Mere hours after news that hundreds of millions of Yahoo user accounts had been hacked, users filed a class-action suit accusing the Sunnyvale tech firm of putting their finances at risk and failing to notify them earlier about the breach.
“While investigating another potential data breach, Yahoo uncovered this data breach, dating back to 2014,” the lawsuit, filed Thursday in U.S. District Court in San Diego, said. “Two years is unusually long period of time in which to identify a data breach.”
On Friday in U.S. District Court in San Jose, a second class-action suit was filed over the hack. Plaintiff Ronald Schwartz, of New York, claims his personal information was stolen. His suit calls Yahoo’s treatment of users’ data “grossly negligent” and alleges that circumstantial evidence indicates “Yahoo insiders” knew of the breach “long before it was disclosed.”
The plaintiffs in the San Diego suit had contacted lawyer David Casey before news of the breach broke Thursday, believing their personal information had been stolen, Casey said Friday.
“They were trying to figure out how people were accessing their information,” Casey said. “When this (breach) became public, they put two and two together.”
One of the plaintiffs suffered an identity theft that led to “intrusion into personal financial matters,” Casey said.
In the hack, which appears to be the largest in history, users’ email addresses, birthdates, phone numbers, passwords with various levels of encryption, and security questions and answers “may” have been among the data stolen, Yahoo said Thursday. The company said users’ financial information had not been compromised.
However, the San Diego lawsuit claimed Yahoo users’ financial information had been breached. Casey said it wasn’t necessary for financial data to have been stolen to jeopardize users’ finances, as nonfinancial information can be used to steal identities and gain access to personal finances.
Other allegations against Yahoo in the San Diego suit include deception, misrepresentation, invasion of privacy and negligence.
Yahoo declined to discuss the allegations in the lawsuits, saying the company doesn’t comment on ongoing litigation.
The firm said Thursday it had discovered the hack during a “recent” investigation, and a source close to the matter said the discovery occurred after a probe into what turned out to be an unfounded report from July of a breach of user data.
The lawsuits refer to research indicating the average time to identify a hack is 191 days and the average time to contain a breach is 58 days after it’s discovered. Casey said the fact that it took Yahoo nearly two years to find out it had been hacked was a significant factor in the legal case.
The first complaint was filed by San Diego residents Jennifer J. Myers and Paul Dugas, who stated that they were Yahoo users at the time of the 2014 data theft, which Yahoo said hit at least 500 million user accounts.
The lawsuits cite 500,000 potential class-action participants. Both legal actions seek a jury trial and unspecified damages.
Yahoo, in the midst of a $4.8 billion sale to Verizon, blamed a “state-sponsored actor” for the attack, but did not name the country allegedly involved. The FBI is investigating the breach.
The price of Yahoo stock rose slightly on Thursday as news of the breach was circulating, but began to drop in after-hours trading. After opening Thursday at $43.94, the share price had sunk to $42.60 by 12:30 p.m. Friday before rising slightly to close at $42.80.
