-related [issues] 

and even if investors would consider the omitted information significant.” Rigel Pharm., 697 

F.3d at 880 n.8. 

c. Statements about cybersecurity risks 

Plaintiffs also challenge fourteen statements that appear in Yahoo’s SEC filings as “Risk 

Factors.” (See Statement Chart at Tab C.12) Plaintiffs do not explain, however, how these 

warnings were false or misleading. 

As with any statement, a risk factor warning does not give rise to Section 10(b) liability 

merely because it is incomplete; rather, the warning itself must “create an impression of a state of 

affairs that differs in a material way from the one that actually exists.” Brody, 280 F.3d at 1006; 

accord Rigel Pharm., 697 F.3d at 880 n.8; Bien v. LifeLock Inc., 2015 WL 12819154, at *8-10 

(D. Ariz. July 21, 2015). 

Yahoo’s Risk Factors explained: 

If our security measures are breached, our products and services may be perceived 

as not being secure, users and customers may curtail or stop using our products 

and services, and we may incur significant legal and financial exposure. . . . 

Security breaches or unauthorized access have resulted in and may in the 

future result in a combination of significant legal and financial exposure, 

increased remediation and other costs, damage to our reputation and a loss of 

confidence in the security of our products, services and networks that could have 

an adverse effect on our business. 

(¶ 268; Stmt. No. 11 (emphasis added).) Plaintiffs allege that Yahoo’s risk factor warnings, while 

undeniably accurate, triggered a duty under Section 10(b) to disclose more. As explained above, 

however, the private right of action under Section 10(b) does not impose a duty of 

completeness—with respect to risk factor warnings or otherwise. Rigel Pharm., 697 F.3d at 880 

n.8; Brody, 280 F.3d at 1006; Bien, 2015 WL 12819154, at *10. In Rigel, the Ninth Circuit 

 

12 Stmt. Nos. 2-3, 6, 11, 17, 25, 33, 35, 41, 43, 48, 52, 55, 57. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 25 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 17

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

affirmed dismissal, explaining that “a company is not required to disclose every safety-related 

result . . . even if the company discloses some safety-related results and even if investors would 

consider the omitted information significant.” Rigel Pharm., 697 F.3d at at 881 n.8. 

Plaintiffs have identified nothing in Yahoo’s risk factor warnings that was necessarily 

inconsistent with the Security Incidents. The warnings do not, therefore, give rise to a Section 

10(b) claim.13 

d. Representations in the Stock Purchase Agreement 

On July 25, 2016, Yahoo announced the Sale Transaction and filed the 74-page Stock 

Purchase Agreement (the “SPA”) with Verizon as an exhibit to a Form 8-K.14 (¶ 359.) Plaintiffs 

challenge one paragraph of the SPA, which stated that there had “not been any incidents of . . . 

Security Breaches, unauthorized access or unauthorized use of any of Seller’s or the Business 

Subsidiaries’ information technology systems . . . that could reasonably be expected to have a 

Business Material Adverse Effect [an ‘MAE’].” (¶¶ 6, 216, 368, 417; Statement Chart at Tab D, 

Stmt. Nos. 56, 61.) 

This statement is not actionable. The Proxy Statement and Form 8-K that attached the 

SPA explicitly stated that the representations and warranties were not intended to describe the 

actual state of affairs at Yahoo, but rather were intended only to allocate risk between the parties 

to the Agreement: 

These representations and warranties were made solely for the benefit of the other 

party to each such Sale Transaction Agreement and (i) are not intended to be 

treated as categorical statements of fact, but rather as a way of allocating risk to 

one of the parties if those statements prove to be inaccurate, (ii) may have been 

qualified in the Sale Transaction Agreements by confidential disclosure schedules 

that were delivered to the other party . . . , (iii) may be subject to standards of 

materiality applicable to the parties that differ from what might be viewed as 

material to stockholders, and (iv) were made only as of the date of the applicable 

 

13 District courts within the Ninth Circuit have frequently rejected claims such as these based on 

risk factor warnings. See, e.g., In re Foundry Networks, Inc. Secs. Litig., 2002 U.S. Dist. LEXIS 

28070, at *23 (N.D. Cal. June 6, 2002) (Plaintiffs “cannot state a claim based on the disclosure of 

risk factors”) (citing Zeid v. Kimberley, 930 F. Supp. 431, 437 (N.D. Cal. 1996)); In re LeapFrog 

Enters., Inc. Sec. Litig., 527 F. Supp. 2d 1033, 1048-49 (N.D. Cal. 2007). 

14 The SPA was also attached to Yahoo’s Preliminary Proxy filed on September 9, 2016. (¶¶ 6, 

216, 368; Ex. 13.) 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 26 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 18

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Sale Transaction Agreement. . . . Accordingly, you should not rely on the 

representations, warranties, and covenants or any descriptions thereof as 

characterizations of the actual state of facts or condition of Yahoo or Verizon. 

(Ex. 12 at 3 (“Additional Information”) (emphasis added); Ex. 14 at 68 (emphasis added).) 

Plaintiffs offer no explanation for how, given this specific instruction not to do so, any reasonable 

investor could rely on this statement as “the actual state of facts or condition of Yahoo.”15

Moreover, the SAC does not plead that this contractual allocation-of-risk provision was 

false. Plaintiff pleads no facts regarding the financial or business effect of the Security Incidents 

as of July 2016, let alone facts showing that the Security Incidents met the MAE threshold. 

Additionally, this statement cannot form the basis of a securities fraud claim because no 

Plaintiff, in fact, relied upon it. As discussed in Section II.E below, neither Lead Plaintiff 

purchased Yahoo securities after the SPA was filed. See Hanon v. Dataproducts Corp., 976 F.2d 

497, 501 (9th Cir. 1992) (“We need not determine whether this statement is misleading because it 

was issued after [plaintiff] bought his stock and thus could not have affected his stock’s . . . 

market price or his decision to buy on that date.”).16

e. September 22, 2016 Press Release 

On September 22, 2016, Yahoo issued a press release, also filed with the SEC on Form 

8-K, disclosing that “a copy of certain user account information was stolen from the company’s 

network in late 2014 by what it believes is a state-sponsored actor” and that Yahoo believed “that 

information associated with at least 500 million user accounts was stolen.” Yahoo recommended 

that “users who haven’t changed their passwords since 2014 do so.” (¶ 185; Stmt. No. 62.) The 

SAC alleges that this press release was misleading because it (i) suggested that “data exfiltration 

was only discovered through a ‘recent’ investigation”; (ii) stated that the stolen account 

information “may have included names, email addresses, telephone numbers, dates of birth, 

 

15 The allegations here, thus, differ from those in Glazer Capital Management, LP v. Magistri, 

549 F.3d 736, 741 (9th Cir. 2008), where the court rejected the argument that representations in a 

publicly filed merger agreement could never give rise to Section 10(b) liability. Here, unlike in 

Glazer, Yahoo explicitly advised investors that they should not rely on the terms of the SPA as a 

statement of fact regarding the condition of the Company. 

16 The same is true of Statement No. 62 made on September 22, 2016. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 27 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 19

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

hashed passwords” when this information “had in fact been stolen”; and (iii) “failed to disclose 

that the Company knew that the Russian hackers had been minting cookies.” (¶¶ 186-89.) These 

allegations fail to support a securities fraud claim. 

First, the fact that Yahoo “confirmed” data exfiltration through a “recent investigation” 

does not signify that Yahoo was unaware of the intrusion prior to this time.17 Second, the 

statement that the stolen account information “may have included” specific data was true, and 

there are no allegations that “names, email addresses, telephone numbers, dates of birth, hashed 

passwords” were stolen for each of the 500 million accounts affected by the Security Incident. 

Third, Plaintiffs have alleged no facts showing that the fact that “the Russian hackers had been 

minting cookies” was material to investors, much less explaining how the purported omission of 

this information rendered the press release false and misleading. Indeed, Plaintiffs concede that 

this information was disclosed in Yahoo’s next filing with the SEC, on November 9, 2016, but do 

not allege that this disclosure was “corrective.” (¶ 180 n.54.) 

2. Challenged statements that are not “objectively verifiable” are 

not actionable. 

Most of the statements addressed above are not actionable for the additional reason that 

they are not “objectively verifiable.” The Ninth Circuit has repeatedly held that such 

statements—which may be described as “corporate optimism,” “puffery,” “vague,” or 

“aspirational”—are not actionable because reasonable investors do not rely upon them. See, e.g., 

Hewlett-Packard, 845 F.3d at 1276; Apollo, 774 F.3d at 606; In re Cutera Sec. Litig., 610 F.3d 

1103, 1111 (9th Cir. 2010). 

Corporate Optimism (Statement Chart Tab E): Plaintiffs challenge twenty-four 

statements of corporate optimism, such as “Yahoo! takes your privacy seriously” (¶ 302, Stmt. 

No. 29), “we’ve had our users’ back when it comes to security and transparency” (¶ 290, Stmt. 

No. 23), or Ms. Mayer’s comment during the Q2 2015 earnings call that “we took an industryleading step towards a password-free future with the announcement of Yahoo! Account Key . . . 

 

17 Importantly, Plaintiffs do not identify any disclosure correcting this “misstatement” or any 

“loss” caused by corrective disclosures on this point. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 28 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 20

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

to provide a fast, convenient, and secure way to access your Yahoo! accounts” (¶ 336; Stmt. No. 

45). (See Statement Chart at Tab E.) Such statements are not actionable. Cutera, 610 F.3d at 

1111; LeapFrog, 527 F. Supp. 2d at 1049-50 (dismissing claims based on optimistic statements 

about financial performance, consumer demand, and strengthening of company systems and 

functions). 

Vague (Statement Chart Tab F): Additionally, thirteen challenged statements are 

“vague and provide[] nothing concrete upon which a plaintiff could reasonably rely.” Apollo, 774 

F.3d at 606-07; see Statement Chart at Tab F. For example: “We’ve worked hard over the years 

to earn our users’ trust and we fight hard to preserve it . . . There is nothing more important to us 

than protecting our users’ privacy,” “I have a real sense, and everyone in the legal department 

thinks that our main job is to protect our users. We have to stand up for them, because if we 

don’t, nobody else is in a position to do that.” (¶¶ 260, 271; Stmt. Nos. 7, 12). The challenges to 

these statements also fail as a matter of law. Cutera, 610 F.3d at 1111; Brodsky v. Yahoo! Inc., 

592 F. Supp. 2d 1192, 1200 (N.D. Cal. 2008) (quoting Glen Holly Ent., Inc. v. Tektronix, Inc.,

352 F.3d 367, 379 (9th Cir. 2003) (“generalized, vague and unspecific assertions” are not 

actionable)). 

Aspirational (Statement Chart Tab G): Plaintiffs challenge twenty-two statements 

reflecting Yahoo’s aspirational data security policy goals and commitments. For example, “[a]t 

Yahoo, our users’ security is paramount, and we continue to update our policies and practices to 

keep our users’ accounts and data secure,” or Ms. Mayer’s comment that Yahoo! Account Key 

“also makes it significantly easier to protect our users’ accounts going forward.” (¶¶ 311; Stmt. 

No. 34; see Statement Chart at Tab G.) As above, this type of statement cannot form the basis of 

a securities fraud claim under Section 10(b) and Rule 10b-5. Hewlett-Packard, 845 F.3d at 1276. 

3. Statements not made in connection with the purchase or sale of 

securities are not actionable. 

Many of the statements Plaintiffs challenge (see Statement Chart at Tab H18) are not 

 

18 Stmt. Nos. 1, 4, 5, 9, 13-15, 23, 26-31, 34, 37-40, 44-45, 49-51, 54, 58-60. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 29 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 21

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

actionable for the additional reason that they were not made “in connection with” the purchase or 

sale of securities. To give rise to a Section 10(b) claim, a statement must be made “in a manner 

reasonably calculated to influence the investing public.” McGann v. Ernst & Young, 102 F.3d 

390, 397 (9th Cir. 1996). 

Statements to users in Yahoo’s customer-facing policies (e.g., Stmt. Nos. 30, 31, 51), to 

security professionals at data security conferences (Stmt. Nos. 26, 27), and in blog posts 

discussing terrorist attacks (Stmt. No. 53) were not made in such a manner. While misstatements 

in such contexts “might have some probative value in an action based on consumer protection 

laws, [] they have none in a case alleging investor fraud.” In re LifeLock, Inc., 690 Fed. App’x 

947, 954 (9th Cir. 2017). 

D. Plaintiffs Fail to Plead Particularized Facts Giving Rise to a “Strong 

Inference” of Scienter. 

Plaintiffs also fail to plead a “strong inference” of scienter—a “mental state embracing 

intent to deceive, manipulate, or defraud,” Ernst & Ernst, 425 U.S. at 193 n.12; Tellabs, 551 U.S. 

at 319, 322-23—as to any Defendant. The SAC should be dismissed for this independent reason. 

Scienter must be properly pled for each false or misleading statement. 15 U.S.C. 

§ 78u-4(b)(2)(B). Because a defendant can be held liable only for a statement he makes, a 

plaintiff must properly allege both who made the challenged statement and that the statementmaker acted (1) knowing that the statement was false at the time he made it, or (2) with 

“deliberate recklessness.” Zucco, 552 F.3d at 991 (citation omitted). 

A statement is attributable to a defendant only where the complaint presents facts showing 

that the particular defendant had “ultimate authority” over the “content of the statement” and over 

“whether and how to communicate it.” Janus Capital Grp., Inc. v. First Derivative Traders, 564 

U.S. 135, 142 (2011). To show that the statement-maker acted with deliberate recklessness, a 

plaintiff must plead facts showing a “danger of misleading buyers or sellers that [was] either 

known to the defendant or [was] so obvious that the actor must have been aware of it.” NVIDIA, 

768 F.3d at 1053 (quoting Hollinger v. Titan Capital Corp., 914 F.2d 1564, 1569 (9th Cir. 1990) 

(en banc)); see also Tellabs, 551 U.S. at 314. This standard is “actually much closer to one of 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 30 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 22

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

intent” and requires “intentional or conscious misconduct.” NVIDIA, 768 F.3d at 1053. 

Scienter allegations must be set out in “great detail,” In re Silicon Graphics, Inc. Sec. 

Litig., 183 F.3d 970, 974 (9th Cir. 1999), and must give rise to an inference of scienter that is both 

“cogent” and “at least as compelling as any opposing inference one could draw from the facts 

alleged.” Tellabs, 551 U.S. at 324. Dismissal is appropriate where, as here, the complaint fails to 

allege “specific contemporaneous statements or conditions that demonstrate the intentional or the 

deliberately reckless false or misleading nature of the statements when made.” Ronconi, 253 F.3d 

at 432; Metzler, 540 F.3d at 1066. 

The Ninth Circuit has set out a two-part approach for assessing allegations of scienter: 

first, the allegations of scienter are analyzed separately; second, the court will “conduct a holistic 

review” to determine whether all allegations in concert create a cogent and compelling inference 

of fraud. Zucco, 552 F.3d at 992. Under a “holistic” analysis, a court “must consider, not only 

inferences urged by the plaintiff, . . . but also competing inferences rationally drawn from the 

facts alleged. An inference of fraudulent intent may be plausible, yet less cogent than other, 

nonculpable explanations for the defendant’s conduct.” Tellabs, 551 U.S. at 314. 

As shown below, Plaintiffs’ allegations fail to give rise to a strong inference of scienter as 

to the Individual Defendants or Yahoo. 

1. The 2013 Security Incident 

Plaintiffs make no attempt to show that any Defendant was aware of the 2013 Security 

Incident before 2016. The Company discovered the 2013 Security Incident after analyzing data 

files provided to it by law enforcement in November 2016; and even with the benefit of that data, 

Yahoo could not identify the source of the intrusion for the 2013 Security Incident.19 (¶ 102.) 

Plaintiffs’ only allegations that the “Defendants knew about the 2013 Data Breach” before 

November 2016 are both, separately and together, insufficient to support Plaintiffs’ claims. First, 

the SAC cites unsourced assertions that a third party told “Yahoo,” through an unidentified 

intermediary, in August 2016 that a hacker group claimed to possess a Yahoo user database. 

 

19 As Mr. Stamos left Yahoo in 2015, he was no longer employed by Yahoo at this time. (¶ 91.) 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 31 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 23

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

(¶¶ 98, 101.) This is insufficient to show scienter for any Defendant even in August 2016, let 

alone in 2013. Plaintiffs plead no facts about who at Yahoo received this information, what 

information the unidentified intermediary provided to “Yahoo,” how (if at all) the information 

related to the 2013 Security Incident, or whether it bore any indicia of reliability. See Police Ret. 

Sys. of St. Louis v. Intuitive Surgical, Inc., 759 F.3d 1051, 1063 (9th Cir. 2014) (“[N]egative 

characterizations of reports relied on by insiders, without specific references to the contents of 

those reports, are insufficient to meet the heightened pleading requirements.”) (quoting Lipton v. 

Pathogenesis Corp., 284 F.3d 1027, 1035-36 (9th Cir. 2002)). 

Second, Plaintiffs assert that Defendants’ supposed awareness in 2014 and 2015 regarding 

the 2014 Security Incident was “sufficient to alert Defendants” that the user database for all three 

billion user accounts had been compromised in the 2013 Security Incident. (¶ 2, n.1.) Plaintiffs, 

however, plead no facts even suggesting a relationship between the two incidents. Quite the 

contrary. Plaintiffs allege that as of December 2016, after an investigation, the Company 

concluded that the 2013 Security Incident was likely distinct from the 2014 Security Incident. 

(¶¶ 102, 408.) 

The absence of allegations establishing that any Defendant was even aware of the 2013 

Security Incident before November 2016 is fatal to Plaintiffs’ claims on this topic. 

2. The 2014 Security Incident 

The SAC alleges that “all material facts” about Yahoo’s information security team’s 

efforts to investigate and remediate the 2014 Security Incident were shared broadly with “senior 

management,” which included, according to Plaintiffs, Ms. Mayer and Mr. Bell. (¶¶ 142-48.) 

The issue, however, is not “whether defendants had knowledge of certain undisclosed 

facts.” City of Dearborn Heights Act 345 Police & Fire Ret. Sys. v. Waters Corp., 632 F.3d 751, 

758 (1st Cir. 2011). Instead, the dispositive question is “whether defendants knew or should have 

known that their failure to disclose those facts” rendered the statements they made false or 

misleading.” Id.; see Rigel Pharm., 697 F.3d at 884 (finding scienter inadequately pled where the 

plaintiffs did not demonstrate that the “defendants believed that they were making false or 

misleading statements related to blood pressure” when they omitted cases of hypertension from a 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 32 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 24

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

chart of side-effects). While the SAC contends that knowledge of cybersecurity issues can be 

inferred, including from Ms. Mayer’s cooperation with the FBI (¶ 205), Mr. Stamos’ reports to 

Ms. Mayer (¶ 149), and an account from a confidential witness (¶¶ 210-12), these allegations do 

not support a strong inference that any challenged statement was made with intent to deceive 

investors. As discussed below, the SAC does not contain particularized factual allegations 

supporting a strong inference that any statement was made with the intent to deceive investors. 

a. Marissa Mayer 

(i) Statements in 2013 and 2014 

Plaintiffs allege that Ms. Mayer made eleven statements between the start of the Class 

Period and November 9, 2014, when Plaintiffs allege that the state-sponsored hackers exfiltrated 

Yahoo user account data from Yahoo’s network. (Stmt. Nos. 2-3, 6-8, 10-11, 16-17, 25, 33.) 

Plaintiffs have alleged no facts even suggesting that Ms. Mayer made these statements—made 

before the 2014 Security Incident occurred and before anyone at Yahoo (much less Ms. Mayer) 

knew of the 2013 Security Incident—with scienter. 

(ii) Statements in 2015 and 2016 

The context of the thirteen statements made after the 2014 Security Incident occurred are 

inconsistent with a strong inference that Ms. Mayer spoke with the intent to deceive investors. 

 Seven are risk factor statements in Yahoo’s SEC filings, which Plaintiffs allege were signed 

by Ms. Mayer. (Statement Chart Tab C; Stmt. Nos. 35, 41, 43, 48, 52, 55, 57.) The risk 

factors expressly warned investors that “[s]ecurity breaches or unauthorized access have 

resulted in and may in the future result in a combination of significant legal and 

financial exposure.” This is inconsistent with a strong inference that Ms. Mayer sought to 

deceive investors about Yahoo’s data security by concealing the fact that Yahoo’s networks 

had been breached. 

 Four are general aspirational statements about “privacy” and Yahoo’s security efforts, 

including a roundtable discussion on the effect of “Snowden and also the counterterrorism 

problem.” (Statement Chart Tab G; Stmt. Nos. 36, 42, 45, 47.) Ms. Mayer’s discussion of 

the effects of “Snowden’s allegations,” “encryption between datacenters,” and a newlyCase 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 33 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 25

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

announced “Yahoo! Account Key” feature has nothing to do with the 2014 Security 

Incident or Yahoo’s exposure to data breaches more generally. There are no particularized 

factual allegations supporting a strong inference that the “‘danger of misleading buyers or 

sellers” of securities with these statements was “either known to the defendant or [was] so 

obvious that the actor must have been aware of it.’” NVIDIA, 768 F.3d at 1053. 

 The remaining two statements are the allocation-of-risk representations included in the SPA. 

(Statement Chart Tab D; Stmt. Nos. 56, 61.) As discussed above, these statements are not 

actionable. Moreover, the fact that the SPA explicitly advised readers not to rely on it 

supports an inference that it was not made with intent to induce reliance. See Glazer, 549 

F.3d at 748 (location of misrepresentation “undercuts any inference that [the defendant] 

knew about the [false statement] when he signed the merger agreement”). 

In addition to the context of these statements being inconsistent with an intent to deceive, 

the Independent Committee’s findings, upon which Plaintiffs rely, undermine Plaintiffs’ fraud 

theory. Specifically, the Independent Committee “did not conclude that there was an intentional 

suppression of relevant information,” but rather that “failures in communication, management, 

inquiry and internal reporting contributed to the lack of proper comprehension and handling of 

the 2014 Security Incident.” (Ex. 20 at 47.) Plaintiffs’ allegations about Yahoo “penalizing” Ms. 

Mayer add nothing to their theory and in fact support the opposite inference. Plaintiffs “point to 

no particularized allegation refuting the reasonable assumption” that Ms. Mayer was not awarded 

a bonus “simply because the errors that le[d] to the [2014 Security Incident] occurred on [her] 

watch. . . . Any inference beyond that is unwarranted without more specific allegations.” In re 

U.S. Aggregates, Inc. Sec. Litig., 235 F. Supp. 2d 1063, 1073-74 (N.D. Cal. 2002). Indeed, the 

fact that Ms. Mayer remained as Yahoo’s CEO until the closing of the Sale Transaction “further 

diminishes any inference of scienter.” City of Dearborn Heights Act 345 Police & Fire Ret. Sys. 

v. Align Tech., Inc., 856 F.3d 605, 622 (9th Cir. 2017); NVIDIA, 768 F.3d at 1063. 

(iii) Stock sales 

Plaintiffs’ only allegation regarding stock sales is that Ms. Mayer “sold at least 1.2 million 

shares of Yahoo common stock at artificially inflated prices, for proceeds of more than $51 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 34 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 26

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

million” during the more than three-year Class Period. (¶ 215.) Stock sales by a corporate 

insider support an inference of scienter only when they are “dramatically out of line with prior 

trading practices at times calculated to maximize the personal benefit from undisclosed inside 

information.” Zucco, 552 F.3d at 1005. Plaintiffs fail to present the requisite “‘meaningful 

trading history’ for purposes of comparison to the stock sales within the class period.” Id. (citing 

Vantive, 283 F.3d at 1095-96). Thus, these allegations contribute nothing. 

b. Ronald Bell 

It is not even clear that Plaintiffs contend Mr. Bell acted with scienter. The SAC asserts 

that Yahoo “self-servingly focused blame on the ‘relevant legal team,’ specifically Mr. Bell, 

Yahoo’s General Counsel.” (¶ 213.) And Plaintiffs allege that Yahoo’s purported 

“condemnation” of Mr. Bell was “ridiculous” and that Mr. Bell “is a good man and as a lawyer he 

wasn’t in charge of security.” (¶ 214.) Such allegations imply that Mr. Bell acted with no 

fraudulent intent. 

In any event, the facts pled in the SAC are wholly inadequate to support an inference of 

scienter on the part of Mr. Bell. Plaintiffs attribute only six statements to Mr. Bell: 

 Four are vague, generalized (inactionable) statements that Yahoo “take[s] the privacy of our 

users seriously” (¶ 252; Stmt. No. 4); the legal department’s “main job is to protect our 

users” (¶ 271; Stmt. No. 12); “users come first at Yahoo . . . We are also committed to 

protecting users’ data” (¶ 300; Stmt. No. 28); and “the security of [Yahoo] users’ 

information is of paramount importance” (¶ 352; Stmt. No. 53). 

 The other two address security issues unrelated to the Security Incidents: Mr. Bell stated 

that Yahoo had committed to “introducing HTTPS (SSL – Secure Sockets Layer) 

encryption with 2048-bit keys across our network” (¶ 290; Stmt. No. 23) and that Yahoo 

“recently rolled out an end-to-end (e2e) encryption extension for Yahoo Mail” (¶ 322; Stmt. 

No. 53). 

As explained above (see Sections II.C.1.b and II.C.2, supra), none of these is false or misleading. 

Additionally, four of these statements (¶¶ 252, 271, 290, 300; Stmt. Nos. 4, 12, 23, 28) 

were made before the 2014 Security Incident had even occurred. And, as explained above, 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 35 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 27

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Plaintiffs have pled no particularized facts showing that anyone at Yahoo—let alone Mr. Bell—

knew of the 2013 Security Incident before December 2016. Thus, these statements could not 

have been made with scienter. 

Plaintiffs attribute only two statements to Mr. Bell that were made in February 2015 or 

later. (¶¶ 322, 352; Stmt. Nos. 39, 53.) Plaintiffs have alleged no particularized facts establishing 

a strong inference that Mr. Bell was seeking to deceive Yahoo investors when he made these two 

statements, neither of which has anything to do with the Security Incidents. See Rigel Pharm., 

697 F.3d at 884. Statement 39—”At Yahoo, users always come first”—is classic puffery. (¶ 322; 

see Intuitive Surgical, 759 F.3d at 1060.) Mr. Bell goes on to say that Yahoo has “encrypted 

many of our most important products.” Plaintiffs have presented no facts showing that this 

statement was false, much less that Mr. Bell acted with an intent to deceive investors.20 End-toend encryption was unrelated to the 2014 Security Incident. (¶ 322.) Likewise, Statement 53 is 

also a nonactionable statement that “the security of [Yahoo] users’ information is of paramount 

importance,” made in the context of Bell’s discussion of the FBI’s attempt to compel Apple—not 

Yahoo—to “pick the lock” of the iPhone owned by the suspect in the San Bernardino terrorist 

shooting. (¶ 352; Stmt. No. 53; Ex. 11.) 

Conspicuously absent from the SAC is any allegation that Mr. Bell had any motive to 

engage in securities fraud. Plaintiffs do not allege that Mr. Bell sold any Yahoo stock, much less 

that he sold it in suspicious amounts or at suspicious times. Accordingly, the allegations against 

Mr. Bell are insufficient to state a claim and should be dismissed. 

c. Alexander Stamos 

Plaintiffs’ allegations against Mr. Stamos fail to demonstrate any conflict between his 

understanding of the 2014 Security Incident and his challenged statements. 

As an initial matter, Plaintiffs fail to explain why Yahoo in March 2014 (¶ 17)—in the 

 

20 Plaintiffs also point to Mr. Bell’s resignation, and allege that “no payments [were] made to Mr. 

Bell in connection with his resignation.” (¶ 125.) But, as with Ms. Mayer, Plaintiffs “point to no 

particularized allegation refuting the reasonable assumption” that Mr. Bell was penalized “simply 

because the errors that le[d] to the [2014 Security Incident] occurred on his watch.” U.S. 

Aggregates, 235 F. Supp. 2d at 1073-74. “Any inference beyond that is unwarranted.” Id.

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 36 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 28

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

midst of allegedly covering up the “massive” 2013 Security Incident—would hire Mr. Stamos, 

who by Plaintiffs’ own admission “had a reputation for pushing for privacy and antisurveillance 

measures.” (¶ 91.) Nor do Plaintiffs explain why Mr. Stamos would risk this reputation to 

engage in a securities fraud scheme. As with Mr. Bell, there are no allegations that Mr. Stamos 

engaged in insider trading, or profited in any way from the alleged cover-up. This complete 

absence of motive undermines Plaintiffs’ scienter theory and, in fact, “supports the opposite 

inference.” Rigel Pharm., 697 F.3d at 885. 

Moreover, the context and timing of Mr. Stamos’ purported statements undermine any 

inference of scienter. Plaintiffs challenge six statements allegedly attributable to Mr. Stamos. 

(¶¶ 274-75, 284-88, 292, 297-98, 306, 318; Stmt. Nos. 13-14, 18-22, 24, 26-27, 37.) Five of 

these statements were made before the 2014 Security Incident even occurred. (¶¶ 274-75, 

284-88, 292, 297-98, 306; Stmt. Nos. 13-14, 18-22, 24, 26-27.) 

The only allegedly false statement attributed to Mr. Stamos after the 2014 Security 

Incident occurred—a March 15, 2015 statement in which he vaguely discussed the 

implementation of an end-to-end encryption extension for Yahoo Mail, Yahoo’s commitment to 

protecting users’ security, and Yahoo’s efforts to build “the best products”—is an inactionable 

statement of corporate optimism unrelated to the Security Incidents. (¶ 318; Stmt. No. 37.) 

Plaintiffs plead no particularized facts supporting a strong inference that Mr. Stamos intended to 

deceive investors when making this statement. As discussed above, the “key question . . . is not 

whether defendants had knowledge of certain undisclosed facts, but rather whether defendants 

knew or should have known that their failure to disclose those facts present[ed] a danger of 

misleading buyers or sellers” of securities. Waters Corp., 632 F.3d at 758; see Rigel Pharm., 697 

F.3d at 884 (finding scienter inadequately pled where plaintiffs did not demonstrate that 

“defendants believed that they were making false or misleading statements related to blood 

pressure” when they omitted cases of hypertension from a chart of side-effects). Plaintiffs make 

no such showing with respect to Mr. Stamos, whose job was unrelated to communicating with the 

investment community. Nor is his vague statement one on which investors would rely. Intuitive 

Surgical, 759 F.3d at 1060. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 37 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 29

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Mr. Stamos’ position at Yahoo undermines an inference that he spoke with an intent to 

deceive investors. As CISO, Mr. Stamos’ statements were predominantly made on Yahoo’s 

security blog and at information security events, not at investor-facing presentations or on 

earnings conference calls. (Stmt. Nos. 13-14, 24, 26-27, 32, 37.) Plaintiffs plead no facts 

showing that, in this context, Mr. Stamos “knew or should have known that [his] failure to 

disclose [the allegedly omitted information] presented a danger of misleading investors.” Waters 

Corp., 632 F.3d at 758 (internal quotation marks omitted); see also Petrie v. Elec. Game Card, 

Inc., 2011 WL 13130015, at *7 (C.D. Cal. Oct. 19, 2011) (“[C]ulpability is based on intent, not 

mere knowledge.”); LifeLock, 690 Fed. App’x at 954. 

d. Yahoo 

Pleading corporate scienter requires, at a minimum, satisfying the requirements of 

respondeat superior liability.21 In re ChinaCast Educ. Corp. Sec. Litig., 809 F.3d 471, 476 (9th 

Cir. 2015); Nordstrom, Inc. v. Chubb & Son, Inc., 54 F.3d 1424, 1435-36 (9th Cir. 1995). 

Plaintiffs must plead facts showing that a corporate officer, while acting on Yahoo’s behalf, 

violated Section 10(b). ChinaCast, 809 F.3d at 475-76. Under Ninth Circuit law, a “corporation 

is deemed to have the requisite scienter for fraud only if the individual corporate officer making 

the statement has the requisite level of scienter.” Weiss v. Amkor Tech., Inc., 527 F. Supp. 2d 

938, 952 (D. Ariz. 2017). As discussed above, Plaintiffs fail to make that showing with respect to 

any Individual Defendant. 

For statements that Plaintiffs attribute to a non-Defendant (Stmt. Nos. 5, 9, 15, 34, 40, 44, 

54), Plaintiffs fail to plead any facts concerning the statement maker’s knowledge or intent. 

Plaintiffs have not, therefore, shown that the makers acted with scienter. Under these 

circumstances, Plaintiffs cannot plead a Section 10(b) claim against Yahoo. In re Int’l Rectifier 

Corp. Sec. Litig., 2008 U.S. Dist. LEXIS 44872, at *66 (C.D. Cal. May 23, 2008) (“[F]or scienter 

 

21 In light of the Supreme Court’s repeated rejections of attempts to establish secondary liability 

under Section 10(b)—see, e.g., Stoneridge, 552 U.S. at 158; Cent. Bank of Denver, N.A. v. First 

Interstate Bank, N.A., 511 U.S. 164, 185 (1994)—it is unclear whether the respondeat superior

theory remains viable. While Yahoo does not raise this issue in this Motion, it does not concede 

that respondeat superior is a valid theory and reserves the right to challenge it at a later time. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 38 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 30

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

to be attributed to [the company], [p]laintiffs must sufficiently plead that at least one of [the 

defendant company’s] officers had the requisite scienter at the time they made the allegedly 

misleading statements.” (emphasis added)). 

Twelve of Plaintiffs’ challenged statements are not attributed to any individual— 

Defendant or otherwise. (Stmt. Nos. 1, 29-31, 38, 46, 49-51, 58-60.) This method of pleading 

“cannot withstand the PSLRA’s specific requirement that the untrue statements or omissions be 

set forth with particularity as to ‘the defendant’ and that scienter be pleaded with regard to ‘each 

act or omission’ sufficient to give ‘rise to a strong inference that the defendant acted with the 

required state of mind.’” Southland Sec. Corp. v. INSpire Ins. Solutions Inc., 365 F.3d 353, 

363-67 (5th Cir. 2004); see also Okla. Firefighters Pension & Ret. Sys. v. Ixia, 50 F. Supp. 3d 

1328, 1354-55 (C.D. Cal. 2014) (compiling cases). Plaintiffs cannot establish their Section 10(b) 

claim without particularized allegations establishing who made these unattributed statements and 

the maker’s contemporaneous state of mind. 

E. Plaintiffs’ Claims Should Also Be Dismissed for Failure to Plead Loss 

Causation and Damages. 

In addition to the fatal deficiencies identified above, the SAC fails to plead the essential 

elements of loss causation and damages with respect to any Plaintiff. On these additional 

grounds, it should be dismissed. 

1. Maher has not pled loss causation. 

Loss causation is the “causal connection between the material misrepresentation and the 

loss.” Dura Pharm., Inc. v. Broudo, 544 U.S. 336, 342 (2005); see also Loos, 762 F.3d at 888. 

To plead loss causation in a case governed by the Reform Act, a plaintiff must plead that (1) he 

purchased a security at a market price that was artificially inflated by a fraudulent 

misrepresentation; (2) the artificial inflation was removed from the market price as a result of a 

corrective disclosure; and (3) he continued to hold the security through the date of the corrective 

disclosure. Dura, 544 U.S. at 342; Loos, 762 F.3d at 888. The release of negative information, 

alone, is not enough to satisfy the loss causation requirement. Rather, a plaintiff must “trac[e] the 

loss back to the very facts about which the defendant lied.” Mineworkers’ Pension Scheme v. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 39 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 31

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

First Solar, Inc., 881 F.3d 750, 753 (9th Cir. 2018); see In re Oracle Corp. Sec. Litig., 627 F.3d 

376, 392 (9th Cir. 2010) (“Loss causation is established if the market learns of a defendant’s 

fraudulent act or practice, the market reacts to the fraudulent act or practice, and a plaintiff suffers 

a loss as a result of the market’s reaction.”); Metzler, 540 F.3d at 1063 (rejecting assertion that 

loss causation is proved by showing that the market reacted to the purported impact of the alleged 

fraud rather than to the fraudulent acts themselves); Apollo, 774 F.3d at 608 (a plaintiff must 

show that a corrective disclosure “reveal[ed] fraudulent practices to the market place” and that the 

defendants’ previous statements were “made untrue or called into question by subsequent public 

disclosures”). Rule 9(b) requires that facts supporting allegations of loss causation be pled with 

particularity. Apollo, 774 F.3d at 605. 

Here, the first potential corrective disclosure occurred on September 22, 2016, when 

Yahoo announced the 2014 Security Incident. (¶ 394.) Maher, who traded in options and not 

stock, either had sold his options or his options had expired by February 19, 2016. (See Ex. 27 at 

13-3, pp. 1-6; ¶ 13.) Maher has not, therefore, pled loss causation. 

Maher attempts to avoid dismissal on this ground by asserting—without explanation—that 

the following eleven disclosures preceding the September 22, 2016 announcement of the 2014 

Security Incident constitute corrective disclosures: 

 A May 18, 2015 press report on the departure of Yahoo’s CISO, Mike Kail. (¶ 373.) 

 A July 28, 2015 Yahoo announcement that Yahoo had paid one million dollars in bonuses in 

its “bug bounty” program. (¶ 375.) 

 A September 11, 2015 press report that Yahoo’s interim CISO had left Yahoo. (¶ 377.) 

 A September 14, 2015 press report that some Yahoo Messenger emoticon downloads 

contained a security vulnerability. (¶ 378.) 

 A December 2, 2015 Yahoo announcement that Yahoo would review the possibility of 

selling its operating business. (¶ 380.) 

 A January 4, 2016 press announcement of an impending proxy contest. (¶ 382.) 

 A January 20, 2016 press report of a scripting vulnerability in Yahoo Mail. (¶ 384.) 

 A January 23, 2016 press report that Verizon had made a bid for Yahoo’s operating assets, 

followed by a denial from Verizon. (¶ 386.) 

 A February 2, 2016 Yahoo announcement of a goodwill impairment charge relating to the 

carrying value of Yahoo’s U.S. & Canada, Europe, Tumblr, and Latin America reporting 

units. (¶ 388.) 

 A May 19, 2016 press report on rumors about bids for Yahoo’s operating assets. (¶ 390.) 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 40 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 32

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 A July 24, 2016 press report of a rumor that Verizon had agreed to buy Yahoo’s operating 

assets. (¶ 392.) 

These statements are entirely unrelated to Plaintiffs’ theory that Yahoo’s stock price 

“plummeted” when “the market learned of the data breaches” (¶ 7), and Plaintiffs make no 

attempt to meet their burden of “tracing the [alleged] loss back to the very facts about which the 

defendant lied.” First Solar, 881 F.3d 750, at 753. Attaching the conclusory label “corrective 

disclosure” to these reports achieves nothing. Labels do not change the analysis under Rule 8, 

much less Rule 9(b). Maher’s claims should be dismissed for failure to plead loss causation. 

2. Sutton View’s claim is barred by the Reform Act’s damages 

limitation. 

Lead Plaintiff Sutton View held its Yahoo common stock in two separate accounts during 

the Class Period. (Ex. 27 at 13-3, pp. 6-9.) All shares held in “Account 1” were sold on or before 

March 8, 2016. (Id.) As with Lead Plaintiff Maher, therefore, Sutton View cannot establish loss 

causation with respect to these shares. 

Sutton View held one hundred shares in its “Account 2” through the end of the Class 

Period.22 (Id.) However, these one hundred shares do not save its claim because the Reform Act 

“limits the amount of damages that plaintiffs can recover at trial to the difference between the 

purchase price and the average trading price during the 90-day period following the corrective 

disclosure.” In re Veritas Software Corp. Sec. Litig., 496 F.3d 962, 967 n.3 (9th Cir. 2007); 15 

U.S.C. § 78u-4(e)(1). “Thus, if the mean trading price of a security during the 90-day period 

following the correction is greater than the price at which the plaintiff purchased his stock then 

that plaintiff would recover nothing under the PSLRA’s limitation on damages.”23 In re Mego 

Fin. Corp. Sec. Litig., 213 F.3d 454, 461 (9th Cir. 2000) (emphasis in original); In re Vivendi 

 

22 Sutton View sold all other shares held in this account by May 9, 2016. (Ex. 27 at 13-3, pp. 

6-9.) Similarly, all of Sutton View’s options either were sold or expired by April 15, 2016. (Id.) 

As with Maher, Sutton View cannot establish loss causation with respect to these shares. Dura, 544 U.S. at 342. 

23 The Reform Act defines “mean trading price” as the “average of the daily trading price of that 

security, determined as of the close of the market each day during the 90-day period.” 15 U.S.C. 

§ 78u-4(e)(3). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 41 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 33

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Universal, S.A. Sec. Litig., 123 F. Supp. 3d 424, 438-39 (S.D.N.Y. 2015). 

Here, the final alleged corrective disclosure date identified in the SAC is January 5, 2017. 

(¶ 411.) The average closing price of Yahoo’s stock during the 90-day period following that date 

was $44.87. (Lobdell Decl. ¶ 16.) All the shares purchased in Sutton View’s Account 2, 

however, were purchased at or below $36.42, well below the bounce-back threshold. (Ex. 27 at 

13-3, pp. 7-8.) Thus, Sutton View is not entitled to recover damages. See Mego, 213 F.3d at 461; 

Vivendi, 123 F. Supp. 3d at 438-39. Sutton View’s failure to plead loss causation or damages 

requires dismissal of its claims. Dura, 544 U.S. at 342; Paracor Fin., Inc. v. GE Capital Corp., 

96 F.3d 1151, 1157 (9th Cir. 1996) (“If one of these elements is missing, the Investors’ claim 

fails.”). 

3. Talukder’s claim is barred by the Reform Act’s damages 

limitation. 

Talukder, too, has pled no recoverable damages. His Class Period sales all took place on 

or before July 17, 2015, more than one year before the September 22, 2016 announcement of the 

2014 Security Incident, so he cannot establish loss causation as to these sales. (Ex. 28 at 36.) 

Talukder did not sell all his Yahoo stock, though. He held 1,013 Yahoo shares through the end of 

the Class Period. (Id.) All but three of Talukder’s purchases, however, were made at prices 

below the 90-day bounce-back threshold of $44.87. (Id.; Lobdell Decl., ¶ 16.) For the reasons 

discussed above, Talukder is not entitled to damages with respect to shares purchased below the 

bounce-back threshold. 

Talukder made three Class-Period purchases at levels above the 90-day bounce-back 

threshold of $44.87. These three purchases, however, do not save Talukder’s claim because they 

were all made between November 4 and 6, 2014. (Ex. 28 at 36.) Plaintiffs concede that the 

hackers did not exfiltrate Yahoo user data as part of the 2014 Security Incident until November 

10, 2014. (¶ 142.) Thus, even accepting Plaintiffs’ theory, these purchases occurred before the 

2014 Security Incident even took place, much less when it could have been disclosed to the 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 42 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 34

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

public.24 Similarly, Plaintiffs do not allege that the 2013 Security Incident was known to anyone 

(other than the hackers) until 2016. Talukder, therefore, has not pled—and cannot plead—that 

these three purchases were made in reliance on Defendants’ fraudulent concealment of the 

Security Incidents. See Roots P’ship v. Lands’ End, Inc., 965 F.2d 1411, 1420 (7th Cir. 1992). 

As neither Talukder nor the Lead Plaintiffs have stated a claim upon which relief can be 

granted, the SAC should be dismissed on this ground, as well. The SAC’s class action allegations 

(¶¶ 418-26) do not remedy Plaintiffs’ failure to state a claim.25 

III. THE SECTION 20(a) CLAIMS SHOULD BE DISMISSED. 

To state a claim under Section 20(a), Plaintiffs must establish (1) “a primary violation of 

federal securities law” and (2) “that the defendant exercised actual power or control over the 

primary violator.” NVIDIA, 768 F.3d at 1052; Zucco, 552 F.3d at 990. Section 20(a) claims must 

satisfy the particularized pleading requirements of Rule 9(b). In re Volkswagen “Clean Diesel” 

Mktg., Sales Practices, & Prods. Liab. Litig., 2017 U.S. Dist. LEXIS 1109, at *856 (N.D. Cal. 

Jan. 4, 2017); In re Impac Mortg. Holdings, Inc. Sec. Litig., 554 F. Supp. 2d 1083, 1101 n.12 

(C.D. Cal. 2008); Howard v. Hui, 2001 U.S. Dist. LEXIS 15443, at *13-14 (N.D. Cal. Sept. 24, 

2001). 

Plaintiffs’ control-person claims under Section 20(a) should be dismissed for two reasons. 

First, Plaintiffs have failed to plead a primary violation of the Exchange Act. Rigel Pharm., 697 

F.3d at 886. Second, Plaintiffs have alleged no facts, particularized or otherwise, establishing for 

Section 20(a) that Mr. Bell or Mr. Stamos exercised actual control over a primary violator. See In 

re Invensense, Inc. Sec. Litig., 2016 U.S. Dist. LEXIS 40607, at *24 (N.D. Cal. Mar. 28, 2016). 

The SAC contains only vague and conclusory allegations that “the Individual Defendants,” 

 

24 While Plaintiffs contend that the information security team detected an “intrusion” on October 

9, 2014 (¶ 142), there are no allegations to support a theory that this intrusion warranted 

disclosure. Moreover, Plaintiffs do not contend that any allegedly false and misleading 

statements were made between October 9, 2014, and the dates of Talukder’s purchases. 

25 To proceed as a class representative, a plaintiff must show that it personally has been injured, 

“not that injury has been suffered by other, unidentified members of the class to which [it] 

belong[s] and which [it] purport[s] to represent.” Warth v. Seldin, 422 U.S. 490, 503 (1975). If a 

plaintiff fails to state an individual claim, that plaintiff cannot proceed to represent the purported 

class. In re Impax Labs., Inc. Sec. Litig., 2008 WL 1766943, at *6 (N.D. Cal. Apr. 17, 2008). 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 43 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 35

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

as a group, “participated in the operation and management of Yahoo” and “[b]ecause of their 

positions of control and authority as senior officers, the Individual Defendants were able to, and 

did, control the contents of the various reports, statements, press releases and public filings.” 

(¶¶ 437-41.) Bare legal conclusions and boilerplate language alleging “control” over a primary 

violator are insufficient to overcome a motion to dismiss. City of Westland Police and Fire Ret. 

Sys. v. Sonic Solutions, 2009 U.S. Dist. LEXIS 33339, at *31 (N.D. Cal. Apr. 6, 2009). Such 

“allegations are conclusory and not entitled to a presumption of truth.” Richardson v. 

Oppenheimer & Co. Inc., 2014 U.S. Dist. LEXIS 43419, at *34 (D. Nev. Mar. 31, 2014). Indeed, 

judicially noticeable facts demonstrate that they are not true. For example, neither Mr. Bell nor 

Mr. Stamos signed Yahoo’s Forms 10-Q and 10-K filed with the SEC. And Plaintiffs have 

pleaded no facts suggesting that Mr. Bell or Mr. Stamos “played any role in issuing any public 

statements or disclosures nor that [they] had the authority to do so.” Neborsky v. Valley Forge 

Composite Techs., Inc., 2014 U.S. Dist. LEXIS 104681, at *32-33 (S.D. Cal. July 29, 2014). 

Plaintiffs’ boilerplate allegations rest solely on reciting the Individual Defendants’ 

positions at Yahoo, lacking any facts that “suggest how that authority was manifested.” Neborsky, 

2014 U.S. Dist. LEXIS 104681, at *33. The positions alone “do[] not create any presumption of 

control” and do not, therefore, “sustain an allegation of control person liability.” In re Oak Tech. 

Sec. Litig., 1997 U.S. Dist. LEXIS 18503, at *14 (N.D. Cal. Aug. 1, 1997) (emphasis in original). 

Plaintiffs’ failure to allege “the specific circumstances of [the Individual Defendants’] 

alleged control” is fatal to their Section 20(a) claims. Volkswagen, 2017 U.S. Dist. LEXIS 1109, 

at *856-58; In re Galena Biopharma, Inc. Sec. Litig., 117 F. Supp. 3d 1145, 1202 (D. Or. 2015). 

CONCLUSION 

For the foregoing reasons, the SAC should be dismissed with prejudice. 

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 44 of 45
Case No. 17-CV-00373 (LHK) 

NOTICE OF MOTION AND MOTION TO DISMISS SECOND AMENDED COMPLAINT 36

sf- 3868679

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Dated: March 2, 2018 JORDAN ETH

JUDSON E. LOBDELL 

MORRISON & FOERSTER LLP 

By: /s/ Judson E. Lobdell 

JUDSON E. LOBDELL 

Attorneys for Defendants 

YAHOO! INC. and MARISSA 

MAYER

Case 5:17-cv-00373-LHK Document 75 Filed 03/02/18 Page 45 of 45