[PROPOSED] ORDER GRANTING PLTFS’ MOT. FOR CLASS CERTIFICATION – 16-md-02752-LHK - 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION

IN RE: YAHOO! INC. CUSTOMER DATA 

SECURITY BREACH LITIGATION

)

)

)

)

)

)

)

)

)

)

)

)

Case No. 16-md-02752-LHK

[PROPOSED] ORDER GRANTING 

PLAINTIFFS’ MOTION FOR CLASS 

CERTIFICATION 

Case 5:16-md-02752-LHK Document 246-2 Filed 07/13/18 Page 1 of 5
[PROPOSED] ORDER GRANTING PLTFS’ MOT. FOR CLASS CERTIFICATION – 16-md-02752-LHK - 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

This matter came before the undersigned Honorable Lucy H. Koh of the above-entitled Court 

upon Plaintiffs’ Motion for Class Certification (“Motion”). The Court, having considered the 

Motion and all other papers filed in support of the Motion, all other pertinent documents and 

pleadings filed in this action, and oral argument from counsel, 

NOW, therefore, it is hereby ORDERED and ADJUDGED:

1. Plaintiffs’ Motion is hereby GRANTED.

2. The following Class is hereby certified pursuant to Fed. R. Civ. P. 23(b)(2):

UCL Injunctive Relief Class. All persons who registered for a free 

Yahoo account(s) in the United States whose PII was stolen from 

Yahoo through the 2013 Breach, the 2014 Breach, and/or the Forged 

Cookie Breach.

3. The Court also appoints Plaintiffs Kimberly Heines, Hashmatullah Essar, Paul Dugas, 

Matthew Ridolfo, and Deana Ridolfo as representatives of the UCL Injunctive Relief Class. 

4. The following Class and Subclasses are certified pursuant to Fed. R. Civ. P. 23(b)(3):

Damages Class. All persons who registered for any Yahoo or 

Aabaco account(s) in the United States and Israel whose PII was 

stolen from Yahoo through the 2013 Breach, the 2014 Breach, and/or 

the Forged Cookie Breach.

Free Users Subclass. All persons who registered for free Yahoo 

account(s) in the United States or Israel whose PII was stolen from 

Yahoo through the 2013 Breach, the 2014 Breach, and/or the Forged 

Cookie Breach; 

Paid Users Subclass. All persons who registered for paid Yahoo 

account(s), excluding Yahoo Small Business or Aabaco accounts, in 

the United States or Israel whose PII was stolen from Yahoo through 

the 2013 Breach, the 2014 Breach, and/or the Forged Cookie Breach; 

Small Business Users Subclass. All persons who registered for 

Yahoo Small Business or Aabaco account(s) in the United States or 

Israel whose PII was stolen from Yahoo or Aabaco through the 2013 

Breach, the 2014 Breach, and/or the Forged Cookie Breach; and 

California Users Subclass. All persons who registered for any Yahoo 

or Aabaco account(s) in California, or who are Yahoo or Aabaco 

account users residing in California, whose PII was stolen from 

Yahoo through the 2014 Breach and/or the Forged Cookie Breach.

Case 5:16-md-02752-LHK Document 246-2 Filed 07/13/18 Page 2 of 5
[PROPOSED] ORDER GRANTING PLTFS’ MOT. FOR CLASS CERTIFICATION – 16-md-02752-LHK - 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

5. The Court also appoints Plaintiffs Kimberly Heines, Hashmatullah Essar, Paul Dugas, 

Matthew Ridolfo, Deana Ridolfo, Mali Granot, Yaniv Rivlin, Andrew Mortensen, and Brian Neff as 

representatives of the Damages Class. The Court further appoints: Plaintiffs Kimberly Heines, 

Hashmatullah Essar, Paul Dugas, Matthew Ridolfo, Deana Ridolfo, Mali Granot, and Yaniv Rivlin 

as representatives of the Free Users Subclass; Plaintiff Andrew Mortensen as representative of the 

Paid User Subclass; Plaintiff Brian Neff as representative of the Small Business Users Subclass; and 

Plaintiffs Kimberly Heines and Paul Dugas as representatives of the California Users Subclass. 

6. Pursuant to Fed. R. Civ. P. 23(g), the Court appoints John A. Yanchunis of Morgan & 

Morgan Complex Litigation Group, Stuart A. Davidson of Robbins Geller Rudman & Dowd LLP, 

Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP, Ariana H. Tadler of 

Milberg Tadler Philips Grossman LLP, and Karen Hanson Riebel of Lockridge Grindal Nauen 

P.L.L.P. as Class Counsel. 

7. The Court bases this certification and appointment Order on the following findings, 

all of which are supported by Plaintiffs’ well-pleaded allegations, Defendants’ own documents, 

Plaintiffs’ testimony, Defendants’ testimony, and expert testimony:

(a) Numerosity. Plaintiffs have demonstrated that “the class is so numerous that 

joinder of all members is impracticable” within the meaning of Fed. R. Civ. P. 23(a)(1).

(b) Commonality. Federal Rule of Civil Procedure 23(a)(2) requires that there be 

“questions of law or fact common to the class.” Plaintiffs have satisfied the commonality 

requirement here by identifying, inter alia, the following common questions of law and fact as to all 

Class members1

: (i) whether Defendants’ actions and inactions to identify and respond to the 

Breaches complied with industry norms and applicable regulations in its actions; and (ii) whether 

and when Defendants knew or should have known of the Breaches. 

(i) Plaintiffs have identified the following additional questions of law and 

fact common to Damages Class members: (i) whether Plaintiffs and Damages Class members’ 

accounts were governed by a valid and binding contract; (ii) whether the TOS required Defendants 

 1 “Class members” refers to members of either or both of the UCL Injunctive Relief Class and the 

Damages Class and Subclasses.

Case 5:16-md-02752-LHK Document 246-2 Filed 07/13/18 Page 3 of 5
[PROPOSED] ORDER GRANTING PLTFS’ MOT. FOR CLASS CERTIFICATION – 16-md-02752-LHK - 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

to adequately safeguard Plaintiffs and Damages Class members’ PII; (iii) whether Defendants 

breached the TOS by failing to adequately safeguard PII; (iv) whether Defendants owed a duty to 

exercise due care in collecting, storing, and safeguarding PII; (v) whether Defendants breached that 

duty; (vi) whether Defendants and their top executives knew about the Breaches and the state of 

Defendants’ security (and when); (vii) whether Defendants failed to timely notify Plaintiffs and 

Damages Class members of the Breaches; and (viii) whether Plaintiffs and Damages Class members 

are entitled to punitive damages.

(ii) Plaintiffs have identified the following additional questions of law and 

fact that are common to UCL Injunctive Relief Class members: whether Yahoo’s provision of 

inadequate security was (1) an unfair business practice under either the tethering or balancing tests, 

or (2) an unlawful business practice. 

(iii) Plaintiffs have identified the following additional questions of law and 

fact that are common to the Paid Users Subclass members and Small Business Users Subclass 

members: (1) whether Defendants had a duty to disclose the inadequacy of its security; and (2) 

whether Plaintiffs Mortensen and Neff and Subclass members would have been aware and would 

have acted differently had Defendants disclosed those facts (i.e., whether they were material to a 

reasonable person).

(c) Typicality. Pursuant to Fed. R. Civ. P. 23(a)(3), Plaintiffs must also show that 

“the claims or defenses of the representative parties are typical of the claims or defenses of the 

class.” The same common questions identified above also serve to satisfy Plaintiffs’ burden on 

typicality. The Court accordingly finds that typicality is met here because Plaintiffs and members of 

their respective Classes and Subclasses seek the same remedies for similar harms and under the same 

legal theories.

(d) Adequacy. Pursuant to Fed. R. Civ. P. 23(a)(4), the Court finds that the 

“representative parties will fairly and adequately protect the interests of the class.” Plaintiffs’ 

interests are fully aligned with those of the Class, and her chosen counsel are fully capable of 

effectively prosecuting this litigation.

Case 5:16-md-02752-LHK Document 246-2 Filed 07/13/18 Page 4 of 5
[PROPOSED] ORDER GRANTING PLTFS’ MOT. FOR CLASS CERTIFICATION – 16-md-02752-LHK - 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

8. In addition, the Court finds that certification of the UCL Injunctive Relief Class is 

proper under Rule 23(b)(2), as Plaintiffs “complain of a pattern or practice that is generally 

applicable to the class as a whole.” In re Yahoo Mail, 308 F.R.D. at 598 (citing Walters v. Reno, 145 

F.3d 1032, 1047 (9th Cir. 1998)). Plaintiffs have further demonstrated that the Breaches were part of 

a single course of conduct that gives rise to the legal rights they seek to enforce, both individually 

and classwide. Moreover, because Yahoo’s company-wide policies and failures were uniform and 

persistent through the entire relevant time period, and continue to significantly increased the risk of 

harm to all UCL Injunctive Relief Class members, Rule 23(b)(2) certification is particularly apt. See 

Parsons v. Ryan, 754 F.3d 657, 688 (9th Cir. 2014) (affirming certification seeking injunction of 

systemic deficiencies in policies and practices that put all plaintiffs at substantial risk of harm).

9. The Court further finds that certification of the Damages Class and Subclasses is 

proper under Rule 23(b)(3). The common questions identified above predominate over any 

individualized issues. In other words, “[a] common nucleus of facts and potential legal remedies 

dominates this litigation.” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1022 (9th Cir. 1998). Further, 

a class action is superior to a series of potentially hundreds of individual suits. Even if it were 

feasible for individual Class members to bring individual cases, it would be inefficient to re-litigate 

the numerous common questions in case after case. Moreover, the Court is unaware of any other 

litigation concerning the controversy at issue herein, and the Court foresees no manageability 

problems that would mitigate against class certification.

IT IS SO ORDERED.

Dated: 

THE HONORABLE LUCY H. KOH

UNITED STATES DISTRICT JUDGE

Case 5:16-md-02752-LHK Document 246-2 Filed 07/13/18 Page 5 of 5