DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

MORGAN & MORGAN

COMPLEX LITIGATION GROUP

John A. Yanchunis

201 N. Franklin Street, 7th Floor

Tampa, Florida 33602

Telephone: 813/223-5505

813/223-5402 (fax)

jyanchunis@ForThePeople.com

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

IN RE: YAHOO! CUSTOMER DATA 

SECURITY BREACH LITIGATION

)

)

)

)

)

)

)

Case No. 16-MD-02752-LHK

DECLARATION OF JOHN YANCHUNIS IN 

SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL

I, John A. Yanchunis, declare pursuant to 28 U.S.C. § 1746 as follows:

1. Following the transfer and consolidation of a number of cases before this Court 

by the Judicial Panel on Multidistrict Litigation, I was appointed by this Court as Plaintiffs’ Lead 

Counsel in this matter. 

2. Attached as Exhibit 1 to this declaration is the Settlement Agreement entered into 

in this matter along with each of its exhibits (“Settlement Agreement” or “Settlement”).

1

 

3. The settlement memorialized in the attached Settlement Agreement is the product 

of two years of hard-fought litigation and equally zealous, and arms-length, settlement 

negotiations.

4. On September 24, 2016, following the announcement of a breach occurring in 

2014 and involving some 500 million user accounts (“2014 Breach”), I filed one of the first class

 

1 Unless otherwise noted, all capitalized terms are defined in the Settlement Agreement and 

Release, which is being filed concurrently herewith.

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 1 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

action cases against Yahoo arising out of the breach, McMahon v. Yahoo! Inc., 5:16-cv-05466 

(N.D. Cal.). 

5. On September 28, 2016, I filed a Motion to Consolidate and Transfer before the 

Judicial Panel on Multidistrict Litigation (“JPML”), seeking to centralize the various actions that 

had been filed around the country regarding the data breach. See In Re: Yahoo! Inc. Customer 

Data Security Breach Litigation, Case No. MDL No. 2752, ECF No. 1 (JPML) (“JPML 

Docket”). On December 7, 2016, that motion was granted, and all actions related to the Data 

Breaches were transferred to this Court, (JPML Docket at ECF No. 62), resulting in the creation 

of this case, In re: Yahoo! Inc. Customer Data Breach Security Litigation, Case No. 16-md02752-LHK (N.D. Cal.) (“MDL Case”).2

6. Pursuant to this Court’s December 13th Order (ECF No. 2), motions for lead 

plaintiffs’ counsel were due January 5, 2017. I, along with Gayle Blatt, Stuart Davidson, Karen 

Hanson Riebel, and Ariana Tadler, jointly applied to lead this matter. ECF No. 19. On February 

9, 2017, this Court granted that motion, appointing me as Lead Counsel, and creating a 

Plaintiffs’ Executive Committee (“PEC”) consisting of Mr. Davidson, and Mesdames Blatt, 

Riebel, and Tadler. ECF No. 58. 

7. Shortly thereafter, months of negotiations commenced between Plaintiffs and 

Defendants regarding a Protective Order (ECF No. 73), ESI protocol (ECF No. 74), Rule 502 

Order (ECF No. 76), ESI Search Protocol (ECF No. 104), and multiple rounds of negotiations to 

reach agreement on hundreds of ESI search terms, (ECF Nos. 151, 153, 163, 167, 170, 171).

8. Initially, the parties negotiated for Yahoo to produce certain documents prior to 

the start of formal discovery, including certain investigative reports of malicious activity. 

 

2

In November 2016, December 2016, and October 2017, Yahoo announced additional breaches, 

and/or broadened the scope of those already announced, including the 2013 Breach and Forged 

Cookie Breach. Collectively, all breaches are referred to here as the Data Breaches. 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 2 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Following completion of search terms negotiations, Yahoo produced, and Plaintiffs reviewed, 

over 9 million pages of documents. 

9. During and after document production, Plaintiffs deposed the critical information 

security personnel who worked at Yahoo during the relevant time periods, including:

 November 10 and November 20, 2017 and February 22, 2018: Deposition of 

Yahoo’s Rule 30(b)(6) corporate representative, Sean Zadig, Director of Threat 

Investigations;

 April 13 and June 8, 2018: Deposition of Robert Lord, former Yahoo Chief 

Information Security Officer (“CISO”);

 May 14 and 15, 2018: Deposition of Ramses Martinez, former Incident Response 

Team leader and Yahoo Interim CISO;

 May 29, 2018: Deposition of Justin Somaini, former Yahoo CISO;

 June 26, 2018: Deposition of Christopher P. Rohlf, former Yahoo Director of 

Penetration Testing and Offensive Engineering Team; 

 June 28, 2018: Deposition of Alexander C. Stamos, former Yahoo CISO; and 

 August 16, 2018: Deposition of Jay Rossiter, former Yahoo Senior Vice President 

and Chief Information Officer (“CIO”).

10. At the time the Settlement Agreement was reached, Plaintiffs had also set 

deposition dates for former Yahoo Chief Executive Officer (“CEO”) Marisa Mayer and former 

General Counsel Ronald Bell, and were seeking dates for Yahoo co-founder and former Board of 

Directors member David Filo. 

11. Each of these depositions was coordinated in conjunction with attorneys in the 

California state court coordinated proceedings, Yahoo! Inc. Private Information Disclosure 

Cases, JCCP No. 4895 (Orange County Superior Court) (“JCCP Case”). 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 3 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

12. Given the importance of these depositions—involving the critical information 

security employees immediately prior to, during, and after the Data Breaches—substantial time

was spent reviewing the deponents’ custodial files, preparing “hot doc” document review 

memoranda and deposition outlines, exchanging documents and deposition strategy with the 

JCCP attorneys, traveling for, and examining the witnesses. 

13. Moreover, in conjunction with the document review and depositions, Plaintiffs 

have utilized the services of cybersecurity expert Mary Frantz, and her team at Enterprise 

Knowledge Partners, to assist with the review of highly technical documents and with the 

depositions of information security professionals. 

14. Plaintiffs also propounded interrogatories, to which Defendants responded. 

15. These discovery efforts provided Plaintiffs with a thorough understanding of 

Yahoo’s complex IT systems, and the deficiencies within them and its information security 

department, that Plaintiffs allege contributed to the Data Breaches and must be remedied.

16. Likewise, Yahoo engaged in significant discovery efforts: eight of the nine named 

Plaintiffs in the MDL Case had their devices forensically imaged, they each responded to 

document requests and interrogatories, and they were each deposed. 

17. In connection with Plaintiffs’ Motion for Class Certification, Plaintiffs submitted 

four expert reports, those of James Van Dyke, Mary Frantz, Ian Ratner, and Gary Parilis. 

Thereafter, Defendants deposed each of these experts, and then sought their exclusion via 

Daubert motions. Thereafter, Plaintiffs began the preparation of responses to these motions, the 

preparation of a reply to Defendants’ opposition to Plaintiffs’ motion for class certification, and 

the preparation for depositions of the experts retained by Defendants who had filed declarations 

and reports in opposition to the motion for class certification. 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 4 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

18. The parties mediated this case with the assistance of the Honorable Daniel 

Weinstein, and also with the assistance of additional mediators Jed Melnik and Simone Lelchuk, 

(all of JAMS), on August 14, 2018, and September 7, 2018. The mediation sessions were held in 

San Francisco, California. Plaintiffs also engaged in a pre-mediation session with Mr. Melnick 

on August 10, 2018, in New York City, New York. 

19. As a result of these mediation sessions, on September 7th the parties reached an 

agreement in principle to resolve this action and the parallel JCCP Case. 

20. During the last session, the parties agreed to terms forming the substance of the 

Settlement. Negotiations of attorneys’ fees, costs, and expenses did not commence until 

agreement on behalf of the Settlement Class had been reached.

21. On September 14, 2018, the parties finalized and agreed to a written term sheet 

containing all material terms of their agreement to settle the case and provide substantial relief to 

the class. 

22. Negotiation of the $50 million Settlement Fund, at least two years of Credit 

Services for the entire class to be paid for outside of the Fund, the costs of notice and 

administration to also be paid separately by Defendants, and the Business Practice Changes was 

hard fought and at arms-length. 

23. Due to the extensive discovery efforts which occurred during this litigation, I,

along with the other members of the PEC, know the strengths and weaknesses of the claims in 

this matter. We have worked extensively with experts to best understand those claims, as well as 

to value those claims.

24. I believe the proposed settlement is extremely beneficial for Settlement Class 

Members and is a fair, adequate, and reasonable settlement of their claims.

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 5 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 6 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

25. Based on my knowledge of this case, knowledge gathered from working with the 

experts in this matter, and my knowledge of claims rates in other data breach cases, I believe the 

$50 million fund will be more than ample to accommodate the amounts drawn from it—

consisting of Out-of-Pocket Costs, Alternative Compensation, Paid User Costs, and Small 

Business User Costs—but, in the event it is not, all claims drawn from it will be reduced pro 

rata. See Settlement Agreement § 6.9.

26. The Alternative Compensation payment—for those class members who already 

have credit monitoring services—will be $100.00. Depending on participation, however, the 

amount could rise to as much as $358.80; the full, two-year retail value of the Credit Monitoring 

Services being offered. 

27. By settling now, the Settlement Class will be able to take advantage of remedies, 

particularly the Credit Monitoring Services, that as a practical matter will be unavailable or 

worth substantially less by the time this case could be litigated to a final judgment. Similarly, 

changes to Yahoo’s data security practices will be most effective the sooner they are 

implemented. 

28. The MDL Case class representatives have been integral to litigating this matter. 

All nine have been significantly and personally involved in the case. Eight had their devices 

forensically imaged and the ninth engaged in prolonged document collection from his devices 

due to confidentiality concerns related to his business. All nine responded to interrogatories and 

document requests, and all nine were deposed. 

29. Importantly, each proposed Settlement Class Representative—both those from the 

MDL Case and those from the JCCP Case—strongly supports the Settlement reached here. 

30. I have carefully examined the facts of each of the Settlement Class 

Representatives to ensure that none of them have any conflicts with the Settlement Class. 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 6 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 7 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

31. Plaintiffs have built a very strong liability case, compiling copious evidence 

concerning the shortcomings in Yahoo’s information security environment at the time of the 

Data Breaches, including the understaffing and underfunding of Yahoo’s information security 

team (the Paranoids), inadequate security logs, and the failure to give notice of the 2014 Breach 

despite contemporaneous knowledge thereof. 

32. While I believe that Plaintiffs had a reasonably good chance of proving that 

Yahoo’s data security was inadequate, I am also cognizant of the risks Plaintiffs faced in further 

litigation.

33. Likewise, Plaintiffs put forth three sound damages models, supported by experts 

Van Dyke, Parilis, and Ratner. These models are premised upon three separate theories: benefit 

of the bargain and restitution, lost value of Personally Identifiable Information (“PII”), and 

identity theft losses. Plaintiffs’ firmly believe in these models and the results they potentially 

produce here. Nonetheless, each of these theories is untested beyond the motion to dismiss 

setting, especially in a data breach case of this scope, and unproven before a jury. 

34. Plaintiffs’ benefit of the bargain theory was proposed by Plaintiffs’ experts James 

Van Dyke and Gary Parilis, and was supported by a conjoint analysis to determine the amount 

Paid Users and Small Business Users overpaid for Yahoo’s services because of the concealed 

security inadequacies. 

35. Plaintiffs proposed two methods of identifying lost value of PII. In the first, 

statistical sampling would determine the PII in an average users’ account and its value in order to 

calculate aggregate damages. In the second, a market-based approach—analyzing the value of 

PII in comparable transactions—would be utilized to determine damages resulting from the 

diminution in value of class members’ PII as a result of the Data Breaches.

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 7 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 8 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

36. Finally, identity theft losses were proposed to be established through a claims 

process, where: (1) temporally, the identity theft followed the Breach(es) in which the PII was 

taken, and (2) the PII taken must have been the same kind needed to commit the identity theft 

suffered. 

37. Thus, while the legal theory behind the largest potential outcomes may be sound, 

it is untested, and, as a practical matter, Plaintiffs’ counsel recognize that taking such large 

numbers to a jury presents substantial strategic risks. Understanding these risks after over three 

decades in the courtroom allowed me to make the assessments necessary to negotiate the 

Settlement achieved in this case. Certainly compromise was required here but the relief provided 

by this Settlement does address the types of damages that I have seen in my experience litigating 

privacy rights since 1999. 

38. This Court appointed the PSC more than a year-and-a-half ago. ECF No. 58. 

This group of attorneys has substantial experience litigating complex class cases of various 

natures, and extensive exposure to the highest profile data breach cases in the country. 

Incorporated by this reference is Joint Application for Appointment of Plaintiffs’ Executive 

Committee, as well as its referenced exhibits (ECF No. 19), filed by the PEC in this matter and 

granted by this Court, which establishes proposed Class Counsel’s credentials and adequacy in 

this matter. 

39. Also, submitted simultaneously herewith, is the declaration of Mr. Daniel 

Robinson. Mr. Robinson was appointed by the JCCP Court as co-lead counsel in that matter and 

has similarly impressive credentials. I have worked closely and personally with Mr. Robinson 

throughout this litigation for purposes of coordinating discovery, especially deposition discovery, 

and during settlement negotiations. He, along with his co-counsel, have agreed to resolve their 

case in concert with this litigation, and have agreed to seek their fees, costs, and expenses, and 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 8 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 9 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Service Awards for their named plaintiffs, solely within the context of this Agreement and before 

this Court. Should the Settlement Agreement be given Final Approval, and reach its Effective 

Date, the JCCP Case will be voluntarily dismissed with prejudice by Mr. Robinson and his cocounsel. 

40. Accordingly, Plaintiffs seek the appointment of: 

a. Lead Settlement Class Counsel: John Yanchunis of Morgan & Morgan 

Complex Litigation Group 

b. Executive Settlement Class Counsel: Stuart Davidson of Robins Geller 

Rudman & Dowd LLP, Gayle Blatt of Casey Gerry Schenk Francavilla Blatt 

& Penfield LLP, Karen Hanson Riebel of Lockridge Grindal Nauen PLLP, 

and Ariana Tadler of Milberg Tadler Phillips Grossman LLP; and,

c. Additional Settlement Class Counsel: Daniel Robinson of Robinson 

Calcagnie, Inc.

Collectively, “Class Counsel.” 

41. The motion for an award of attorneys’ fees, costs, and expenses will be supported 

with detailed lodestar information and an accounting of expenses. As directed by the Court, I 

have implemented efficiency protocols and ensured that work performed in this matter was nonduplicative and contemporaneously recorded. 

42. Having worked on behalf of the putative class since the Data Breaches were first 

announced, and having dedicated thousands of hours to the case, proposed Class Counsel 

endorse the Settlement without reservation. I wholeheartedly endorse the resolution reached 

here on behalf of the Settlement Class, and believe it to be the best, most fulsome resolution of a 

data breach to date, and an excellent outcome within the context of the facts here, specifically. 

43. The parties solicited confidential bids from companies to provide notice and 

administration services in conjunction with the proposed settlement. These companies were 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 9 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 10 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

provided the material terms of the settlement and asked to formulate a notice and media plan that 

would provide the best notice practical to reach the Settlement Class.

44. The parties ultimately chose Heffler Claims Group to propose to the Court to 

serve as the Settlement Administrator. It is our belief that Heffler Claims Group’s proposed 

notice and administration plan will allow for the effective dissemination of notice to the 

Settlement Class, efficient administration of Class claims, and will do so in an economical 

matter.

45. I have reviewed the proposed Long Form Notice, Short Form Notice, and 

Publication Notice (the “Notices”). The Notices clearly explain the background of the case, the 

terms of the settlement, the process and deadlines for filing claims, the deadlines for objecting or 

opting out and how to do so, and how to obtain additional information. Thus, the Notices provide 

all the information necessary for Settlement Class Members to make informed decisions with 

respect to whether they remain in or opt-out of the Settlement Class, or object to the proposed 

Settlement. 

46. I have also reviewed the Notice Plan and believe it will be effective in meeting 

and exceeding the requirements of Due Process for notifying Settlement Class Members. The 

Notice Plan was developed by a provider with significant experience in designing notice plans in 

large and national class actions similar to this one, Jeanne C. Finegan. I have utilized Jeanne 

Finegan’s services in the past and believe her to be one of the best, most knowledge, class notice 

professionals in the world. 

47. Ms. Finegan has reviewed the proposed Notices and offered her input as to 

tailoring them to clearly and effectively notify the Settlement Class Members of their rights 

under the Settlement.

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 10 of 11
DECLARATION OF JOHN YANCHUNIS IN SUPPORT OF PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL - 11 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

48. The $500 per year cap on the amounts Small Business Users can receive in 

reimbursements impacts, if any, only those receiving the highest level of small business services 

from Yahoo—described as Merchant Solutions—and includes a suite of offerings far above and 

beyond email services. 

I declare under penalty of perjury under the laws of the United States of America that the 

foregoing is true and correct. Executed October 22, 2018 in Tampa, Florida.

By: /s/ John A. Yanchunis

 John A. Yanchunis 

Case 5:16-md-02752-LHK Document 330-2 Filed 10/22/18 Page 11 of 11