Yahoo proposes $117.5 million settlement in data breach suit

Yahoo has agreed to pay a $117.5 million settlement to users affected by a massive data breach, a deal that if approved would be the largest common fund created for a data breach case, according to court documents filed Tuesday.

"We believe that the settlement demonstrates our strong commitment to security," a spokesman for Verizon Communications Inc., which owns Yahoo, said in a statement Tuesday.

The lawsuit resulted from one of the largest data breaches in history, according to court documents, when Yahoo announced a 2014 breach of 500 million accounts.

Months later, it was revealed that approximately all 3 billion Yahoo accounts were compromised, according to court documents. In re: Yahoo Inc. Customer Data Breach Security Litigation, 16-MD02752 (N.D. Cal., filed October 22, 2018).

In the complaint filed in 2016, the Yahoo account holder plaintiffs alleged the company was negligent in protecting their personal data and discovering the 2013 breach that compromised all of Yahoo's accounts, a security failure that allegedly wasn't discovered until 2016.

"(Yahoo's) misconduct was so bad that it evidently allowed unauthorized and malicious access to Plaintiffs' and the Class members' personal information on Defendant's computer systems to continue unimpeded for approximately three years," the complaint claimed.

About half of Tuesday's settlement funds are for victims' expenses, and the terms establish $24 million for two years of credit monitoring for the affected users. Verizon also agreed to spend $306 million for the next three years on increased information security.

Tuesday's proposed settlement comes after U.S. District Judge Lucy H. Koh shot down a $50 million settlement in January, voicing concerns over the proposed deal's ambiguity about how much money victims could recover, high legal fees and missing information concerning a 2012 breach.

Tuesday's settlement detailed the 2012 breaches as hacking groups "actively compromising Yahoo's systems" and affecting approximately one billion accounts in the U.S. and Israel.

The motion to notice the class was filed Monday and responses are due by April 29.

Koh scheduled a hearing on the settlement proposal, which she must approve, on June 27.

Ann Marie Mortimer, a Hunton Andrews Kurth LLP partner representing Yahoo, and Gayle M. Blatt, an attorney for Casey Gerry Schenk Francavilla Blatt & Penfield LLP representing local plaintiffs, did not respond to requests for comment Tuesday.