SAN JOSE, Calif. (CN) - A federal judge denied approval of a settlement in the Yahoo data breach class action on Monday, saying Yahoo’s refusal to disclose the total amount to be paid out to those affected by the largest data breach in history renders it insufficient.
“The proposed notice does not disclose the costs of credit monitoring services or costs for class notice and settlement administration, and does not disclose the total size of the settlement fund,” U.S. District Judge Lucy Koh wrote in a 24-page ruling. “Without knowing the total size of the settlement fund, class members cannot assess the reasonableness of the settlement.”
Koh’s denial of the settlement comes as no surprise to those who followed the case closely, as the judge badgered both sides with questions during a November hearing and expressed displeasure particularly aimed at the plaintiffs, who she accused of being more concerned about getting paid than investigating how Yahoo allowed hackers gain access to the private data of its customers.
“I’m disappointed that there doesn’t seem to be any motivation to get to the bottom of this,” Koh said in November. “It appears there’s a willful blindness or an attitude of ‘Let’s settle this and get out.’ The motivation of this lawsuit should be to find out the full extent of the potential damage and alert users so they can take precautions like shutting down bank accounts or getting new credit cards.”
Koh echoed that sentiment in her ruling on Monday, saying that while the total settlement amount for those affected was vague, the attorneys’ fees relative to the settlement were too high.
The lead plaintiffs’ counsel, John Yanchunis, of Morgan & Morgan in Tampa Bay, Florida, sought $22 million for his firm and 32 other firms with about 140 attorneys associated with the case. But Koh notes only five firms were authorized to work on the litigation, which was consolidated from lawsuits filed in federal courts throughout the country.
Koh also questioned whether the quality of the work itself justified the costs.
“The court concludes that the legal theories involved were not particularly novel,” she wrote in the ruling. “In Adobe and Anthem, this Court previously addressed several of the legal theories that Plaintiffs relied on in the instant case.”
Koh said the attorneys are asking for higher fees than the class attorneys who litigated the High Tech case, an antitrust case that found major technology companies like Apple, Google and Intel were colluding to keep employee salaries artificially low.
“Class counsel claim to have spent more time litigating this case and request a higher lodestar figure than class counsel did in High-Tech,” Koh said. “This claim is surprising. Moreover, class counsel in High-Tech secured a significantly larger settlement of $415 million with more direct payments to class members than the $50 million settlement fund disclosed in the proposed notice here.”
Koh also criticizes the non-monetary relief, saying the settlement does not require robust security enhances, which was the case in other data breach cases.
“As a result of the lack of specific increases in budget or number of employees and the vague commitments as to changed business practices, the court cannot adequately consider the benefits offered to the class in settlement,” Koh writes.
The denial means the parties will have to consider new terms for a settlement. An email sent to Yanchunis was not immediately returned Monday evening.
Follow @@MatthewCRenda
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
