$117.5 Million Yahoo Data Breach Settlement, the Largest Common Fund Ever Recovered in a Data Breach Case

Between 2013 and 2016, hackers working in successive waves stole data associated with essentially every Yahoo account in existence, names, email addresses, phone numbers, birth dates, hashed passwords, and the security questions and answers that guard password resets. Roughly 3 billion accounts were compromised in what remains the largest data breach ever disclosed, and Yahoo compounded the damage by sitting on the news for years, revealing the intrusions only in 2016 as Verizon was negotiating to buy the company.

The consolidated class action that followed in the Northern District of California became the proving ground for a question courts had dodged for a decade: what is stolen personal data actually worth? Judge Lucy Koh appointed John Yanchunis, head of Morgan & Morgan's complex litigation group in Tampa, to lead the plaintiffs' side, a role that put a personal injury firm best known for Florida jury trials at the center of the biggest privacy case in the country.

The litigation was neither quick nor smooth. Yahoo and its successor entities fought dismissal, fought certification, and then offered a settlement that Judge Koh threw out in January 2019 as inadequately funded and insufficiently transparent, a rare rejection that forced the parties back to the table. The revised deal Yanchunis's team negotiated put $117.5 million into a non-reversionary common fund: at least $55 million earmarked for victims' out-of-pocket losses, $24 million for two years of credit monitoring, and the remainder covering notice, administration, and court-approved fees.

Judge Koh granted final approval in 2020, finding the reworked settlement fair to a class of as many as 194 million people in the United States and Israel holding roughly 896 million accounts. In court filings, Yanchunis called it the biggest common fund ever obtained in a data breach case, a claim no one seriously disputed, since nothing close to it existed.

The Yahoo settlement did more than move money. It established the template, real cash funds, credit monitoring with teeth, judicial scrutiny of claims-made gimmicks, that Yanchunis and other privacy lawyers would carry into Equifax, Capital One, and T-Mobile. For Morgan & Morgan, it marked the firm's arrival as a national force in data privacy litigation, far from the courtroom lanes it was built in.