Yahoo Data Breach: Company Sued For Gross Negligence As Massive Hack Casts Cloud Over Verizon Deal

For Yahoo, troubled times are far from over.

Just a day after it came to light that the personal information of at least 500 million of its users was stolen in a massive data breach in 2014 — the largest-known breach of user accounts — the company is now being sued for gross negligence over its failure to secure customer data.

In a lawsuit filed Friday in the federal court in San Jose, California, the plaintiff — a New York resident named Ronald Schwartz — alleged that as a result of Yahoo’s “failure to establish and implement basic data security protocols, contrary to Yahoo’s guarantees, its users’ personal information is now in the hands of criminals and/or enemies of the U.S.”

Schwartz has reportedly sought a class-action lawsuit against the company and an unspecified amount as compensation. According to Bloomberg, similar cases have also been filed in Illinois and San Diego.

“Defendant’s misconduct was so bad that it evidently allowed unauthorized and malicious access to plaintiff’s and the class’s personal information on defendant’s computer systems to continue unimpeded for nearly two years,” the California lawsuit reportedly alleged.

The lawsuit, and the revelation of the data breach — for which Yahoo has blamed a “state-sponsored actor” — comes at a time when CEO Marissa Mayer is trying to shore up revenue growth ahead of its planned $4.8 billion acquisition by Verizon early next year.

Once it acquires Yahoo, the New York-based Verizon is likely to combine its online business with AOL, which it bought last year in a deal valued at roughly $4.4 billion. It is not yet clear if the disclosure of the data breach would affect Verizon’s plans. In a statement released Friday, the company reportedly said that it had only been notified of the 2014 hack “within the last two days.”

“We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact. We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities,” Verizon said. “Until then, we are not in position to further comment.”

According to legal experts cited by the Wall Street Journal, the data breach may give Verizon enough leverage to renegotiate the terms of the deal by invoking "material adverse effect" clauses in the merger agreement. The terms of the Verizon-Yahoo deal reportedly define material adverse effects as developments that can have a detrimental impact on "the business, assets, properties, results of operation or financial condition of the business, taken as a whole."

However, whether the data breach can be construed as such an incident depends on its interpretation by the parties involved.

"It’s vague," Stephen Wu, a lawyer at the Silicon Valley Law Group who reviewed the purchase agreement, told the Journal. "This is an agreement written in a way that there’s a judgment call that needs to be made."

If the deal falls through, Yahoo, already struggling to remain profitable as it competes with Google and Facebook for digital market advertising share, would have to pay roughly $145 million as termination fees to Verizon.