VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ROBBINS ARROYO LLP

BRIAN J. ROBBINS (190264)

FELIPE J. ARROYO (163803)

SHANE P. SANDERS (237146)

600 B Street, Suite 1900

San Diego, CA 92101

Telephone: (619) 525-3990

Facsimile: (619) 525-3991

E-mail: brobbins@robbinsarroyo.com

farroyo@robbinsarroyo.com

ssanders@robbinsarroyo.com

Attorneys for Plaintiff

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION

DAVID SUMMER, Derivatively on Behalf of

Behalf of YAHOO! INC.,

Plaintiff,

v.

MARISSA A. MAYER, DAVID FILO, 

KENNETH A. GOLDMAN, ERIC K. 

BRANDT, MAYNARD G. WEBB, JR., 

THOMAS J. MCINERNEY, JANE E. SHAW, 

CATHERINE J. FRIEDMAN, TOR R. 

BRAHAM, EDDY W. HARTENSTEIN, 

RICHARD S. HILL, JEFFREY C. SMITH, 

MAX R. LEVCHIN, SUSAN M. JAMES, 

CHARLES R. SCHWAB, H. LEE SCOTT,

JR., and PETER LIGUORI,

Defendants,

and

YAHOO! INC., a Delaware corporation,

Nominal Defendant.

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

)

Case No. 

VERIFIED STOCKHOLDER DERIVATIVE 

COMPLAINT FOR VIOLATIONS OF THE 

FEDERAL SECURITIES LAWS, BREACH 

OF FIDUCIARY DUTIES, AND UNJUST 

ENRICHMENT

DEMAND FOR JURY TRIAL

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 1 of 33
- 1 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

NATURE AND SUMMARY OF THE ACTION

1. This is a stockholder derivative action brought by plaintiff on behalf of Yahoo! Inc. 

("Yahoo" or the "Company") against certain of its officers and directors for violations of the federal 

securities laws, breach of fiduciary duties, unjust enrichment, and other violations of law at the 

expense of the Company. These wrongs have resulted in hundreds of millions of dollars in damages 

to Yahoo and other damages, such as to its reputation and goodwill. Further, it threatens the massive 

$4.8 billion acquisition of Yahoo's core assets by Verizon Communications Inc. ("Verizon").

2. In 2013 and 2014, Yahoo was subjected to two massive data breaches. In the 2014

data breach, 500 million Yahoo accounts were compromised. The 2013 data breach was even 

bigger, compromising approximately one billion accounts. The 2013 and 2014 data breaches are 

the largest ever reported. Yahoo has attributed the hack to a "state-sponsored actor."

3. The stolen information includes Yahoo users' names e-mail addresses, telephone 

numbers, dates of birth, passwords, and, in some cases, security questions and answers (the "Private 

Information"). Though the Company says there was no bank account information or payment card 

data stolen, the Private Information theft can still have significant detrimental effects on a Yahoo 

user. The Private Information can be used by hackers and others unscrupulous characters to create 

false identities. In addition, many people use the same passwords for multiple accounts and thus, 

the same password used for a Yahoo account can be used for an online bank account. 

4. Just as troubling as the data breaches themselves, however, is that the Company 

failed to notify users and the public in general about these data breaches for years. Yahoo has 

admitted that it "identified that a state-sponsored actor had access to the Company's network in late 

2014." Yet, it waited until September 22, 2016, to notify its users about the 2014 data breach. The 

Company did not inform users about the 2013 data breach until December 14, 2016. Thus, for two 

years after Yahoo learned of the data breaches, Yahoo's users continued using their yahoo accounts 

unaware that hackers had access to their personal information including, in some cases, passwords. 

5. In addition to being morally wrong, Yahoo's delay in notifying its users of the 

data breaches was unreasonable and therefore illegal. Yahoo's affected users have been quick to act. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 2 of 33
- 2 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

As of the Company's most recent quarterly filing, twenty-three consumer class actions have been 

filed against Yahoo thus far. 

6. The data breaches and the Company's knowledge of the data breaches since 2014, 

also renders defendants' statements about Yahoo's data security, including the efficacy of its 

encryption of user data, false and misleading. Upon disclosure of the data breaches, Yahoo's market 

capitalization fell 4.21%, or $1,770,315,612, between September 22, 2016 and September 26, 2016, 

and 6.11%, or $2,385,311,205 between December 14, 2016 and December 15, 2016. As a result, an 

investor in the Company's stock has filed a class action against Yahoo and certain of its insiders 

for securities fraud. In addition, the U.S. Securities and Exchange Commission ("SEC") is looking 

into the timeliness of the Company's disclosures.

7. Now that the defendants have finally alerted the public to the data breaches, Yahoo

notified many of its users that they must change their passwords. Experts have stated that rather 

than changing passwords, Yahoo's users are likely to drop the service altogether. Indeed, for years, 

defendants have admitted in Yahoo's public filings that "[if] our security measures are breached, 

our products and services may be perceived as not being secure, users and customers may curtail or 

stop using our products and services, and we may incur significant legal and financial exposure." 

The financial impact of the data breaches has led to speculation that Verizon may walk away from its 

offer to purchase most of Yahoo for $6 billion.1

JURISDICTION AND VENUE

8. Pursuant to 28 U.S.C. §1331 and section 27 of the Securities Exchange Act of 1934 

(the "Exchange Act"), this Court has jurisdiction over the claims asserted herein for violations of 

sections 14(a) and 20(a) of the Exchange Act and SEC Rule 14a-9 promulgated thereunder. This 

Court has supplemental jurisdiction over the remaining claims under 28 U.S.C. §1367. 

9. Jurisdiction is also conferred by 28 U.S.C. §1332. Complete diversity among the 

 

1

See, e.g., Reinhardt Krause, Yahoo Discloses New, Bigger Data Breach; Verizon May Scrap: 

Reports, Investor's Bus. Daily (Dec. 15, 2016) http://www.investors.com/news/technology/yahooadmits-one-billion-accounts-breached-verizon-deal-in-jeopardy/.

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 3 of 33
- 3 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

parties exists and the amount in controversy exceeds $75,000, exclusive of interest and costs.

10. This Court has jurisdiction over each defendant named herein because each 

defendant is either a corporation that conducts business in and maintains operations in this District, 

or is an individual who has sufficient minimum contacts with this District to render the exercise of 

jurisdiction by the District courts permissible under traditional notions of fair play and substantial 

justice. 

11. Venue is proper in this Court in accordance with 28 U.S.C. §1391(a) because: 

(i) Yahoo maintains its principal place of business in this District; (ii) one or more of the defendants 

either resides in or maintains executive offices in this District; (iii) a substantial portion of the 

transactions and wrongs complained of herein, including the defendants' primary participation in the 

wrongful acts detailed herein, and aiding and abetting and conspiracy in violation of fiduciary duties 

owed to Yahoo, occurred in this District; and (iv) defendants have received substantial compensation 

in this District by doing business here and engaging in numerous activities that had an effect in this 

District.

INTRADISTRICT ASSIGNMENT

12. A substantial portion of the transactions and wrongdoings which give rise to the 

claims in this action occurred in the County of Santa Clara, and as such, this action is properly 

assigned to the San Jose division of this Court.

THE PARTIES

Plaintiff

13. Plaintiff David Summer is a stockholder of Yahoo and has continuously held stock 

since March 7, 2013. Plaintiff is a citizen of Massachusetts.

Nominal Defendant 

14. Nominal defendant Yahoo is a Delaware corporation with principal executive 

offices located at 701 First Avenue, Sunnyvale, California. Accordingly, Yahoo is a citizen of 

Delaware and California. Yahoo together with its consolidated subsidiaries is a guide to digital 

information discovery, focused on informing, connecting, and entertaining users through its search, 

communications, and digital content products. Yahoo's revenue is generated principally from search 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 4 of 33
- 4 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

and display advertising. Yahoo continues to manage and measure its business geographically, 

principally in the Americas, EMEA (Europe, Middle East, and Africa), and Asia Pacific. As of 

September 30, 2016, Yahoo had approximately 8,500 full-time employees and approximately 600 

contractors.

Defendants

15. Defendant Marissa A. Mayer ("Mayer") is Yahoo's Chief Executive Officer ("CEO"), 

President, and director and has been since July 2012. Defendant Mayer knowingly, recklessly, or 

with gross negligence made improper statements in the Company's press releases and public filings

concerning the Company's data security and failed to reveal in a reasonable amount of time that the 

Company's users' data was exposed in the data breaches. While in possession of material, nonpublic information concerning Yahoo's true business health, defendant Mayer sold 1,236,000 shares 

of her stock for $51,401,708.40 in proceeds. Yahoo paid defendant Mayer the following 

compensation as an executive:

Defendant Mayer is a citizen of California.

16. David Filo ("Filo") is Yahoo's Chief Yahoo and has been since March 1995 and a 

director and has been since June 2014. Defendant Filo founded Yahoo in March 1995. 

Defendant Filo was also a director from March 1995 to February 1996. Defendant Filo knowingly, 

recklessly, or with gross negligence made improper statements in the Company's press releases and 

public filings concerning the Company's data security and failed to reveal in a reasonable amount of 

time that the Company's users' data was exposed in the data breaches. Yahoo paid defendant Filo 

the following compensation as an executive:

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 5 of 33
- 5 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Defendant Filo is a citizen of California.

17. Kenneth A. Goldman ("Goldman") is Yahoo's Chief Financial Officer ("CFO") and 

has been since October 2012. Defendant Goldman knowingly, recklessly, or with gross negligence 

made improper statements in the Company's press releases and public filings concerning the 

Company's data security and failed to reveal in a reasonable amount of time that the Company's 

users' data was exposed in the data breaches. While in possession of material, non-public 

information concerning Yahoo's true business health, defendant Goldman sold 350,194 shares of 

his stock for $12,629,632.56 in proceeds. Yahoo paid defendant Goldman the following 

compensation as an executive:

Defendant Goldman is a citizen of California.

18. Eric K. Brandt ("Brandt") is Yahoo's Chairman of the Board of Directors (the 

"Board") and has been since January 2017 and a director and has been since March 2016. 

Defendant Brandt is Chairman of Yahoo's Audit and Finance Committee and has been since April 

2016 and a member of that committee and has been March 2016. Defendant Brandt knowingly 

or recklessly made improper statements in the Company's press releases and public filings

concerning the Company's data security and failed to reveal in a reasonable amount of time that the 

Company's users' data was exposed in the data breaches. Defendant Brandt is a citizen of 

California.

19. Defendant Maynard G. Webb, Jr. ("Webb") is Yahoo's Chairman of the Board 

Emeritus and has been since January 2017 and a director and has been since February 2012. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 6 of 33
- 6 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Defendant Webb was also Yahoo's Chairman of the Board from August 2013 to January 2017 and 

was also Yahoo's Interim Chairman of the Board from April 2013 to August 2013. Defendant 

Webb was also a member of Yahoo's Audit and Finance Committee from at least May 2013 to at 

least May 2014 and from February 2016 to April 2016. Defendant Webb knowingly or recklessly 

made improper statements in the Company's press releases and public filings concerning the 

Company's data security and failed to reveal in a reasonable amount of time that the Company's 

users' data was exposed in the data breaches. Yahoo paid defendant Webb the following 

compensation as a director:

Fiscal Year Stock Awards

Option 

Awards Total

2015 $509,908 $0 $509,908

2014 $219,982 $256,794 $476,776

2013 $219,978 $210,671 $430,649

Defendant Webb is a citizen of California.

20. Defendant Thomas J. McInerney ("McInerney") is a Yahoo director and has been 

since April 2012. Defendant McInerney is also a member of Yahoo's Audit and Finance Committee 

and has been since at least May 2013. Defendant McInerney knowingly or recklessly made 

improper statements in the Company's press releases and public filings concerning the Company's 

data security and failed to reveal in a reasonable amount of time that the Company's users' data was 

exposed in the data breaches. Yahoo paid defendant McInerney the following compensation as a 

director:

Fiscal Year Fees Paid in Cash Stock Awards Total

2015 $70,000 $239,990 $309,990

2014 $90,000 $219,982 $309,982

2013 $90,000 $219,978 $309,978

Defendant McInerney is a citizen of New York.

21. Defendant Jane E. Shaw ("Shaw") is a Yahoo director and has been since June 2014. 

Defendant Shaw knowingly or recklessly made improper statements in the Company's press 

releases and public filings concerning the Company's data security and failed to reveal in a 

reasonable amount of time that the Company's users' data was exposed in the data breaches. Yahoo

paid defendant Shaw the following compensation as a director:

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 7 of 33
- 7 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Fiscal Year Fees Paid in Cash Stock Awards Total

2015 $95,000 $239,990 $334,990

2014 $42,460 $219,982 $262,442

Defendant Shaw is a citizen of California.

22. Defendant Catherine J. Friedman ("Friedman") is a Yahoo director and has been since 

March 2016. Defendant Friedman knowingly or recklessly made improper statements in the 

Company's press releases and public filings concerning the Company's data security and failed to 

reveal in a reasonable amount of time that the Company's users' data was exposed in the data 

breaches. Defendant Friedman is a citizen of California.

23. Defendant Tor R. Braham ("Braham") is a Yahoo director and has been since April 

2016. Defendant Braham is also a member of Yahoo's Audit and Finance Committee and has been 

since April 2016. Defendant Braham knowingly or recklessly made improper statements in the 

Company's press releases and public filings concerning the Company's data security and failed to 

reveal in a reasonable amount of time that the Company's users' data was exposed in the data 

breaches. Defendant Braham is a citizen of California.

24. Defendant Eddy W. Hartenstein ("Hartenstein") is a Yahoo director and has been 

since April 2016. Defendant Hartenstein knowingly or recklessly made improper statements in the 

Company's press releases and public filings concerning the Company's data security and failed to 

reveal in a reasonable amount of time that the Company's users' data was exposed in the data 

breaches. Defendant Hartenstein is a citizen of California.

25. Defendant Richard S. Hill ("Hill") is a Yahoo director and has been since April 2016. 

Defendant Hill knowingly or recklessly made improper statements in the Company's press releases 

and public filings concerning the Company's data security and failed to reveal in a reasonable 

amount of time that the Company's users' data was exposed in the data breaches. Defendant Hill is a 

citizen of Nevada.

26. Defendant Jeffrey C. Smith ("Smith") is a Yahoo director and has been since April 

2016. Defendant Smith knowingly or recklessly made improper statements in the Company's press 

releases and public filings concerning the Company's data security and failed to reveal in a 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 8 of 33
- 8 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

reasonable amount of time that the Company's users' data was exposed in the data breaches. 

Defendant Smith is a citizen of New York.

27. Defendant Max R. Levchin ("Levchin") was a Yahoo director from December 2012 

to December 2015. Defendant Levchin knowingly or recklessly made improper statements in the 

Company's press releases and public filings concerning the Company's data security and failed to 

reveal in a reasonable amount of time that the Company's users' data was exposed in the data 

breaches. Yahoo paid defendant Levchin the following compensation as a director:

Fiscal 

Year Stock Awards

Option 

Awards Total

2015 $295,487 $0 $295,487

2014 $219,982 $68,679 $288,661

2013 $219,978 $73,338 $293,316

Defendant Levchin is a citizen of California.

28. Defendant Susan M. James ("James") was a Yahoo director from January 2010 to 

June 2016. Defendant James was also Chairman of Yahoo's Audit and Finance Committee from at 

least May 2013 to April 2016. Defendant James knowingly or recklessly made improper statements 

in the Company's press releases and public filings concerning the Company's data security and 

failed to reveal in a reasonable amount of time that the Company's users' data was exposed in the 

data breaches. While in possession of material, non-public information concerning Yahoo's true 

business health, defendant James sold 20,000 shares of her stock for $879,911.89 in proceeds. 

Yahoo paid defendant James the following compensation as a director:

Fiscal Year Fees Paid in Cash Stock Awards Total

2015 $95,000 $239,990 $334,990

2014 $115,000 $219,982 $334,982

2013 $0 $334,894 $334,894

Defendant James is a citizen of California.

29. Defendant Charles R. Schwab ("Schwab") was a Yahoo director from June 2014 to 

February 2016. Defendant Schwab was also a member of Yahoo's Audit and Finance Committee 

from June 2014 to February 2016. Defendant Schwab knowingly or recklessly made improper

statements in the Company's press releases and public filings concerning the Company's data 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 9 of 33
- 9 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

security and failed to reveal in a reasonable amount of time that the Company's users' data was 

exposed in the data breaches. Yahoo paid defendant Schwab the following compensation as a

director:

Fiscal Year Stock Awards

Option 

Awards Total

2015 $309,923 $0 $309,923

2014 $219,982 $37,969 $257,951

Defendant Schwab is a citizen of California.

30. Defendant H. Lee Scott, Jr. ("Scott") was a Yahoo director from June 2014 to June 

2016. Defendant Scott knowingly or recklessly made improper statements in the Company's press 

releases and public filings concerning the Company's data security and failed to reveal in a 

reasonable amount of time that the Company's users' data was exposed in the data breaches. Yahoo 

paid defendant Scott the following compensation as a director:

Fiscal Year Stock Awards

Option 

Awards Total

2015 $314,898 $0 $314,898

2014 $219,982 $40,075 $260,057

Defendant Scott is a citizen of Florida.

31. Defendant Peter Liguori ("Liguori") was a Yahoo director from April 2012 to June 

2014. Defendant Liguori knowingly or recklessly made improper statements in the Company's 

press releases and public filings concerning the Company's data security and failed to reveal in a 

reasonable amount of time that the Company's users' data was exposed in the data breaches.

Defendant Liguori is a citizen of Pennsylvania.

32. The defendants identified in ¶¶15-17 are referred to herein as the "Officer 

Defendants." The defendants identified in ¶¶15-16, 18-31 are referred to herein as the "Director 

Defendants." The defendants identified in ¶¶18-20, 28-29 are referred to herein as the "Audit and 

Finance Committee Defendants." Collectively, the defendants identified in ¶¶15-31 are referred to 

herein as the "Individual Defendants."

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 10 of 33
- 10 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DUTIES OF THE INDIVIDUAL DEFENDANTS

Fiduciary Duties of the Individual Defendants

33. By reason of their positions as officers, directors, and/or fiduciaries of Yahoo and 

because of their ability to control the business and corporate affairs of Yahoo, the Individual 

Defendants owed Yahoo and its stockholders fiduciary obligations of trust, loyalty, good faith, and 

due care, and were and are required to use their utmost ability to control and manage Yahoo in a fair, 

just, honest, and equitable manner. The Individual Defendants were and are required to act in 

furtherance of the best interests of Yahoo and its stockholders so as to benefit all stockholders 

equally and not in furtherance of their personal interest or benefit.

34. Each officer and director of the Company owes to Yahoo and its stockholders the 

fiduciary duty to exercise good faith and diligence in the administration of the affairs of the 

Company and in the use and preservation of its property and assets, and the highest obligations of 

fair dealing. In addition, as officers and/or directors of a publicly held company, the Individual 

Defendants had a duty to promptly disseminate accurate and truthful information with regard to the 

Company's operations, performance, management, projections, and forecasts so that the market 

price of the Company's stock would be based on truthful and accurate information. During fiscal 

2015, the Board met nineteen times.

Additional Duties of the Audit and Finance Committee Defendants

35. The Audit and Finance Committee Defendants, defendants Brandt, Webb, 

McInerney, Braham, James, and Schwab, owed specific duties to Yahoo, under its Charter in effect 

since January 17, 2014. 

36. Foremost, the Audit and Finance Committee is to assist in the "oversight of (i) the 

integrity of the Company's financial statements, (ii) the accounting and financial reporting processes 

of the Company and the audits of the financial statements of the Company, [and] (iii) the Company's 

compliance with legal and regulatory requirements." The Audit and Finance Committee is also 

required to review and discuss with management the Company's administrative, operational, and 

accounting controls, including any factors that could materially affect the Company's internal 

controls and any special steps adopted in light of the discovery of any material weaknesses. The 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 11 of 33
- 11 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Audit and Finance Committee must: 

(a) review the Company's financial risk assessment and financial risk 

management policies;

(b) review the Company's quarterly and annual financial statements;

(c) review major issues regarding accounting principles and financial statements 

presentations;

(d) review the Company's earnings press releases; and

(e) meet periodically with Yahoo's General Counsel to review legal and 

regulatory matters, including any matters that may have a material impact on the financial statements 

of the Company.

37. Finally, the Audit and Finance Committee is required to evaluate whether the 

Company is operating in accordance with its prescribed policies, procedures, and codes of conduct. 

Control, Access, and Authority

38. The Individual Defendants, because of their positions of control and authority as 

directors and/or officers of Yahoo, were able to and did, directly and/or indirectly, exercise control 

over the wrongful acts complained of herein, as well as the contents of the various public statements 

issued by the Company. 

39. Because of their advisory, executive, managerial, and directorial positions with 

Yahoo, each of the Individual Defendants had access to adverse, non-public information about the 

financial condition, operations, and improper representations of Yahoo, including information 

regarding the several factors negatively impacting the Company's performance.

40. At all times relevant hereto, each of the Individual Defendants was the agent of each 

of the other Individual Defendants and of Yahoo, and was at all times acting within the course and 

scope of such agency.

Reasonable and Prudent Supervision

41. To discharge their duties, the officers and directors of Yahoo were required to 

exercise reasonable and prudent supervision over the management, policies, practices, and controls 

of the financial affairs of the Company. By virtue of such duties, the officers and directors of Yahoo

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 12 of 33
- 12 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

were required to, among other things:

(a) ensure that the Company complied with its legal obligations and requirements, 

including acting only within the scope of its legal authority and disseminating truthful and accurate 

statements to the investing public;

(b) conduct the affairs of the Company in an efficient, business-like manner so as 

to make it possible to provide the highest quality performance of its business;

(c) properly and accurately guide investors and analysts as to the true financial 

condition of the Company at any given time, including making accurate statements about the 

Company's financial results;

(d) remain informed as to how Yahoo conducted its operations, and, upon receipt 

of notice or information of imprudent or unsound conditions or practices, make reasonable inquiry in 

connection therewith, and take steps to correct such conditions or practices and make such 

disclosures as necessary to comply with securities laws; and

(e) ensure that the Company was operated in a diligent, honest, and prudent 

manner in compliance with all applicable laws, rules, and regulations.

Breaches of Duties

42. Each Individual Defendant, by virtue of his or her position as a director and/or 

officer, owed to the Company and to its stockholders the fiduciary duty of loyalty and good faith and 

the exercise of due care and diligence in the management and administration of the affairs of the 

Company, as well as in the use and preservation of its property and assets. The conduct of the 

Individual Defendants complained of herein involves a knowing and culpable violation of their 

obligations as directors and officers of Yahoo, the absence of good faith on their part, and a reckless 

disregard for their duties to the Company and its stockholders that the Individual Defendants were 

aware or should have been aware posed a risk of serious injury to the Company. The conduct of the 

Individual Defendants who were also officers and/or directors of the Company have been ratified by 

the remaining Individual Defendants who collectively comprised all of Yahoo's Board.

43. The Individual Defendants breached their duty of loyalty and good faith by allowing 

defendants to cause, or by themselves causing, the Company to misrepresent its financial results and 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 13 of 33
- 13 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

delay the reporting of the data breaches, as detailed herein, and by failing to prevent the Individual 

Defendants from taking such illegal actions. In addition, as a result of defendants' illegal actions 

and course of conduct, the Company is now the subject of consumer class actions and a securities 

class action alleging securities law violations in connection with the improper financial reporting. 

As a result, Yahoo has expended, and will continue to expend, significant sums of money. 

CONSPIRACY, AIDING AND ABETTING, AND CONCERTED ACTION

44. In committing the wrongful acts alleged herein, the Individual Defendants have 

pursued, or joined in the pursuit of, a common course of conduct, and have acted in concert with and 

conspired with one another in furtherance of their common plan or design. In addition to the 

wrongful conduct herein alleged as giving rise to primary liability, the Individual Defendants further 

aided and abetted and/or assisted each other in breaching their respective duties.

45. During all times relevant hereto, the Individual Defendants, collectively and 

individually, initiated a course of conduct that was designed to and did: (i) conceal the fact that the 

Company had experienced massive data breaches; (ii) enhance the Individual Defendants' executive 

and directorial positions at Yahoo and the profits, power, and prestige that the Individual 

Defendants enjoyed as a result of holding these positions; and (iii) deceive the Company's users and 

the investing public, including stockholders of Yahoo, regarding the Individual Defendants'

management of Yahoo's operations. In furtherance of this plan, conspiracy, and course of conduct, 

the Individual Defendants, collectively and individually, took the actions set forth herein.

46. The Individual Defendants engaged in a conspiracy, common enterprise, and/or 

common course of conduct. During this time, the Individual Defendants caused the Company to 

issue improper financial results based upon the failure to disclose the several factors negatively 

impacting the Company's performance. 

47. The purpose and effect of the Individual Defendants' conspiracy, common enterprise, 

and/or common course of conduct was, among other things, to disguise the Individual Defendants'

violations of federal securities laws, breach of fiduciary duties, and unjust enrichment, and to 

conceal adverse information concerning the Company's operations, financial condition, and future 

business prospects. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 14 of 33
- 14 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

48. The Individual Defendants accomplished their conspiracy, common enterprise, 

and/or common course of conduct by causing the Company to purposefully, recklessly, or 

negligently release improper statements. Because the actions described herein occurred under the 

authority of the Board, each of the Individual Defendants was a direct, necessary, and substantial 

participant in the conspiracy, common enterprise, and/or common course of conduct complained of 

herein.

49. Each of the Individual Defendants aided and abetted and rendered substantial 

assistance in the wrongs complained of herein. In taking such actions to substantially assist the 

commission of the wrongdoing complained of herein, each Individual Defendant acted with 

knowledge of the primary wrongdoing, substantially assisted the accomplishment of that 

wrongdoing, and was aware of his or her overall contribution to and furtherance of the wrongdoing.

FACTUAL BACKGROUND 

50. Yahoo describes itself as a "guide to digital information discovery." The Company 

strives to create "highly personalized experiences" which "help[s] users discover the information that 

matters most to them around the world." Yahoo users can create accounts with Yahoo to access 

different services provided by the Company. To create an account, a user must provide Yahoo with 

private information, including a username and password. 

51. The Company's revenue is generated principally from display and search 

advertising. Yahoo places "cookies" on users' computers when they login. The cookies contain 

personalized information that allows Yahoo to identify a user. Cookies can contain a great detail of 

information, such as browsing activity and information users enter into form fields. A specific type 

of cookie, an "authentication cookie," occurs after a user authenticates itself and tells a website it 

can send sensitive information to a user. 

52. The Company does not hide that it collects its users' personal information. It 

explicitly states that "Yahoo collects personal information when you register with Yahoo" and 

"when you register we ask for information such as your name, email address, birth date, gender, ZIP 

code, occupation, industry and personal interests. For some financial products and services we 

might also ask for your address, Social Security number, and information about your assets." The 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 15 of 33
- 15 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Company also admits that it analyzes and stores all of its users' communications content, including 

e-mail content. Further, "Yahoo automatically receives and records information from your 

computer and browser, including your IP address, Yahoo cookie information, software and hardware 

attributes, and the page you request." Thus, the amount of personal private data that the Company 

stores about its users is massive. It is also well known that it has this information since Yahoo 

publicly states it collects this information, making the Company a prime target for hackers. 

Individuals, however, feel comfortable using Yahoo's services because it claims on its website that it 

is "'committed to ensuring [users'] information is protected and [it] applies safeguards in accordance 

with applicable law"' and "[the Company has] physical, electronic, and procedural safeguards that 

comply with federal regulations to protect personal information about you."

53. On July 25, 2016, Yahoo announced that it agreed to sell its core assets to Verizon 

for $4.8 billion. As part of the agreement, Yahoo represented to Verizon that it was unaware of any 

security breaches. 

THE DATA BREACHES AND RESPONSE

54. Yahoo has been subjected to hacks and data breaches in the past. In 2012, over 

400,000 unencrypted Yahoo usernames and passwords were stolen and posted on a public website. 

In 2013, Yahoo Japan suffered a security breach, which exposed the personal data of twenty-two

million users. 

55. In late 2014, a "state-sponsored actor" stole the account information of 500 million 

Yahoo users. The account information included names, e-mail addresses, telephone numbers, dates 

of birth, passwords, and security questions and answers. The public was unaware of the data breach 

at the time. Instead, it was not until rumors of the breach began to leak out to the public in August 

2016, when a hacker by the name of "Peace" claimed to be selling data from 200 million Yahoo 

users online that people began looking into whether Yahoo's users' data was illegally accessed. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 16 of 33
- 16 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

56. In early August, Yahoo stated that it was "aware of [Peace's] claim" and was 

"working to determine the facts" but provided no other details.2 According to reports, Yahoo's

awareness of "Peace's" claim extended to the Company's CEO, defendant Mayer.3 And, in fact, 

reports claimed that defendant Mayer and key executives had been engaged "from the very 

beginning."

57. Nearly two months later, on September 22, 2016, Yahoo confirmed that data 

associated with 500 million users' accounts were stolen. Yahoo told users to change their password 

and security questions and review their accounts for suspicious activity. Verizon stated that Yahoo 

told it about the breach just two days earlier. 

58. Yahoo was heavily criticized for taking two months to report the breach to the 

public. Senator Richard Blumenthal stated that "'[i]f Yahoo knew about the hack as early as August, 

and failed to coordinate with law enforcement, taking this long to confirm the breach is a blatant 

betrayal of their users' trust.'"4 Senator Blumenthal called on law enforcement and regulators to 

"'investigate whether Yahoo may have concealed its knowledge of this breach in order to artificially 

bolster its valuation in its pending acquisition by Verizon."'

59. While Senator Blumenthal's anger over a two month delay was justified, it turns out 

that the Company had actually known about the 2014 data breach soon after it occurred. The 

Company revealed in its Quarterly Report on Form 10-Q filed with the SEC on November 9, 2016, 

that it identified that a state sponsored actor had access to Yahoo's network in late 2014. 

60. Yahoo's delay violated various state laws. Forty-seven states require companies to 

alert consumers when they have been hacked. The exact notice period required under state law 

 

2

Tom Mendelsohn, Yahoo Investigating Claimed Breach and Data Dump of 200 Million Users, 

ARS Technical (Aug. 3, 2016) https://arstechnica.com/security/2016/08/yahoo-email-data-breachdump/.

3 Madhumita Murgiz, et al., Marissa Mayer Knew of Yahoo Breach Probe in July, Financial Times 

(Sept. 23, 2016) https://www.ft.com/content/d0d07444-81aa-11e6-bc52-0c7211ef3198.

4

Seth Fiegerman, Yahoo Says 500 Million Accounts Stolen, CNN Tech (Sept. 23, 2016)

http://money.cnn.com/2016/09/22/technology/yahoo-data-breach/.

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 17 of 33
- 17 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

varies, with some states requiring notice within thirty or forty-five days, while others use general 

language, such as "as soon as expedient" and 'without unreasonable delay." Yahoo's terms of 

service state that users agree that the laws of the state of California will govern all claims between a 

user and Yahoo. Under California Civil Code section 1798.82, Yahoo was required to inform users 

of the data breach "in the most expedient time possible and without unreasonable delay." Under no 

circumstance could a two year delay be considered expedient or reasonable. Unsurprisingly then, 

soon after the public learned of the data breach and Yahoo sitting on this information, the Company 

was sued in multiple class actions. According to the Company's most recent Quarterly Report on 

Form 10-Q, twenty-three consumer class actions lawsuits have been filed against Yahoo thus far. 

61. The bad news continued for the Company. On December 14, 2016, Yahoo disclosed 

that in a separate incident in 2013, hackers stole data from at least one billion accounts. The 

attackers forged the cookies that Yahoo places on user computers, including the authentication 

cookies. By forging the authentication cookies the hackers could gain access to the targeted 

accounts without ever having the user's password and would also allow the hacker to remain logged 

into a user's account indefinitely. 

62. Questions about the data breaches persist to this day. It is not just the public that 

defendants are stonewalling, but U.S. Senators as well. Yahoo's representatives were supposed to 

meet with members of the Senate Commerce Committee on January 31, 2017. The Company 

abruptly canceled that meeting on January 28, 2017. Senators John Thune and Jerry Moran wrote to 

defendant Mayer expressing their dismay at this "last minute" cancellation. The Senators, in their 

letter, stated that the Company's last minute cancellation "has prompted concerns about [Yahoo's] 

willingness to deal with Congress with complete candor about [the data breaches]." Further, the 

letter stated that "[d]espite several inquiries by Committee staff seeking information about the 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 18 of 33
- 18 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

security of Yahoo! user accounts, company officials have thus far been unable to provide answers 

to many basic questions."5

DEFENDANTS' IMPROPER STATEMENTS

63. Defendants' failure to acknowledge the data breaches while repeatedly pointing out 

that such breaches could have a material effect on it rendered Yahoo's public statements improper. 

On November 12, 2013, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, announcing

the Company's financial and operating results for the quarter ended September 30, 2013. The 

Quarterly Report acknowledges the potential harm that might result from a data breach. Despite 

acknowledging the materiality of a data breach to the Company, it does not mention that Yahoo was 

victim to the largest ever data breach. In particular, Yahoo stated:

If our security measures are breached, our products and services may be

perceived as not being secure, users and customers may curtail or stop using

our products and services, and we may incur significant legal and financial

exposure.

Our products and services involve the storage and transmission of Yahoo's users'

and customers' personal and proprietary information in our facilities and on our

equipment, networks and corporate systems. Security breaches expose us to a

risk of loss of this information, litigation, remediation costs, increased costs for

security measures, loss of revenue, damage to our reputation, and potential

liability. Our user data and corporate systems and security measures have been

and may in the future be breached due to the actions of outside parties (including

cyber attacks), employee error, malfeasance, a combination of these, or otherwise,

allowing an unauthorized party to obtain access to our data or our users' or

customers' data. Additionally, outside parties may attempt to fraudulently induce

employees, users, or customers to disclose sensitive information in order to gain

access to our data or our users' or customers' data.

Any breach or unauthorized access could result in significant legal and financial

exposure, increased remediation and other costs, damage to our reputation and a

loss of confidence in the security of our products, services and networks that

could potentially have an adverse effect on our business. Because the techniques

used to obtain unauthorized access, disable or degrade service, or sabotage systems

change frequently or may be designed to remain dormant until a predetermined event

and often are not recognized until launched against a target, we may be unable to

 

5 Robert McMillan, Senators Question Yahoo's Candor on Data Breach, Wall St. J. (Feb. 13, 2017, 

9:41 a.m.) https://www.wsj.com/articles/senators-question-yahoos-candor-on-data-breach-148678

8867.

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 19 of 33
- 19 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

anticipate these techniques or implement adequate preventative measures. If an

actual or perceived breach of our security occurs, the market perception of the

effectiveness of our security measures could be harmed and we could lose users and 

customers.

64. Defendants Mayer, Goldman, Webb, James, Levchin, Liguori, and McInerney made 

the same statements without acknowledging the 2013 data breach in the Company's Annual Report

on Form 10-K filed with the SEC on February 28, 2014. 

65. In fact, for the next three years, every one of the Company's quarterly filings and 

yearly filings contains nearly the exact same language. Despite Yahoo's knowledge of the data 

breaches, no mention of them ever occurs until September 2016. Even then, as described above, it 

was only after rumors began circulating that a hacker named "Peace" was selling information linked 

to hundreds of millions of Yahoo users' accounts. The Individual Defendants' failure to include this 

known material event that admitted could significantly harm the Company in its public filings 

renders them materially improper. 

66. In particular, the following public filings are misleading, Yahoo's: (a) Quarterly

Report on Form 10-Q announcing the Company's financial and operating results for the quarter

ended March 31, 2014; (b) Quarterly Report on Form 10-Q announcing the Company's financial

and operating results for the quarter ended June 30, 2014; (c) Quarterly Report on Form 10-Q

announcing the Company's financial and operating resultsfor the quarter ended September 30, 2014; 

(d) Annual Report on Form 10-K announcing the Company's financial and operating results for

the quarter and year ended December 31, 2014, which was signed by defendants Mayer, Goldman, 

Webb, Filo, James, Levchin, McInerney, Schwab, Scott, and Shaw; (e) Quarterly Report on Form

10-Q announcing the Company's financial and operating results for the quarter ended March 31,

2015; (f) Quarterly Report on Form 10-Q announcing the Company's financial and operating

results for the quarter ended June 30, 2015; (g) Quarterly Report on Form 10-Q announcing the

Company's financial and operating results for the quarter ended September 30, 2015; (h) Annual

Report on Form 10-K announcing the Company's financial and operating results for the quarter

and year ended December 31, 2015, signed by defendants Mayer, Goldman, Webb, Filo, James, 

McInerney, Scott, and Shaw; (i) Quarterly Report on Form 10-Q announcing the Company's

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 20 of 33
- 20 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

financial and operating results for the quarter ended March 31, 2016; and (j) Quarterly Report on

Form 10-Q announcing the Company's financial and operating results for the quarter ended June 30,

2016.

67. In addition, on July 25, 2016, Yahoo announced that it entered into a purchase 

agreement with Verizon. Pursuant to the agreement, Verizon will acquire the operating business of 

Yahoo for $4.8 billion. The announcement of the purchase attached the actual purchase agreement. 

The purchase agreement specifically states that Yahoo does not know of any data breaches. In 

particular, it states:

[A]ny incidents of, or third party claims alleging, (i) Security Breaches, unauthorized 

access or unauthorized use of any of Seller's or the Business Subsidiaries'

information technology systems or (ii) loss, theft, unauthorized access or acquisition, 

modification, disclosure, corruption, or other misuse of any Personal Data in Seller's 

or the Business Subsidiaries' possession, or other confidential data owned by Seller 

or the Business Subsidiaries (or provided to Seller or the Business Subsidiaries by 

their customers) in Seller's or the Business Subsidiaries' possession, in each case (i) 

and (ii) that could reasonably be expected to have a Business Material Adverse 

Effect. Neither Seller nor the Business Subsidiaries have notified in writing, or to the 

Knowledge of Seller, been required by applicable Law or a Governmental Authority 

to notify in writing, any Person of any Security Breach. To the Knowledge of Seller, 

neither Seller nor the Business Subsidiaries have received any notice of any claims, 

investigations (including investigations by a Governmental Authority), or alleged 

violations of Laws with respect to Personal Data possessed by Seller or the Business 

Subsidiaries, in each case that could reasonably be expected to have a Business 

Material Adverse Effect. 

THE DISCLOSURE OF THE DATA BREACHES 

DECIMATES YAHOO'S MARKET CAPITALIZATION

68. As stated above, on September 22, 2016, Yahoo disclosed the 2014 data breach. On 

this news, Yahoo's market capitalization fell $1,770,315,612, a 4.21% drop. 

69. On December 14, 2016, Yahoo disclosed the massive 2013 data breach. On this 

news, Yahoo's market capitalization fell $2,385,311,205, a 6.11 % drop. 

THE MATERIALLY MISLEADING PROXY STATEMENTS

70. On April 29, 2015, defendants Filo, James, Levchin, Mayer, McInerney, Schwab, 

Scott, Shaw, and Webb, caused Yahoo to file with the SEC a Proxy Statement on Schedule 14A in 

connection with the 2015 Annual Meeting of Stockholders, held on June 24, 2015 (the "2015 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 21 of 33
- 21 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Proxy"). In the 2015 Proxy, defendants solicited stockholder votes to, among other things, re-elect 

defendants Filo, James, Levchin, Mayer, McInerney, Schwab, Scott, Shaw, and Webb, and to vote 

against a stockholder proposal to authorize stockholders to act by written consent. Defendants 

issued materially misleading statements with respect to the solicited votes.

71. The 2015 Proxy stated the following in support of re-electing defendants Filo, 

James, Levchin, Mayer, McInerney, Schwab, Scott, Shaw, and Webb:

The Board's Role in Risk Oversight

The Board, as a whole and through its committees, serves an active role in 

overseeing management of the Company's risks. The Company's officers are 

responsible for day-to-day risk management activities. The full Board monitors risks 

through regular reports from each of the committee chairs and the General Counsel, 

and is apprised of particular risk management matters in connection with its general 

oversight and approval of corporate matters. The Board and its committees oversee 

risks associated with their respective areas of responsibility, as summarized below. 

Each committee meets with key management personnel and representatives of 

outside advisers as required.

The Audit Committee reviews risks and exposures associated with financial matters, 

particularly financial reporting, tax, accounting, disclosures, internal control over 

financial reporting, investment guidelines and credit and liquidity matters, programs 

and policies relating to legal compliance and strategy, and the Company's operational 

infrastructure, particularly reliability, business continuity and capacity.

72. In support of its proposal for adopting the right for stockholders to act by written 

consent, the stockholders claimed that the ability to act by written consent would improve the 

Company's corporate governance and that "[t]aking action by written consent in lieu of a meeting is 

a means shareholders can use to raise important matters outside the normal annual meeting cycle. 

A shareholder right to act by written consent and to call a special meeting are 2 complimentary ways 

to bring an important matter to the attention of both management and shareholders outside the annual 

meeting cycle." Defendants Filo, James, Levchin, Mayer, McInerney, Schwab, Scott, Shaw, and 

Webb stated in the 2015 Proxy that they recommended voting against the proposal because "[the 

Board's] existing strong corporate governance practices make adoption of this proposal 

unnecessary." 

73. The 2015 Proxy's claims that: (i) the Board was effective in overseeing Yahoo's 

business affairs; (ii) the Audit Committee was effective in fulfilling its oversight responsibilities 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 22 of 33
- 22 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

with respect to internal control over financial reporting and disclosure controls and procedures; and 

(iii) the Board had strong corporate governance practices were misleading because the 2015 Proxy 

omitted any disclosures reflecting or acknowledging the data breaches, the delay in alerting users, 

how those would affect the Company's business, and the lack of internal controls necessitating 

disclosure of the data breaches. 

74. The 2015 Proxy harmed Yahoo by interfering with the proper governance on its 

behalf that follows the free and informed exercise of the stockholders' right to vote for directors. As 

a result of the Individual Defendants' misleading statements in the 2015 Proxy, Yahoo's

stockholders voted to re-elect defendants Filo, James, Levchin, Mayer, McInerney, Schwab, Scott, 

Shaw, and Webb, and against the right to act by written consent.

75. On May 23, 2016, defendants James, Scott, Braham, Brandt, Filo, Friedman, 

Hartenstein, Hill, Mayer, McInerney, Shaw, Smith, and Webb, caused Yahoo to file with the SEC a

Proxy Statement on Schedule 14A in connection with the 2016 Annual Meeting of Stockholders, 

held on June 30, 2016 (the "2016 Proxy"). In the 2016 Proxy, defendants solicited stockholder votes 

to, among other things, re-elect defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, 

Mayer, McInerney, Shaw, Smith, and Webb. Defendants issued materially misleading statements 

with respect to the solicited votes.

76. The 2016 Proxy highlighted the Company's claimed progress on its turnaround 

efforts, by among other things, pointing to the Company's one billion monthly users and growth 

businesses, many of which require Yahoo accounts. These statements were misleading, because 

they did not discuss the data breaches and the likely decline it would cause to these very businesses

and monthly users, despite knowing about the breach for over a year at this point. In particular, the 

2016 Proxy stated, "We continued our progress on our turnaround efforts to restore the Company to 

sustainable growth focusing our resources on our growth oriented businesses, stabilizing declining 

revenues, and sunsetting unprofitable products and services. We also maintained our base of over 

one billion monthly users. Our growth businesses—Mobile, Video, Native, and Social ("Mavens")—

delivered more than $1.6 billion of [generally accepted accounting principles] revenue in 2015."

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 23 of 33
- 23 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

77. Defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, McInerney, 

Shaw, Smith, and Webb also discussed their plan for 2016, stating that they plan to "Play to Our 

Strengths to Grow User Engagement. Prioritize growing engagement with our enormous user 

base of more than one billion monthly users." Again, the 2016 Proxy did not discuss the data 

breaches, how those data breaches would affect user engagement or the Company's user base, or 

how it planned to deal with those, despite the material effect notice of the data breaches would have 

on this strategic plan. 

78. In addition to the above, in seeking the election of defendants Braham, Brandt, Filo, 

Friedman, Hartenstein, Hill, Mayer, McInerney, Shaw, Smith, and Webb, the 2016 Proxy stated the 

following:

The Board's Role in Risk Oversight

The Board, as a whole and through its committees, serves an active role in 

overseeing management of the Company's risks. The Company's officers are 

responsible for day-to-day risk management activities. The full Board monitors risks

through regular reports from each of the committee chairs and the General Counsel, 

and is apprised of particular risk management matters in connection with its general 

oversight and approval of corporate matters. The Board and its committees oversee 

risks associated with their respective areas of responsibility, as summarized below. 

Each committee meets with key management personnel and representatives of 

outside advisers as required.

The Audit Committee reviews risks and exposures associated with financial matters, 

particularly financial reporting, tax, accounting, disclosures, internal control over 

financial reporting, investment guidelines and credit and liquidity matters, programs 

and policies relating to legal compliance and strategy, and the Company's operational 

infrastructure, particularly reliability, business continuity and capacity.

79. These claims were misleading because the 2016 Proxy omitted any disclosures 

reflecting or acknowledging the data breaches, the delay in alerting users, how those would affect 

the Company's business, and the lack of internal controls necessitating disclosure of the data 

breaches.

80. The 2016 Proxy harmed Yahoo by interfering with the proper governance on its 

behalf that follows the free and informed exercise of the stockholders' right to vote for directors. As 

a result of defendants James, Scott, Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 24 of 33
- 24 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

McInerney, Shaw, Smith, and Webb's misleading statements in the 2016 Proxy, Yahoo's 

stockholders voted to re-elect defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, 

McInerney, Shaw, Smith, and Webb.

81. On September 9, 2016, the defendants filed with the SEC a Preliminary Proxy 

Statement on Schedule 14A (the "Preliminary Proxy") recommending stockholders vote in favor of 

the Yahoo-Verizon asset purchase. The Preliminary Proxy attached a copy of the Stock Purchase 

Agreement. The Stock Purchase Agreement continued to specifically state that Yahoo does not 

know of any data breaches. The Preliminary Proxy does not provide any guidance that this 

statement in the Stock Purchase Agreement is incorrect. Further, the Preliminary Proxy does not 

state whether Yahoo alerted Verizon to the data breaches and what steps Verizon is taking in 

response to learning about the data breaches. Without this information, the Preliminary Proxy is 

misleading and incomplete. Without this information, stockholders cannot make an informed vote 

on whether to approve the Yahoo-Verizon transaction. 

DAMAGES TO YAHOO CAUSED BY THE INDIVIDUAL DEFENDANTS

82. As a result of the Individual Defendants' wrongful conduct, Yahoo disseminated 

improper financial statements that misrepresented the Company's knowledge of the data breaches. 

These improper statements have devastated Yahoo's credibility as reflected by the Company's more 

than 4.21% market capitalization loss following the acknowledgment on September 22, 2016, of 

2014 data breach, and 6.11% market capitalization loss following the acknowledgment of the 2013

data breach on December 14, 2016. Additionally, Yahoo is now the subject of a securities class 

action alleging securities laws violations in connection with the improper financial reporting. 

83. Further, Yahoo's failure to timely alert its users of the data breaches violated 

numerous state laws. Yahoo is now subject to consumer class actions that allege it violated these 

disclosure obligations and that the Company failed to take appropriate steps to keep its users' data 

safe. The Company will face substantial costs in connection with the consumer and securities class 

action lawsuits.

84. The Company is now also being investigated by the SEC concerning the disclosure of 

the data breaches. Yahoo will incur substantial costs in responding to this investigation. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 25 of 33
- 25 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

85. Yahoo will also likely lose users and the associated revenues from those users 

reviewing advertising, as a result of the data breaches. As explained above, when users have to 

change passwords because of a data breach, many simply cancel their account altogether.

86. Yahoo also paid substantial compensation to directors and officers that breached their 

fiduciary duty and violated federal securities laws. The retention of this payment by the Individual 

Defendants is unfair and unjust. 

87. Finally, commentators have called into question whether Verizon will go through 

with its acquisition of Yahoo's core assets in light of the data breaches. As stated above, Yahoo 

represented to Verizon that it was unaware of any data breaches at the time it entered into the Stock 

Purchase Agreement. That statement was false. On January 23, 2017, Yahoo stated that it now 

expects the Verizon purchase to close in the second quarter for 2017, pushing back the closing from 

the first quarter of 2017. 

DERIVATIVE AND DEMAND FUTILITY ALLEGATIONS

88. Plaintiff brings this action derivatively in the right and for the benefit of Yahoo to 

redress injuries suffered, and to be suffered, by Yahoo as a direct result of violations of the federal 

securities laws, breach of fiduciary duties, and unjust enrichment, as well as the aiding and abetting 

thereof, by the Individual Defendants. Yahoo is named as a nominal defendant solely in a derivative 

capacity. This is not a collusive action to confer jurisdiction on this Court that it would not 

otherwise have.

89. Plaintiff will adequately and fairly represent the interests of Yahoo in enforcing and 

prosecuting its rights.

90. Plaintiff was a stockholder of Yahoo at the time of the wrongdoing complained of,

has continuously been a stockholder, and is a current Yahoo stockholder.

91. The current Board of Yahoo consists of the following eleven individuals: 

defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, McInerney, Shaw, Smith,

and Webb. Plaintiff has not made any demand on the present Board to institute this action because 

such a demand would be a futile, wasteful, and useless act, as set forth below.

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 26 of 33
- 26 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Demand Is Excused Because Defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, 

Mayer, McInerney, Shaw, Smith, and Webb Face a Substantial Likelihood of Liability for 

Their Misconduct

92. As alleged above, defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, 

Mayer, McInerney, Shaw, Smith, and Webb violated section 14(a) of the Exchange Act by at least 

negligently making the misstatements and omissions in the 2015 Proxy and 2016 Proxy. 

Accordingly, demand is excused because a majority of the Board faces a substantial likelihood of

liability.

93. Defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, McInerney, 

Shaw, Smith, and Webb also breached their fiduciary duty of loyalty by making and allowing

improper statements to be made in the Company's public statements, including its Annual and 

Quarterly Reports, and Proxy Statements. In addition, these Board members allowed the Company 

to delay announcing the data breaches, despite the Company's knowledge of it, exposing Yahoo to 

massive liability in the consumer class actions. Accordingly, demand is futile. 

94. Audit and Finance Committee Defendants Braham, Brandt, McInerney, and Webb, 

as members of the Audit Committee, were responsible under the Audit Committee Charter in effect 

during the relevant period for reviewing and approving quarterly and annual financial statements and 

Yahoo's internal controls, as described above. Despite these duties, the Audit Committee 

Defendants knowingly or recklessly reviewed and approved improper financial statements. The 

Audit Committee Defendants also reviewed and approved Yahoo's ineffective internal controls. 

Accordingly, these defendants face a sufficiently substantial likelihood of liability for breach of their 

fiduciary duty of loyalty. Demand upon these defendants is futile.

95. Plaintiff has not made any demand on the other stockholders of Yahoo to institute

this action since such demand would be a futile and useless act for at least the following reasons:

(a) Yahoo is a publicly held company with over 954 million shares outstanding 

and thousands of stockholders;

(b) making demand on such a number of stockholders would be impossible 

for plaintiff who has no way of finding out the names, addresses, or phone numbers of stockholders; 

and

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 27 of 33
- 27 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(c) making demand on all stockholders would force plaintiff to incur excessive 

expenses, assuming all stockholders could be individually identified.

COUNT I

Against Defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, 

McInerney, Shaw, Smith, and Webb for Violation of Section 14(a) of the Exchange Act

96. Plaintiff incorporates by reference and realleges each and every allegation contained 

above, as though fully set forth herein.

97. The section 14(a) Exchange Act claims alleged herein are based solely on 

negligence. They are not based on any allegation of reckless or knowing conduct by or on behalf of 

Director Defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, McInerney, Shaw, 

Smith, and Webb. The section 14(a) Exchange Act claims alleged herein do not allege and do not 

sound in fraud. Plaintiff specifically disclaims any allegations of, reliance upon any allegation of, 

or reference to any allegation of fraud, scienter, or recklessness with regard to the non-fraud claims.

98. Director defendants Braham, Brandt, Filo, Friedman, Hartenstein, Hill, Mayer, 

McInerney, Shaw, Smith, and Webb negligently issued, caused to be issued, and participated in the 

issuance of materially misleading written statements to stockholders which were contained in the 

2015 Proxy and 2016 Proxy. 

99. The misleading information contained in the 2015 Proxy and 2016 Proxy were

material to Yahoo's stockholders in determining whether or not to elect defendants Braham, Brandt, 

Filo, Friedman, Hartenstein, Hill, James, Levchin, Mayer, McInerney, Schwab, Scott, Shaw, Smith, 

and Webb. This information was also material to the integrity of these directors that were proposed 

for election to the Board. The proxy solicitation process in connection with the 2015 Proxy and 

2016 Proxy was an essential link in the re-election of nominees to the Board. 

100. Plaintiff, on behalf of Yahoo, thereby seeks relief for damages inflicted upon the 

Company based upon the misleading 2015 Proxy and 2016 Proxy.

101. In addition, plaintiff seeks to enjoin the stockholder vote on the Verizon-Yahoo 

Stock Purchase Agreement unless and until the Preliminary Proxy is no longer misleading. 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 28 of 33
- 28 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

102. Because of the false and misleading statements in the Preliminary Proxy, plaintiff 

and the Company are threatened with irreparable harm. 

COUNT II

Against the Individual Defendants for Violation of Section 20(a) of the Exchange Act

103. Plaintiff incorporates by reference and realleges each and every allegation contained 

above, as though fully set forth herein.

104. The Individual Defendants acted as controlling persons of within the meaning of 

section 20(a) of the Exchange Act as alleged herein. By virtue of their positions as officers and/or 

directors of Yahoo and participation in and/or awareness of the Company's operations and/or 

intimate knowledge of the false statements contained in the Proxy filed with the SEC, they had the 

power to influence and control and did influence and control, directly or indirectly, the decisionmaking of the Company, including the content and dissemination of the various statements which 

plaintiff contends are false and misleading.

105. Each of the Individual Defendants was provided with or had unlimited access to 

copies of the 2015 Proxy and 2016 Proxy and other statements alleged by plaintiff to be misleading 

prior to and/or shortly after these statements were issued and had the ability to prevent the issuance 

of the statements or cause the statements to be corrected.

106. In particular, each of the Individual Defendants had direct and supervisory 

involvement in the day-to-day operations of the Company, and, therefore, is presumed to have had 

the power to control or influence the particular transactions giving rise to the securities violations as 

alleged herein, and exercised the same. The 2015 Proxy and 2016 Proxy contain the unanimous 

recommendation of each of the Individual Defendants to the stockholders to vote in favor of the 

election of directors. They were, thus, directly involved in the making of this document.

107. In addition, as the Preliminary Proxy sets forth at length, and as described herein, the 

Individual Defendants were each involved in negotiating, reviewing, and approving the Stock 

Purchase Agreement. The Preliminary Proxy purports to describe the various issues and information 

that they reviewed and considered—descriptions which had input from the directors.

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 29 of 33
- 29 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

108. By virtue of the foregoing, the Individual Defendants have violated section 20(a) of 

the Exchange Act.

109. As set forth above, the Individual Defendants had the ability to exercise control over 

and did control a person or persons who have each violated section 14(a) and SEC Rule 14a-9, 

promulgated thereunder, by their acts and omissions as alleged herein. By virtue of their positions as 

controlling persons, these defendants are liable pursuant to section 20(a) of the Exchange Act. As a 

direct and proximate result of defendants' conduct, Yahoo's stockholders will be irreparably 

harmed.

COUNT III

Against the Individual Defendants for Breach of Fiduciary Duties

110. Plaintiff incorporates by reference and realleges each and every allegation contained 

above, as though fully set forth herein.

111. The Individual Defendants owed and owe Yahoo fiduciary obligations. By reason

of their fiduciary relationships, the Individual Defendants owed and owe Yahoo the highest 

obligation of due care, loyalty, and good faith. 

112. The Individual Defendants, and each of them, violated and breached their fiduciary 

duties.

113. As a direct and proximate result of defendants' failure to perform their fiduciary 

obligations, Yahoo has sustained significant damages. As a result of the misconduct alleged herein, 

these defendants are liable to the Company.

114. Plaintiff, on behalf of Yahoo, has no adequate remedy at law.

COUNT IV

Against the Individual Defendants for Unjust Enrichment

115. Plaintiff incorporates by reference and realleges each and every allegation contained 

above, as though fully set forth herein.

116. By their wrongful acts and omissions, the Individual Defendants were unjustly 

enriched at the expense of and to the detriment of Yahoo. The Individual Defendants were unjustly 

enriched as a result of the salaries, bonuses, and other forms of compensation they received while 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 30 of 33
- 30 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

breaching their fiduciary duties owed to Yahoo. 

117. Plaintiff, as a stockholder and representative of Yahoo, seeks restitution from these 

defendants, and each of them, and seek an order of this Court disgorging all profits, benefits, and 

other compensation obtained by these defendants, and each of them, from their wrongful conduct 

and fiduciary breaches. 

118. Plaintiff, on behalf of Yahoo, has no adequate remedy at law.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff demands for a judgment as follows:

A. Against the Individual Defendants and in favor of the Company for the amount of 

damages sustained by the Company as a result of the Individual Defendants' violation of securities 

law, breaches of fiduciary duties, and unjust enrichment;

B. Preliminarily and permanently enjoining defendants and all persons acting in 

concert with them from proceeding with, consummating, or closing the Verizon-Yahoo asset 

purchase; 

C. Directing the Individual Defendants to disseminate a proxy concerning the VerizonYahoo asset purchase that does not contain any untrue statements of material fact and that states all 

material facts required in it or necessary to make the statements contained therein not misleading;

D. Directing Yahoo to take all necessary actions to reform and improve its corporate 

governance and internal procedures to comply with applicable laws and to protect Yahoo and its 

stockholders from a repeat of the damaging events described herein, including, but not limited to, 

putting forward for stockholder vote, resolutions for amendments to the Company's By-Laws or 

Articles of Incorporation and taking such other action as may be necessary to place before 

stockholders for a vote the following Corporate Governance Policies:

1. a proposal to strengthen the Board's supervision of operations and develop and 

implement procedures for greater stockholder input into the policies and guidelines of the Board;

2. a provision to permit the stockholders of Yahoo to nominate at least three 

candidates for election to the Board; 

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 31 of 33
- 31 -

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

3. a provision requiring immediate disclosure to affected users in the event of a 

data breach; and

4. a proposal to strengthen Yahoo's internal controls over financial reporting;

E. Extraordinary equitable and/or injunctive relief as permitted by law, equity, and 

state statutory provisions sued hereunder, including attaching, impounding, imposing a constructive 

trust on, or otherwise restricting defendants' assets so as to assure that plaintiff, on behalf of Yahoo,

have an effective remedy;

F. Awarding to Yahoo restitution from the defendants, and each of them, and ordering 

disgorgement of all profits, benefits, and other compensation obtained by the defendants;

G. Awarding to plaintiff reasonable attorneys' fees, consultant and expert fees, costs,

and expenses; and

H. Granting such other and further relief as the Court deems just and proper.

JURY DEMAND

Plaintiff demands a trial by jury.

Dated: February 16, 2017 ROBBINS ARROYO LLP

BRIAN J. ROBBINS

FELIPE J. ARROYO 

SHANE P. SANDERS 

/s/ Brian J. Robbins

BRIAN J. ROBBINS

600 B Street, Suite 1900

San Diego, CA 92101

Telephone: (619) 525-3990

Facsimile (619) 525-3991

E-mail: brobbins@robbinsarroyo.com

farroyo@robbinsarroyo.com

ssanders@robbinsarroyo.com

Attorneys for Plaintiff

11519601

Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 32 of 33
Case 5:17-cv-00787-LHK Document 1 Filed 02/16/17 Page 33 of 33