1 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

POMERANTZ LLP 

Jennifer Pafiti (SBN 282790) 

468 North Camden Drive 

Beverly Hills, CA 90210 

Telephone: (818) 532-6499 

E-mail: jpafiti@pomlaw.com 

- additional counsel on signature page - 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

MARK MADRACK, Individually and on 

Behalf of All Others Similarly Situated, 

Plaintiff,

 vs. 

YAHOO! INC., MARISSA A. MAYER, and 

KENNETH A. GOLDMAN, 

Defendants

 

Case No. 

CLASS ACTION COMPLAINT FOR 

VIOLATION OF THE FEDERAL 

SECURITIES LAWS 

JURY TRIAL DEMANDED 

Plaintiff Mark Madrack (“Plaintiff”), individually and on behalf of all other persons similarly 

situated, by Plaintiff’s undersigned attorneys, for Plaintiff’s complaint against Defendants (defined 

below), alleges the following based upon personal knowledge as to Plaintiff and Plaintiff’s own acts, 

and information and belief as to all other matters, based upon, inter alia, the investigation conducted by 

and through Plaintiff’s attorneys, which included, among other things, a review of the Defendants’ 

public documents, conference calls and announcements made by Defendants, United States Securities 

and Exchange Commission (“SEC”) filings, wire and press releases published by and regarding Yahoo! 

Inc. (“Yahoo” or the “Company”), analysts’ reports and advisories about the Company, and information 

readily obtainable on the Internet. Plaintiff believes that substantial evidentiary support will exist for the 

allegations set forth herein after a reasonable opportunity for discovery. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 1 of 31
2 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

NATURE OF THE ACTION 

1. This is a federal securities class action on behalf of a class consisting of all persons other 

than Defendants who purchased or otherwise acquired common shares of Yahoo between November 

12, 2013 and December 14, 2016, both dates inclusive (the “Class Period”). Plaintiff seeks to recover 

compensable damages caused by Defendants’ violations of the federal securities laws and to pursue 

remedies under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 (the “Exchange Act”) 

and Rule 10b-5 promulgated thereunder. 

2. Yahoo, together with its subsidiaries, is a multinational technology company that 

provides a variety of internet services, including, inter alia, a web portal, search engine, Yahoo! Mail, 

Yahoo! News, Yahoo! Finance, advertising, and fantasy sports. As of February 2016, Yahoo had an 

estimated 1 billion monthly active users, roughly 280 million Yahoo! Mail users, and 205 million 

monthly unique visitors to its sites and services. 

3. Founded in January 1994, the Company was formerly known as “Jerry and David’s 

Guide to the World Wide Web” and changed its name to Yahoo! Inc. in March 1994. Yahoo is 

headquartered in Sunnyvale, California. The Company’s common stock trades on the Nasdaq Capital 

Market (“NASDAQ”) under the ticker symbol “YHOO.” 

4. On July 25, 2016, Verizon Communications, Inc. (“Verizon”) formally announced its 

intent to acquire Yahoo’s internet business for $4.8 billion. 

5. Throughout the Class Period, Defendants made materially false and misleading 

statements regarding the Company’s business, operational and compliance policies. Specifically, 

Defendants made false and/or misleading statements and/or failed to disclose that: (i) Yahoo failed to 

encrypt its users’ personal information and/or failed to encrypt its users’ personal data with an up-todate and secure encryption scheme; (ii) consequently, sensitive personal account information from more 

than 1 billion users was vulnerable to theft; (iii) a data breach resulting in the theft of personal user data 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 2 of 31
3 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

would foreseeably cause a significant drop in user engagement with Yahoo’s websites and services; and 

(iv) as a result, Yahoo’s public statements were materially false and misleading at all relevant times. 

6. On September 22, 2016, Yahoo disclosed that hackers had stolen information in late 

2014 on more than 500 million accounts. Following the breach, Yahoo executives advised investors 

that the breach was not material, in part because the Company had not required to reset their passwords. 

7. On this news, Yahoo’s share price fell $1.35, or 3.06%, to close at $42.80 on September 

23, 2016. 

8. On December 14, 2016, post-market, Yahoo announced that it had uncovered a data 

breach, stating that data from more than 1 billion user accounts was compromised in August 2013. In a 

press release and Current Report filed with the SEC on Form 8-K, Yahoo stated, in part: 

SUNNYVALE, Calif., December 14, 2016— Yahoo! Inc. (NASDAQ:YHOO) has 

identified data security issues concerning certain Yahoo user accounts. Yahoo has taken 

steps to secure user accounts and is working closely with law enforcement. 

As Yahoo previously disclosed in November, law enforcement provided the company 

with data files that a third party claimed was Yahoo user data. The company analyzed this 

data with the assistance of outside forensic experts and found that it appears to be Yahoo 

user data. Based on further analysis of this data by the forensic experts, Yahoo believes 

an unauthorized third party, in August 2013, stole data associated with more than one 

billion user accounts. The company has not been able to identify the intrusion associated 

with this theft. Yahoo believes this incident is likely distinct from the incident the 

company disclosed on September 22, 2016. 

For potentially affected accounts, the stolen user account information may have 

included names, email addresses, telephone numbers, dates of birth, hashed passwords 

(using MD5) and, in some cases, encrypted or unencrypted security questions and 

answers. The investigation indicates that the stolen information did not include 

passwords in clear text, payment card data, or bank account information. Payment card 

data and bank account information are not stored in the system the company believes was 

affected. 

Yahoo is notifying potentially affected users and has taken steps to secure their 

accounts, including requiring users to change their passwords. Yahoo has also 

invalidated unencrypted security questions and answers so that they cannot be used to 

access an account. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 3 of 31
4 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Separately, Yahoo previously disclosed that its outside forensic experts were 

investigating the creation of forged cookies that could allow an intruder to access users’ 

accounts without a password. Based on the ongoing investigation, the company believes 

an unauthorized third party accessed the company’s proprietary code to learn how to 

forge cookies. The outside forensic experts have identified user accounts for which they 

believe forged cookies were taken or used. Yahoo is notifying the affected account 

holders, and has invalidated the forged cookies. The company has connected some of this 

activity to the same state-sponsored actor believed to be responsible for the data theft the 

company disclosed on September 22, 2016. 

(Emphases added.) 

9. Following Yahoo’s announcement, several news sources reported that Verizon was 

considering ways to amend the terms of its deal with Yahoo to reflect the impact of the data breach and 

would likely seek “major concessions” from Yahoo. 

10. On this news, Yahoo’s share price fell $2.50, or 6.11%, to close at $38.41 on December 

15, 2016. 

11. On December 15, 2016, after the market closed, the Wall Street Journal published an 

article entitled “Yahoo’s Password Move May Put Verizon Deal at Risk.” The article stated, in part: 

Yahoo Inc.’s move to force some users to reset their passwords following a newly 

disclosed security breach could disrupt the planned sale of its core assets to Verizon 

Communications Inc., security experts say. 

Yahoo didn’t force users to reset their passwords after its September disclosure of 

another breach. Experts say forcing users to reset their passwords typically causes some 

to drop a service.

That is one reason why the newly disclosed hack—which Yahoo says occurred in 2013 

and affected more than one billion accounts—could prove more disruptive to Verizon’s 

pending $4.83 billion acquisition of Yahoo’s core assets. 

. . . 

Yahoo is forcing users to reset their passwords now because some of the material taken 

in the 2013 breach wasn’t encrypted, and other parts were protected by what is now 

considered an outdated encryption scheme, according to a person familiar with that 

matter. 

(Emphases added.) 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 4 of 31
5 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

12. On January 23, 2017, the Wall Street Journal reported that the SEC had opened an 

investigation into the timing of Yahoo’s disclosures regarding the data breaches. The article reported, 

in part: 

The Securities and Exchange Commission has opened an investigation, and in December 

issued requests for documents, as it looks into whether the tech company’s disclosures 

about the cyberattacks complied with civil securities laws, the people said. The SEC 

requires companies to disclose cybersecurity risks as soon as they are determined to have 

an effect on investors. 

The investigation is likely to center on a 2014 data breach at Yahoo that compromised the 

data of at least 500 million users, according to the people familiar with the matter. Yahoo 

disclosed that breach in September 2016, despite having linked the incident to statesponsored hackers two years earlier. 

To date, Yahoo hasn’t explained why the company took two years to disclose the 2014 

incident publicly or who made the decision not to go public sooner with this information. 

In mid-December Yahoo also said it had recently discovered an August 2013 data breach 

that had exposed the private information of more than 1 billion Yahoo users. 

13. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline in 

the market value of the Company’s common shares, Plaintiff and other Class members have suffered 

significant losses and damages. 

JURISDICTION AND VENUE 

14. The claims asserted herein arise under and pursuant to §§10(b) and 20(a) of the 

Exchange Act (15 U.S.C. §§78j(b) and §78t(a)) and Rule 10b-5 promulgated thereunder by the SEC (17 

C.F.R. §240.10b-5). 

15. This Court has jurisdiction over the subject matter of this action under 28 U.S.C. §1331 

and §27 of the Exchange Act. 

16. Venue is proper in this Judicial District pursuant to §27 of the Exchange Act (15 U.S.C. 

§78aa) and 28 U.S.C. §1391(b). Yahoo’s principal executive offices are located within this Judicial 

District. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 5 of 31
6 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

17. In connection with the acts, conduct and other wrongs alleged in this Complaint, 

Defendants, directly or indirectly, used the means and instrumentalities of interstate commerce, 

including but not limited to, the United States mail, interstate telephone communications and the 

facilities of the national securities exchange. 

PARTIES 

18. Plaintiff, as set forth in the accompanying Certification, purchased common shares of 

Yahoo at artificially inflated prices during the Class Period and was damaged upon the revelation of the 

alleged corrective disclosure. 

19. Defendant Yahoo! Inc. is incorporated in Delaware, and the Company’s principal 

executive offices are located at 701 First Avenue, Sunnyvale, California, 94089. Yahoo’s common 

stock trades on the NASDAQ under the ticker symbol “YHOO.” 

20. Defendant Marissa A. Mayer (“Mayer”) has served at all relevant times as the 

Company’s Chief Executive Officer (“CEO”) and Director. 

21. Defendant Kenneth A. Goldman (“Goldman”) has served at all relevant times as the 

Company’s Chief Financial Officer (“CFO”). 

22. The Defendants referenced above in ¶¶ 20-21 are sometimes referred to- herein as the 

“Individual Defendants.” 

SUBSTANTIVE ALLEGATIONS 

Background 

23. Yahoo, together with its subsidiaries, is a multinational technology company that 

provides a variety of internet services, including, inter alia, a web portal, search engine, Yahoo! Mail, 

Yahoo! News, Yahoo! Finance, advertising, and fantasy sports. As of February 2016, Yahoo had an 

estimated 1 billion monthly active users, roughly 280 million Yahoo! Mail users, and 205 million 

monthly unique visitors to its sites and services. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 6 of 31
7 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Materially False and Misleading Statements Issued During the Class Period 

24. The Class Period begins on November 12, 2013, when Yahoo filed a Quarterly Report 

on Form 10-Q with the SEC, announcing the Company’s financial and operating results for the quarter 

ended September 30, 2013 (the “Q3 2013 10-Q”). For the quarter, Yahoo announced net income of 

$296.66 million, or $0.28 per diluted share, on revenue of $1.14 billion, compared to net income of 

$3.12 billion, or $2.64 per diluted share, on revenue of $1.2 billion for the same period in the prior year. 

25. In the Q3 2013 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure.

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Our user data and corporate 

systems and security measures have been and may in the future be breached due to the 

actions of outside parties (including cyber attacks), employee error, malfeasance, a 

combination of these, or otherwise, allowing an unauthorized party to obtain access to 

our data or our users’ or customers’ data. Additionally, outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information in 

order to gain access to our data or our users’ or customers’ data. 

Any breach or unauthorized access could result in significant legal and financial 

exposure, increased remediation and other costs, damage to our reputation and a loss of 

confidence in the security of our products, services and networks that could potentially 

have an adverse effect on our business. Because the techniques used to obtain 

unauthorized access, disable or degrade service, or sabotage systems change frequently or 

may be designed to remain dormant until a predetermined event and often are not 

recognized until launched against a target, we may be unable to anticipate these 

techniques or implement adequate preventative measures. If an actual or perceived breach 

of our security occurs, the market perception of the effectiveness of our security measures 

could be harmed and we could lose users and customers. 

26. The Q3 2013 10-Q contained signed certifications pursuant to the Sarbanes-Oxley Act of 

2002 (“SOX”) by the Individual Defendants, stating that the financial information contained in the Q3 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 7 of 31
8 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

2013 10-Q was accurate and disclosed any material changes to the Company’s internal control over 

financial reporting. 

27. On February 28, 2014, Yahoo filed an Annual Report on Form 10-K with the SEC, 

announcing the Company’s financial and operating results for the quarter and year ended December 31, 

2013 (the “2013 10-K”). For the quarter, Yahoo announced net income of $348.19 million, or $0.33 

per diluted share, on revenue of $1.27 billion, compared to net income of $272.27 million, or $0.23 per 

diluted share, on revenue of $1.35 billion for the same period in the prior year. For 2013, Yahoo 

announced net income of $1.37 billion, or $1.26 per diluted share, on revenue of $4.68 billion, 

compared to net income of $3.95 billion, or $3.28 per diluted share, on revenue of $4.99 billion for 

2012. 

28. In the 2013 10-K, with respect to the efficacy of the Company’s encryption of user data, 

Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Security breaches or 

unauthorized access have resulted in and may in the future result in a combination of 

significant legal and financial exposure, increased remediation and other costs, damage to 

our reputation and a loss of confidence in the security of our products, services and 

networks that could have an adverse effect on our business. We take steps to prevent 

unauthorized access to our corporate systems, however, because the techniques used to 

obtain unauthorized access, disable or degrade service, or sabotage systems change 

frequently or may be designed to remain dormant until a triggering event, we may be 

unable to anticipate these techniques or implement adequate preventative measures. If an 

actual or perceived breach of our security occurs, the market perception of the 

effectiveness of our security measures could be harmed and we could lose users and 

customers. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 8 of 31
9 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

29. The 2013 10-K contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the 2013 10-K was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

30. On May 8, 2014, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended March 31, 2014 (the 

“Q1 2014 10-Q”). For the quarter, Yahoo announced net income of $311.58 million, or $0.29 per 

diluted share, on revenue of $1.13 billion, compared to net income of $390.29 million, or $0.35 per 

diluted share, on revenue of $1.14 billion for the same period in the prior year. 

31. In the Q1 2014 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Security breaches or 

unauthorized access have resulted in and may in the future result in a combination of 

significant legal and financial exposure, increased remediation and other costs, damage to 

our reputation and a loss of confidence in the security of our products, services and 

networks that could have an adverse effect on our business. We take steps to prevent 

unauthorized access to our corporate systems, however, because the techniques used to 

obtain unauthorized access, disable or degrade service, or sabotage systems change 

frequently or may be designed to remain dormant until a triggering event, we may be 

unable to anticipate these techniques or implement adequate preventative measures. If an 

actual or perceived breach of our security occurs, the market perception of the 

effectiveness of our security measures could be harmed and we could lose users and 

customers. 

32. The Q1 2014 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q1 2014 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 9 of 31
10 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

33. On August 7, 2014, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended June 30, 2014 (the “Q2 

2014 10-Q”). For the quarter, Yahoo announced net income of $269.71 million, or $0.26 per diluted 

share, on revenue of $1.08 billion, compared to net income of $331.15 million, or $0.30 per diluted 

share, on revenue of $1.14 billion for the same period in the prior year. 

34. In the Q2 2014 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Security breaches or 

unauthorized access have resulted in and may in the future result in a combination of 

significant legal and financial exposure, increased remediation and other costs, damage to 

our reputation and a loss of confidence in the security of our products, services and 

networks that could have an adverse effect on our business. We take steps to prevent 

unauthorized access to our corporate systems, however, because the techniques used to 

obtain unauthorized access, disable or degrade service, or sabotage systems change 

frequently or may be designed to remain dormant until a triggering event, we may be 

unable to anticipate these techniques or implement adequate preventative measures. If an 

actual or perceived breach of our security occurs, the market perception of the 

effectiveness of our security measures could be harmed and we could lose users and 

customers. 

35. The Q2 2014 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q2 2014 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

36. On November 7, 2014, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended September 30, 2014 

(the “Q3 2014 10-Q”). For the quarter, Yahoo announced net income of $6.77 billion, or $6.70 per 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 10 of 31
11 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

diluted share, on revenue of $1.15 billion, compared to net income of $296.66 million, or $0.28 per 

diluted share, on revenue of $1.14 billion for the same period in the prior year. 

37. In the Q3 2014 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Security breaches or 

unauthorized access have resulted in and may in the future result in a combination of 

significant legal and financial exposure, increased remediation and other costs, damage to 

our reputation and a loss of confidence in the security of our products, services and 

networks that could have an adverse effect on our business. We take steps to prevent 

unauthorized access to our corporate systems, however, because the techniques used to 

obtain unauthorized access, disable or degrade service, or sabotage systems change 

frequently or may be designed to remain dormant until a triggering event, we may be 

unable to anticipate these techniques or implement adequate preventative measures. If an 

actual or perceived breach of our security occurs, the market perception of the 

effectiveness of our security measures could be harmed and we could lose users and 

customers. 

38. The Q3 2014 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q3 2014 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

39. On February 27, 2015, Yahoo filed an Annual Report on Form 10-K with the SEC, 

announcing the Company’s financial and operating results for the quarter and year ended December 31, 

2014 (the “2014 10-K”). For the quarter, Yahoo announced net income of $166.34 million, or $0.17 

per diluted share, on revenue of $1.25 billion, compared to net income of $348.19 million, or $0.33 per 

diluted share, on revenue of $1.27 billion for the same period in the prior year. For 2014, Yahoo 

announced net income of $7.52 billion, or $7.45 per diluted share, on revenue of $4.62 billion, 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 11 of 31
12 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

compared to net income of $1.37 billion, or $1.26 per diluted share, on revenue of $4.68 billion for 

2013. 

40. In the 2014 10-K, with respect to the efficacy of the Company’s encryption of user data, 

Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Security breaches or unauthorized access have resulted in and may in the future 

result in a combination of significant legal and financial exposure, increased remediation 

and other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

41. The 2014 10-K contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the 2014 10-K was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

42. On May 7, 2015, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended March 31, 2015 (the 

“Q1 2015 10-Q”). For the quarter, Yahoo announced net income of $21.20 million, or $0.02 per 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 12 of 31
13 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

diluted share, on revenue of $1.23 billion, compared to net income of $311.58 million, or $0.29 per 

diluted share, on revenue of $1.13 billion for the same period in the prior year. 

43. In the Q1 2015 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Security breaches or unauthorized access have resulted in and may in the future 

result in a combination of significant legal and financial exposure, increased remediation 

and other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

44. The Q1 2015 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q1 2015 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

45. On August 7, 2015, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended June 30, 2015 (the “Q2 

2015 10-Q”). For the quarter, Yahoo announced a net loss of $21.55 million, or $0.02 per diluted 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 13 of 31
14 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

share, on revenue of $1.24 billion, compared to net income of $269.71 million, or $0.26 per diluted 

share, on revenue of $1.08 billion for the same period in the prior year. 

46. In the Q2 2015 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Security breaches or unauthorized access have resulted in and may in the future 

result in a combination of significant legal and financial exposure, increased remediation 

and other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

47. The Q2 2015 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q2 2015 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

48. On November 5, 2015, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended September 30, 2015 

(the “Q3 2015 10-Q”). For the quarter, Yahoo announced net income of $76.26 million, or $0.08 per 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 14 of 31
15 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

diluted share, on revenue of $1.23 billion, compared to net income of $6.77 billion, or $6.70 per diluted 

share, on revenue of $1.15 billion for the same period in the prior year. 

49. In the Q3 2015 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Security breaches or unauthorized access have resulted in and may in the future 

result in a combination of significant legal and financial exposure, increased remediation 

and other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

50. The Q3 2015 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q3 2015 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

51. On February 29, 2016, Yahoo filed an Annual Report on Form 10-K with the SEC, 

announcing the Company’s financial and operating results for the quarter and year ended December 31, 

2015 (the “2015 10-K”). For the quarter, Yahoo announced a net loss of $4.43 billion, or $4.70 per 

diluted share, on revenue of $1.27 billion, compared to net income of $166.34 million, or $0.17 per 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 15 of 31
16 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

diluted share, on revenue of $1.25 billion for the same period in the prior year. For 2015, Yahoo 

announced a net loss of $4.34 billion, or $4.64 per diluted share, on revenue of $4.97 billion, compared 

to net income of $7.52 billion, or $7.45 per diluted share, on revenue of $4.62 billion for 2014. 

52. In the 2015 10-K, with respect to the efficacy of the Company’s encryption of user data, 

Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Additionally, some third parties, such as our distribution partners, service 

providers and vendors, and app developers, may receive or store information provided by 

us or by our users through applications integrated with Yahoo. If these third parties fail to 

adopt or adhere to adequate data security practices, or in the event of a breach of their 

networks, our data or our users’ data may be improperly accessed, used or disclosed. 

Security breaches or unauthorized access have resulted in and may in the future result in 

a combination of significant legal and financial exposure, increased remediation and 

other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

53. The 2015 10-K contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the 2015 10-K was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 16 of 31
17 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

54. On May 10, 2016, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended March 31, 2016 (the 

“Q1 2016 10-Q”). For the quarter, Yahoo announced a net loss of $99.23 million, or $0.10 per diluted 

share, on revenue of $1.09 billion, compared to net income of $21.20 million, or $0.02 per diluted 

share, on revenue of $1.23 billion for the same period in the prior year. 

55. In the Q1 2016 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Additionally, some third parties, such as our distribution partners, service 

providers and vendors, and app developers, may receive or store information provided by 

us or by our users through applications integrated with Yahoo. If these third parties fail to 

adopt or adhere to adequate data security practices, or in the event of a breach of their 

networks, our data or our users’ data may be improperly accessed, used or disclosed. 

Security breaches or unauthorized access have resulted in and may in the future result in 

a combination of significant legal and financial exposure, increased remediation and 

other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 17 of 31
18 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

56. The Q1 2016 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q1 2016 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

57. On July 25, 2016, Verizon formally announced its intent to acquire Yahoo’s internet 

business for $4.8 billion. 

58. On August 8, 2016, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing the Company’s financial and operating results for the quarter ended June 30, 2016 (the “Q2 

2016 10-Q”). For the quarter, Yahoo announced a net loss of $439.91 million, or $0.46 per diluted 

share, on revenue of $1.31 billion, compared to a net loss of $21.55 million, or $0.02 per diluted share, 

on revenue of $1.24 billion for the same period in the prior year. 

59. In the Q2 2016 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo simply stated, in part: 

If our security measures are breached, our products and services may be perceived as 

not being secure, users and customers may curtail or stop using our products and 

services, and we may incur significant legal and financial exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks and corporate systems. Security breaches expose us to a risk of loss of this 

information, litigation, remediation costs, increased costs for security measures, loss of 

revenue, damage to our reputation, and potential liability. Outside parties may attempt to 

fraudulently induce employees, users, or customers to disclose sensitive information to 

gain access to our data or our users’ or customers’ data. In addition, hardware, software 

or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. Additionally, some third parties, such as our distribution partners, service 

providers and vendors, and app developers, may receive or store information provided by 

us or by our users through applications integrated with Yahoo. If these third parties fail to 

adopt or adhere to adequate data security practices, or in the event of a breach of their 

networks, our data or our users’ data may be improperly accessed, used or disclosed. 

Security breaches or unauthorized access have resulted in and may in the future result in 

a combination of significant legal and financial exposure, increased remediation and 

other costs, damage to our reputation and a loss of confidence in the security of our 

products, services and networks that could have an adverse effect on our business. We 

take steps to prevent unauthorized access to our corporate systems, however, because the 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 18 of 31
19 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

techniques used to obtain unauthorized access, disable or degrade service, or sabotage 

systems change frequently or may be designed to remain dormant until a triggering event, 

we may be unable to anticipate these techniques or implement adequate preventative 

measures. If an actual or perceived breach of our security occurs, the market perception 

of the effectiveness of our security measures could be harmed and we could lose users 

and customers. 

60. The Q2 2016 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q2 2016 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

The Truth Begins to Emerge 

61. On September 22, 2016, Yahoo disclosed that hackers had stolen information in late 

2014 on more than 500 million accounts. Following the breach, Yahoo executives advised investors 

that the breach was not material, in part because the Company had not required to reset their passwords. 

62. On this news, Yahoo’s share price fell $1.35, or 3.06%, to close at $42.80 on September 

23, 2016. 

63. On November 9, 2016, Yahoo filed a Quarterly Report on Form 10-Q with the SEC, 

announcing in full the Company’s financial and operating results for the quarter ended September 30, 

2016 (the “Q3 2016 10-Q”). For the quarter, Yahoo announced net income of $162.83 million, or 

$0.17 per diluted share, on revenue of $1.31 billion, compared to net income of $76.26 million, or 

$0.08 per diluted share, on revenue of $1.23 billion for the same period in the prior year. 

64. In the Q3 2016 10-Q, with respect to the efficacy of the Company’s encryption of user 

data, Yahoo stated, in part: 

On September 22, 2016, we disclosed that, based on an ongoing investigation, a copy of 

certain user account information for at least 500 million user accounts was stolen from 

Yahoo’s network in late 2014 (the “Security Incident”). We believe the user account 

information was stolen by a state-sponsored actor. The user account information taken 

included names, email addresses, telephone numbers, dates of birth, hashed passwords 

(the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security 

questions and answers. Our investigation to date indicates that the stolen information did 

not include unprotected passwords, payment card data, or bank account information. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 19 of 31
20 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Payment card data and bank account information are not stored in the system that the 

investigation found to be affected. Based on the investigation to date, we do not have 

evidence that the state-sponsored actor is currently in or accessing the Company’s 

network. 

. . . 

Our security measures may be breached as they were in the Security Incident and user 

data accessed, which may cause users and customers to curtail or stop using our 

products and services, and may cause us to incur significant legal and financial 

exposure. 

Our products and services involve the storage and transmission of Yahoo’s users’ and 

customers’ personal and proprietary information in our facilities and on our equipment, 

networks, and corporate systems. Yahoo is routinely targeted by outside third parties, 

including technically sophisticated and well-resourced state-sponsored actors, attempting 

to access or steal our user and customer data or otherwise compromise user accounts. We 

believe such a state-sponsored actor was responsible for the theft involved in the Security 

Incident. Security breaches or other unauthorized access or actions expose us to a risk of 

theft of user data, regulatory actions, litigation, investigations, remediation costs, damage 

to our reputation and brand, loss of user and partner confidence in the security of our 

products and services and resulting fees, costs, and expenses, loss of revenue, damage to 

our reputation, and potential liability. Outside parties may attempt to fraudulently induce 

employees, users, partners, or customers to disclose sensitive information or take other 

actions to gain access to our data or our users’ or customers’ data. In addition, hardware, 

software, or applications we procure from third parties may contain defects in design or 

manufacture or other problems that could unexpectedly compromise network and data 

security. In addition, our or our partners’ implementation of software may contain 

security vulnerabilities or may not be implemented properly due to human error or 

limitations in our systems. Additionally, some third parties, such as our distribution 

partners, service providers, vendors, and app developers, may receive or store 

information provided by us or by our users through applications that are integrated with 

Yahoo properties and services. If these third parties fail to adopt or adhere to adequate 

data security practices, or in the event of a breach of their networks, our data or our users’ 

data may be improperly accessed, used, or disclosed. Security breaches or other 

unauthorized access (such as the Security Incident) have resulted in, and may in the 

future result in, a combination of significant legal and financial exposure, increased 

remediation and other costs, damage to our reputation, and a loss of confidence in the 

security of our products, services, and networks that could have a significantly adverse 

effect on our business. We take steps to prevent unauthorized access to our corporate 

systems, however, because the techniques used to obtain unauthorized access, disable or 

degrade service, or sabotage systems change frequently or may be disguised or difficult 

to detect, or designed to remain dormant until a triggering event, we may be unable to 

anticipate these techniques or implement adequate preventative measures. Breaches of 

our security measures, such as the Security Incident, or perceived breaches, have caused 

and may in the future cause, the market perception of the effectiveness of our security 

measures to be harmed and cause us to lose users and customers. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 20 of 31
21 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

65. The Q3 2016 10-Q contained signed certifications pursuant to SOX by the Individual 

Defendants, stating that the financial information contained in the Q3 2016 10-Q was accurate and 

disclosed any material changes to the Company’s internal control over financial reporting. 

66. The statements referenced in ¶¶ 24-56, 58-60, and 63-65 above were materially false 

and/or misleading because they misrepresented and/or failed to disclose the following adverse facts 

pertaining to the Company’s business, operational and financial results, which were known to 

Defendants or recklessly disregarded by them. Specifically, Defendants made false and/or misleading 

statements and/or failed to disclose that: (i) Yahoo failed to encrypt its users’ personal information 

and/or failed to encrypt its users’ personal data with an up-to-date and secure encryption scheme; (ii) 

consequently, sensitive personal account information from more than 1 billion users was vulnerable to 

theft; (iii) a data breach resulting in the theft of personal user data would foreseeably cause a significant 

drop in user engagement with Yahoo’s websites and services; and (iv) as a result, Yahoo’s public 

statements were materially false and misleading at all relevant times. 

67. On December 14, 2016, post-market, post-market, Yahoo announced that it had 

uncovered a data breach, stating that data from more than 1 billion user accounts was compromised in 

August 2013. In a press release and Current Report filed with the SEC on Form 8-K, Yahoo stated, in 

part: 

SUNNYVALE, Calif., December 14, 2016— Yahoo! Inc. (NASDAQ:YHOO) has 

identified data security issues concerning certain Yahoo user accounts. Yahoo has taken 

steps to secure user accounts and is working closely with law enforcement. 

As Yahoo previously disclosed in November, law enforcement provided the company 

with data files that a third party claimed was Yahoo user data. The company analyzed this 

data with the assistance of outside forensic experts and found that it appears to be Yahoo 

user data. Based on further analysis of this data by the forensic experts, Yahoo believes 

an unauthorized third party, in August 2013, stole data associated with more than one 

billion user accounts. The company has not been able to identify the intrusion associated 

with this theft. Yahoo believes this incident is likely distinct from the incident the 

company disclosed on September 22, 2016. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 21 of 31
22 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

For potentially affected accounts, the stolen user account information may have 

included names, email addresses, telephone numbers, dates of birth, hashed passwords 

(using MD5) and, in some cases, encrypted or unencrypted security questions and 

answers. The investigation indicates that the stolen information did not include 

passwords in clear text, payment card data, or bank account information. Payment card 

data and bank account information are not stored in the system the company believes was 

affected. 

Yahoo is notifying potentially affected users and has taken steps to secure their 

accounts, including requiring users to change their passwords. Yahoo has also 

invalidated unencrypted security questions and answers so that they cannot be used to 

access an account. 

Separately, Yahoo previously disclosed that its outside forensic experts were 

investigating the creation of forged cookies that could allow an intruder to access users’ 

accounts without a password. Based on the ongoing investigation, the company believes 

an unauthorized third party accessed the company’s proprietary code to learn how to 

forge cookies. The outside forensic experts have identified user accounts for which they 

believe forged cookies were taken or used. Yahoo is notifying the affected account 

holders, and has invalidated the forged cookies. The company has connected some of this 

activity to the same state-sponsored actor believed to be responsible for the data theft the 

company disclosed on September 22, 2016. 

(Emphases added.) 

68. On this news, Yahoo’s share price fell $2.50, or 6.11%, to close at $38.41 on December 

15, 2016. 

69. On December 15, 2016, after the market closed, the Wall Street Journal published an 

article entitled “Yahoo’s Password Move May Put Verizon Deal at Risk.” The article stated, in part: 

Yahoo Inc.’s move to force some users to reset their passwords following a newly 

disclosed security breach could disrupt the planned sale of its core assets to Verizon 

Communications Inc., security experts say. 

Yahoo didn’t force users to reset their passwords after its September disclosure of 

another breach. Experts say forcing users to reset their passwords typically causes some 

to drop a service.

That is one reason why the newly disclosed hack—which Yahoo says occurred in 2013 

and affected more than one billion accounts—could prove more disruptive to Verizon’s 

pending $4.83 billion acquisition of Yahoo’s core assets. 

. . . 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 22 of 31
23 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Yahoo is forcing users to reset their passwords now because some of the material taken 

in the 2013 breach wasn’t encrypted, and other parts were protected by what is now 

considered an outdated encryption scheme, according to a person familiar with that 

matter. 

(Emphases added.) 

70. On January 23, 2017, the Wall Street Journal reported that the SEC had opened an 

investigation into the timing of Yahoo’s disclosures regarding the data breaches. The article reported, 

in part: 

The Securities and Exchange Commission has opened an investigation, and in December 

issued requests for documents, as it looks into whether the tech company’s disclosures 

about the cyberattacks complied with civil securities laws, the people said. The SEC 

requires companies to disclose cybersecurity risks as soon as they are determined to have 

an effect on investors. 

The investigation is likely to center on a 2014 data breach at Yahoo that compromised the 

data of at least 500 million users, according to the people familiar with the matter. Yahoo 

disclosed that breach in September 2016, despite having linked the incident to statesponsored hackers two years earlier. 

To date, Yahoo hasn’t explained why the company took two years to disclose the 2014 

incident publicly or who made the decision not to go public sooner with this information. 

In mid-December Yahoo also said it had recently discovered an August 2013 data breach 

that had exposed the private information of more than 1 billion Yahoo users. 

71. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline in 

the market value of the Company’s common shares, Plaintiff and other Class members have suffered 

significant losses and damages. 

PLAINTIFF’S CLASS ACTION ALLEGATIONS 

72. Plaintiff brings this action as a class action pursuant to Federal Rule of Civil Procedure 

23(a) and (b)(3) on behalf of a Class, consisting of all those who purchased or otherwise acquired 

Yahoo common shares traded on the NASDAQ during the Class Period (the “Class”); and were 

damaged upon the revelation of the alleged corrective disclosures. Excluded from the Class are 

Defendants herein, the officers and directors of the Company, at all relevant times, members of their 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 23 of 31
24 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

immediate families and their legal representatives, heirs, successors or assigns and any entity in which 

Defendants have or had a controlling interest. 

73. The members of the Class are so numerous that joinder of all members is impracticable. 

Throughout the Class Period, Yahoo common shares were actively traded on the NASDAQ. While the 

exact number of Class members is unknown to Plaintiff at this time and can be ascertained only through 

appropriate discovery, Plaintiff believes that there are hundreds or thousands of members in the 

proposed Class. Record owners and other members of the Class may be identified from records 

maintained by Yahoo or its transfer agent and may be notified of the pendency of this action by mail, 

using the form of notice similar to that customarily used in securities class actions. 

74. Plaintiff’s claims are typical of the claims of the members of the Class as all members of 

the Class are similarly affected by Defendants’ wrongful conduct in violation of federal law that is 

complained of herein. 

75. Plaintiff will fairly and adequately protect the interests of the members of the Class and 

has retained counsel competent and experienced in class and securities litigation. Plaintiff has no 

interests antagonistic to or in conflict with those of the Class. 

76. Common questions of law and fact exist as to all members of the Class and predominate 

over any questions solely affecting individual members of the Class. Among the questions of law and 

fact common to the Class are: 

 whether the federal securities laws were violated by Defendants’ acts as alleged 

herein; 

 whether statements made by Defendants to the investing public during the Class 

Period misrepresented material facts about the financial condition, business, 

operations, and management of Yahoo; 

 whether Defendants caused Yahoo to issue false and misleading financial 

statements during the Class Period; 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 24 of 31
25 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 whether Defendants acted knowingly or recklessly in issuing false and 

misleading financial statements; 

 whether the prices of Yahoo securities during the Class Period were artificially 

inflated because of Defendants’ conduct complained of herein; and 

 whether the members of the Class have sustained damages and, if so, what is the 

proper measure of damages. 

77. A class action is superior to all other available methods for the fair and efficient 

adjudication of this controversy since joinder of all members is impracticable. Furthermore, as the 

damages suffered by individual Class members may be relatively small, the expense and burden of 

individual litigation make it impossible for members of the Class to individually redress the wrongs 

done to them. There will be no difficulty in the management of this action as a class action. 

78. Plaintiff will rely, in part, upon the presumption of reliance established by the fraud-onthe-market doctrine in that: 

 Defendants made public misrepresentations or failed to disclose material facts 

during the Class Period; 

 the omissions and misrepresentations were material; 

 Yahoo common shares are traded in efficient markets; 

 the Company’s shares were liquid and traded with moderate to heavy volume 

during the Class Period; 

 the Company traded on the NASDAQ, and was covered by multiple analysts; 

 the misrepresentations and omissions alleged would tend to induce a reasonable 

investor to misjudge the value of the Company’s common shares; and 

 Plaintiff and members of the Class purchased and/or sold Yahoo common shares 

between the time the Defendants failed to disclose or misrepresented material 

facts and the time the true facts were disclosed, without knowledge of the 

omitted or misrepresented facts. 

79. Based upon the foregoing, Plaintiff and the members of the Class are entitled to a 

presumption of reliance upon the integrity of the market. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 25 of 31
26 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

80. Alternatively, Plaintiff and the members of the Class are entitled to the presumption of 

reliance established by the Supreme Court in Affiliated Ute Citizens of the State of Utah v. United 

States, 406 U.S. 128, 92 S. Ct. 2430 (1972), as Defendants omitted material information in their Class 

Period statements in violation of a duty to disclose such information, as detailed above. 

COUNT I 

Violation of Section 10(b) of The Exchange Act and Rule 10b-5 

Against All Defendants 

81. Plaintiff repeats and realleges each and every allegation contained above as if fully set 

forth herein. 

82. This Count is asserted against Yahoo and the Individual Defendants and is based upon 

Section 10(b) of the Exchange Act, 15 U.S.C. § 78j(b), and Rule 10b-5 promulgated thereunder by the 

SEC. 

83. During the Class Period, Yahoo and the Individual Defendants, individually and in 

concert, directly or indirectly, disseminated or approved the false statements specified above, which 

they knew or deliberately disregarded were misleading in that they contained misrepresentations and 

failed to disclose material facts necessary in order to make the statements made, in light of the 

circumstances under which they were made, not misleading. 

84. Yahoo and the Individual Defendants violated §10(b) of the 1934 Act and Rule 10b-5 in 

that they: 

 employed devices, schemes and artifices to defraud; 

 made untrue statements of material facts or omitted to state material facts 

necessary in order to make the statements made, in light of the circumstances 

under which they were made, not misleading; or 

 engaged in acts, practices and a course of business that operated as a fraud or 

deceit upon plaintiff and others similarly situated in connection with their 

purchases of Yahoo common shares during the Class Period. 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 26 of 31
27 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

85. Yahoo and the Individual Defendants acted with scienter in that they knew that the 

public documents and statements issued or disseminated in the name of Yahoo were materially false 

and misleading; knew that such statements or documents would be issued or disseminated to the 

investing public; and knowingly and substantially participated, or acquiesced in the issuance or 

dissemination of such statements or documents as primary violations of the securities laws. These 

Defendants by virtue of their receipt of information reflecting the true facts of Yahoo, their control 

over, and/or receipt and/or modification of Yahoo allegedly materially misleading statements, and/or 

their associations with the Company which made them privy to confidential proprietary information 

concerning Yahoo, participated in the fraudulent scheme alleged herein. 

86. Individual Defendants, who are the senior officers and/or directors of the Company, had 

actual knowledge of the material omissions and/or the falsity of the material statements set forth above, 

and intended to deceive Plaintiff and the other members of the Class, or, in the alternative, acted with 

reckless disregard for the truth when they failed to ascertain and disclose the true facts in the statements 

made by them or other Yahoo personnel to members of the investing public, including Plaintiff and the 

Class. 

87. As a result of the foregoing, the market price of Yahoo common shares was artificially 

inflated during the Class Period. In ignorance of the falsity of Yahoo’s and the Individual Defendants’ 

statements, Plaintiff and the other members of the Class relied on the statements described above and/or 

the integrity of the market price of Yahoo common shares during the Class Period in purchasing Yahoo 

common shares at prices that were artificially inflated as a result of Yahoo’s and the Individual 

Defendants’ false and misleading statements. 

88. Had Plaintiff and the other members of the Class been aware that the market price of 

Yahoo common shares had been artificially and falsely inflated by Yahoo’s and the Individual 

Defendants’ misleading statements and by the material adverse information which Yahoo’s and the 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 27 of 31
28 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Individual Defendants did not disclose, they would not have purchased Yahoo’s common shares at the 

artificially inflated prices that they did, or at all. 

89. As a result of the wrongful conduct alleged herein, Plaintiff and other members of the 

Class have suffered damages in an amount to be established at trial. 

90. By reason of the foregoing, Yahoo and the Individual Defendants have violated Section 

10(b) of the 1934 Act and Rule 10b-5 promulgated thereunder and are liable to the plaintiff and the 

other members of the Class for substantial damages which they suffered in connection with their 

purchase of Yahoo common shares during the Class Period. 

COUNT II 

Violation of Section 20(a) of The Exchange Act 

Against The Individual Defendants 

91. Plaintiff repeats and realleges each and every allegation contained in the foregoing 

paragraphs as if fully set forth herein. 

92. During the Class Period, the Individual Defendants participated in the operation and 

management of Yahoo, and conducted and participated, directly and indirectly, in the conduct of 

Yahoo’s business affairs. Because of their senior positions, they knew the adverse non-public 

information regarding the Company’s inadequate internal safeguards in data security protocols. 

93. As officers and/or directors of a publicly owned company, the Individual Defendants had 

a duty to disseminate accurate and truthful information with respect to Yahoo’s financial condition and 

results of operations, and to correct promptly any public statements issued by Yahoo which had become 

materially false or misleading. 

94. Because of their positions of control and authority as senior officers, the Individual 

Defendants were able to, and did, control the contents of the various reports, press releases and public 

filings which Yahoo disseminated in the marketplace during the Class Period. Throughout the Class 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 28 of 31
29 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Period, the Individual Defendants exercised their power and authority to cause Yahoo to engage in the 

wrongful acts complained of herein. The Individual Defendants therefore, were “controlling persons” of 

Yahoo within the meaning of Section 20(a) of the Exchange Act. In this capacity, they participated in 

the unlawful conduct alleged which artificially inflated the market price of Yahoo common shares. 

95. By reason of the above conduct, the Individual Defendants are liable pursuant to Section 

20(a) of the Exchange Act for the violations committed by Yahoo. 

PRAYER FOR RELIEF 

WHEREFORE, Plaintiff demands judgment against Defendants as follows: 

A. Determining that the instant action may be maintained as a class action under Rule 23 of 

the Federal Rules of Civil Procedure, and certifying Plaintiff as the Class representative; 

B. Requiring Defendants to pay damages sustained by Plaintiff and the Class by reason of 

the acts and transactions alleged herein; 

C. Awarding Plaintiff and the other members of the Class prejudgment and post- judgment 

interest, as well as their reasonable attorneys’ fees, expert fees and other costs; and 

D. Awarding such other and further relief as this Court may deem just and proper. 

DEMAND FOR TRIAL BY JURY 

Plaintiff hereby demands a trial by jury. 

Dated: January 24, 2017 

Respectfully submitted, 

POMERANTZ LLP 

By: /s/ Jennifer Pafiti 

Jennifer Pafiti (SBN 282790) 

468 North Camden Drive 

Beverly Hills, CA 90210 

Telephone: (818) 532-6499 

E-mail: jpafiti@pomlaw.com 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 29 of 31
30 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

POMERANTZ, LLP 

Jeremy A. Lieberman 

J. Alexander Hood II 

Hui M. Chang 

600 Third Avenue, 20th Floor 

New York, New York 10016 

Telephone: (212) 661-1100 

Facsimile: (212) 661-8665 

E-mail: jalieberman@pomlaw.com 

E-mail: ahood@pomlaw.com 

E-mail: hchang@pomlaw.com 

POMERANTZ LLP 

Patrick V. Dahlstrom 

Ten South La Salle Street, Suite 3505 

Chicago, Illinois 60603 

Telephone: (312) 377-1181 

Facsimile: (312) 377-1184 

E-mail: pdahlstrom@pomlaw.com 

GOLDBERG LAW PC 

Michael Goldberg 

Brian Schall 

1999 Avenue of the Stars 

Los Angeles, California 90067 

Suite 1100 

Telephone: 1-800-977-7401 

Fax: 1-800-536-0065 

Email: michael@goldberglawpc.com 

Email: brian@goldberglawpc.com 

Attorneys for Plaintiff 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 30 of 31
{00221758;3 } 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

Case 5:17-cv-00373-LHK Document 1 Filed 01/24/17 Page 31 of 31