Yahoo! Inc.

In 2013, Russian hackers stole the records of Yahoo’s 3 billion users — including usernames, phone numbers, encrypted passwords and other sensitive information. In 2014, Russian hackers again compromised the accounts of 500 million Yahoo users. From 2013 through 2015, while Yahoo continued to tout its robust security measures, news of security issues at the company repeatedly surfaced. In 2016, while closing a deal with Verizon, Yahoo finally disclosed the 2014 data breach.

Historically, data breach disclosures by publicly traded companies were not generally followed by significant stock price declines, making it difficult to show that investors suffered material harm. With stock prices largely unaffected, cyber-related disclosures, if they engendered any litigation, mainly drove shareholder derivative or consumer protection actions. Data breach securities class actions, when filed, were typically dismissed early on by courts, leaving virtually no precedents.

Pomerantz’s initial investigations revealed a strong indication that Yahoo and its directors had knowingly concealed the company’s deficient security practices and the data breaches of 2013 and 2014. However, the Firm was aware that, given the history of similar litigation, bringing a lawsuit based on such claims was risky. Eager to shape new law, Pomerantz, along with co-counsel, filed a putative securities class action against Yahoo in March 2017.

Pomerantz located critical evidence showing that Yahoo’s management had concurrent knowledge of at least one of the data breaches. Importantly, these records showed that Yahoo’s Board of Directors, including Defendant CEO Marissa Mayer, had knowledge of and received repeated updates regarding the breach despite Yahoo denying in its public filings that the CEO knew about the breach. The CEO’s knowledge was a key issue in the case.

The complaint alleged that Yahoo and some of its officers failed to disclose the massive data breaches of 2013 and 2014, as well as two additional data breaches in 2015 and 2016, which affected an additional 32 million Yahoo users. The suit further alleged that defendants knowingly concealed its grossly outdated and substandard information security methods and technologies throughout the class period, while continuing to reassure the public that Yahoo had “physical, electronic, and procedural safeguards that [complied] with federal regulations to protect personal information about [its users],” that it would publicly disclose all security vulnerabilities within 90 days of discovery, and that its data security employed “best practices,” among other misrepresentations.

Beyond the 31% decline in share price allegedly suffered by Yahoo’s investors over the course of the class period in reaction to its data breach disclosures, Pomerantz and co-counsel further argued that these data breach disclosures had a substantial and quantifiable financial impact on Yahoo, evidenced when Verizon Communications, Inc. reduced its bid to acquire Yahoo by a whopping $350 million, to $4.4 billion. Pomerantz’s response to the defendants’ arguments applied the established federal securities laws to the new phenomenon of data breaches. Commentators have noted the significance of Yahoo in showing that misstatements related to data breaches are as severe as those at issue in this action.

A month after the class action settlement received preliminary approval from the court, the SEC imposed a $35 million fine on Yahoo in connection with the 2014 data breach, marking the first time a publicly traded company had been fined for a cybersecurity hack. While the SEC acknowledged that large companies are at risk of persistent cyber-related breaches by hackers, it maintained that this did not excuse companies from reasonably dealing with these risks and of responding to known cyber-breaches. The SEC stated that Yahoo continued to mislead investors with generic public disclosures about the risks of cyber-related breaches, when it knew a significant breach had occurred.

Following on the heels of this fine, the SEC updated its guidance on cybersecurity disclosures to stress the importance of cybersecurity policies and procedures and advise companies that they need “disclosure controls and procedures that provide an appropriate method of discerning the impact that such matters may have on the company and its business, financial condition and results of operations.” It also calls for public companies to be more open when disclosing cybersecurity risks, with companies expected “to disclose cybersecurity risks and incidents that are material to investors, including the concomitant financial, legal or reputational consequence.”

Pomerantz’s Yahoo! litigation team included Partners Emma Gilmore, Jeremy A. Lieberman, Michael Grunfeld and Senior Counsel Patrick V. Dahlstrom.