The court identified six problems with the deal. “Any of these bases would be sufficient to deny the motion for preliminary approval,” Judge Lucy H. Koh wrote for the U.S. District Court for the Northern District of California.
The settlement would end consumer class claims for everyone who had a Yahoo account from 2012 to 2016, when the company was hit with multiple data breaches.
Yahoo has settled three other actions arising from the breaches. It settled Securities and Exchange Commission claims that it misled investors for $35 million in April 2018. In September 2018, Koh granted final approval to a $80 million settlement with investors. And in January 2019, a California state court granted final approval to a $29 million shareholder derivative settlement.
Under the proposed settlement agreement here, Yahoo would put up a $50 million settlement fund, additional attorneys’ fees of up to $35 million, costs of up to $2.5 million, and service awards of up to $7,500 for each class representative. The company would also provide customers with two years of credit monitoring and improve its data security.
But the settlement agreement lacked sufficient detail about how much the deal would cost Yahoo in total, the court said.
The proposed notice of the deal doesn’t disclose the costs of credit monitoring or how much Yahoo will spend on security, the court said.
Without knowing the total size of the settlement fund, class members can’t assess the reasonableness of the settlement or the attorneys’ fee request, the court said.
The fees in particular concerned the court. The request seemed “unreasonably high,” and any amount not awarded by the court would revert to Yahoo rather than benefit the class, the court said.
The court also challenged the parties’ estimate of the number of class members. They said the class includes about 80 percent of the U.S. population during the class period, 200 million people.
But the court’s estimate of the number of active users in the U.S. is far lower.
Morgan & Morgan P.A.; Milberg Tadler Phillips Grossman LLP; Robbins Geller Rudman & Dowd LLP; Casey Gerry Schenk Francavilla Blatt & Penfield LLP; and Lockridge Grindal Nauen PLLP are the customers’ executive committee.
Gibson, Dunn & Crutcher LLP; Hunton Andrews Kurth LLP; and Chapman Spingola LLP represented Yahoo.
The case is In re Yahoo! Inc. Customer Data Sec. Breach Litig., 2019 BL 27288, N.D. Cal., No. 16-MD-2752, 1/28/19.