[BreachExchange] Lawyers File New Yahoo Data Breach Settlement, Boosting Its Value to $117.5M

[Destry Winant]

https://www.law.com/therecorder/2019/04/09/lawyers-file-new-yahoo-data-breach-settlement-boosting-its-value-to-117m/?slreturn=20190310014003

Attorneys have boosted a class action settlement over Yahoo Inc.’s
recent data breaches to $117.5 million after a federal judge rejected
preliminary approval of it earlier this year.

The settlement, filed Tuesday with the U.S. District Court for the
Northern District of California, includes a single fund from which $55
million would be available for out-of-pocket costs and $24 million in
identity theft protection for class members (or $100 payments to those
who already have credit monitoring). It also includes $30 million in
attorney fees and $2.5 million in legal costs, a slight reduction from
the original fee request.

“Following the court’s denial of preliminary approval, the parties
immediately set about addressing the issues the court identified,
re-engineering the resolution of this case,” wrote lead plaintiffs
counsel, Tampa, Florida-based John Yanchunis of Morgan & Morgan.

The deal is one of the largest data breach settlements in U.S. history.

In 2016, Yahoo announced that 500 million accounts had been hacked in
2014, compromising names, email addresses, phone numbers, birth dates
and passwords. Months later, Yahoo disclosed another breach in 2013
that affected 1 billion accounts, a figure that Verizon increased to 3
billion last year. The settlement also involves a third breach in 2015
and 2016.

The defendants are Altaba Inc., the division of Verizon formerly known
as Yahoo, and Oath Holdings Inc., which owns Yahoo’s holding company.

The original $85 million settlement included a $50 million fund from
which consumers could make claims for out-of-pocket costs. In
addition, Yahoo had agreed to provide at least two years of credit
monitoring and identity theft protection insurance to class members.

U.S. District Judge Lucy Koh, who rejected the deal on Jan. 28, asked
why the class involved only 200 million individuals with about 1
billion Yahoo accounts. She also questioned why it took 32 firms to
work on issues that were “not particularly novel.” The $35 million fee
request was “unreasonably high,” she wrote. The firms had included a
$22 million lodestar calculation for 143 lawyers.

She also found the settlement improperly released claims relating to
smaller breaches in 2012, calling Yahoo’s nondisclosures and lack of
transparency “egregious.”

An amended complaint filed Monday, however, expanded the class to
include Yahoo users in 2012. The motion for settlement approval
estimated that 194 million individuals holding 896 million accounts
would be part of the class.

The $117.5 million settlement fund would reimburse businesses and
individuals, with a $25,000 cap for individuals. The reimbursement is
for fraud charges, and other costs, and includes compensable time
spent dealing with the breach’s repercussions. The fund also includes
$6 million in administrative costs.

Leftover funds would not revert to the defendants but end up
distributed as cy pres to the Electronic Privacy Information Center.

The new deal includes an information security budget of more than $300
million over the next four years, with 200 people involved, which are
“amounts that are at least four times and three times greater,
respectively, than Yahoo maintained prior to this case,” the motion
says.

“Enhanced and improved data security is a critical aspect of the
settlement,” the motion says.

A spokesman for Verizon Media, speaking for Yahoo, said in an emailed
statement: “We believe that the settlement demonstrates our strong
commitment to security.”

Yahoo is represented in the matter by counsel at Gibson, Dunn &
Crutcher and Hunton Andrews Kurth.