It only took one day for lawsuits to be filed against Yahoo regarding its recent announcement of the data breach that exposed personal information for over 500 million users.
The lawsuit, first reported by Fortune, stems from a public statement from Yahoo in which the company acknowledged that “someone” breached its servers in 2014 and stole user information.
Yahoo blamed “state-sponsored” actors and said it continues to investigate the incident.
A New Yorker named Ronald Schwartz filed the lawsuit on behalf of all Yahoo users and is seeking class action measures. Schwartz accuses the company of gross negligence.
Schwartz's lawyers filed the lawsuit in San Jose, California, one of the US states with the strictest data breach rules and home to Yahoo.
Verizon announced in July that it would purchase some of Yahoo's core assets for $4.8 billion. The deal will take some time to finalize and Verizon may find legal loopholes to back out of the acquisition if the lawsuit becomes too costly.
The acquisition came before Yahoo received a tip about a data breach in August, when a hacker named peace_of_mind had put up to 200 million user records for sale on a Dark Web marketplace.
According to Yahoo, this tip caused the company to investigate the breach, which turned out to be false, but later revealed the larger breach.
Schwartz claims that Yahoo should not have to wait almost two months to tell its users about the breach. However, Yahoo could be exonerated if the FBI, which had also been called to investigate, admits that the agency's employees instructed the company not to disclose the situation immediately to its customers, as is customary during the investigation of sensitive breaches. If not, things are not good for the company.
Ironically, on the same day Yahoo announced its $500 million breach, a UK judge sentenced a hacker to two years in prison for hacking Yahoo! Voice in 2012, from which he stole and dumped personal information from over 450,000 users, the largest data breach in Yahoo's history to that point.
