Santa Clara, CA: Yahoo is facing a class action lawsuit brought by a small business owner in Texas who alleges his identity and information for his websites and online advertising, which he runs through Yahoo, were compromised during the two large data breaches the Internet giant disclosed in 2015.
Specifically, Brian Neff claims that Yahoo and its subsidiary, Aabaco Small Business LLC, breached its contract and negligently allowed hackers to access data on a billion Yahoo users during the two breaches.
Filed in California federal court, the lawsuit claims Yahoo failed to protect the “treasure trove” of personal information he provided to the company in order to set up and pay for an account in 2009. The theft of that data has resulted in a number of fraudulent charges on his bank accounts, as well as an unauthorized card being opened in his name.
In September 2015, Yahoo announced that in late 2014, information from 500 million accounts was stolen. While that Yahoo data breach was considered to be the largest in history, in December Yahoo then revealed that in 2013, hackers had stolen account data for one billion of its users in 2013.
Neff alleges that while Yahoo claims that the data taken was just email addresses and passwords, not bank account information, at this early stage it is unknown whether Yahoo’s descriptions of the breadth of the breaches are accurate.
“Given that more than three years elapsed before Yahoo disclosed the 2013 data breach and more than two years passed before Yahoo disclosed the 2014 data breach, Mr. Neff is rightfully skeptical of Yahoo’s self-serving statements,” the complaint states.
Neff states that in addition to paying Yahoo thousands of dollars “for services that subjected him to a security breach,” he was also the victim of actual identity theft as a result of either or both of the hacks. According to the complaint, Neff has incurred fraudulent charges on his Capital One credit card and his Chase debit card, both of which were on file with Yahoo to pay for the website services. Yahoo was the only company to which Neff had given that information to, the complaint alleges.
Further, the suit states that concurrent with the fraudulent charges, an unauthorized credit card account was opened at Credit One Bank in his name, and additional charges were made to that account.
The complaint includes claims for breach of contract, breach of implied contract, negligence, fraudulent and negligent inducement, and violations of California’s Unfair Competition Law. He’s seeking to represent a national class of Yahoo and Aabaco small business customers whose personal identifying information was disclosed in the 2013 or 2014 data breaches.
Neff is represented by David Azar of Milberg LLP. The case is Brian Neff v. Yahoo Inc. et al., case number 5:17-cv-00641, in the U.S. District Court for the Northern District of California.
