Yahoo has been ordered by a federal judge to face much of a lawsuit in the United States claiming that the personal information of all 3 billion users was compromised in a series of data breaches. Verizon Communications (NYSE:VZ), which purchased Yahoo's internet business last June, attempted to have the claims dismissed.
California judge Lucy Koh rejected a bid by Verizon, which bought the internet giant a year ago, to dismiss a large portion of the claims, including breach of contract, deceit and concealment, and negligence.
Additionally, Koh granted a motion to dismiss claims made under the California Customer Records Act, and claims of breach of implied covenant of good faith and fair dealing.
The case began in 2016, after a number of plaintiffs sued the web services provider following a disclosure that more than 1 billion email accounts had been hacked three times over a three-year period beginning in 2013.
The data hack is the largest in history.
One of the reasons why ruling went against Yahoo is Yahoo took nearly 4 years to reveal the truth about the data breach, which, according to judge, is a serious breach of contract and risking identity as well as assets of the shareholders.
The suit accused Yahoo! and its ownership group of failing to properly disclose and remedy the 2014 breach that resulted in some 3 billion Yahoo!-hosted email accounts being exposed to hackers.
The judge also chided Yahoo's legal strategy of blaming its customers for continuing to use its email services after learning of data breaches.
The breaches exposed usernames and passwords used to login to Yahoo accounts to hackers. They say Yahoo's failure to promptly disclose the depth and breadth of the hack created direct financial harm.
"Plaintiffs' allegations are sufficient to show that they would have behaved differently had defendants disclosed the security weaknesses of the Yahoo Mail System", Koh wrote in her decision, which was obtained by International Business Times.
Meanwhile, Yahoo, in its defense brought out the fact that the United States government charged two Russian agents and two hackers of sabotage and identity theft of 500 million accounts. The other three have not been apprehended and are believed to be in Russian Federation.