Yahoo! Can't! Toss! Hacking! Lawsuit!

The remains of Yahoo! will be forced to defend the class action complaint filed by customers whose data was exposed in the 2014 megahack.

ON Friday Judge Lucy Koh denied in part a motion by parent company Verizon to have the complaint thrown out of court. The scope of the suit, however, was narrowed as parts were dismissed.

The suit accused Yahoo! and its ownership group of failing to properly disclose and remedy the 2014 breach that resulted in some 3 billion Yahoo!-hosted email accounts being exposed to hackers. Yahoo! would eventually fess up to the breach in 2016, but only after it had already agreed to an acquisition deal with Verizon that would lump Yahoo! in with Aol as part of a new company called "Oath".

In her 48-page decision (PDF), Koh found that while parts of the complaint stood up to scrutiny, plaintiffs will have to show they actually suffered damages or losses.

Koh agreed to toss the claims of two of the named plaintiffs who claim violations of California's unfair competition law on grounds of the threat of identity theft from the breach, but upheld the claim of another plaintiff who had paid $19.95 per year for the premium email service.

"Even if his annual fee did not provide for security measures above and beyond those for free accounts, Plaintiff Mortensen pleads that Defendants’ representations about security formed part of the reason for him to use Yahoo! Mail in the first place and to pay $19.95 per year for the premium email service," Koh reckons.

"Moreover, Plaintiff Mortensen alleges that he would not have signed up for the supposedly secure services or turned over his PII at all if Defendants had disclosed the security issues. "

Additionally, Koh granted a motion to dismiss claims made under the California Customer Records Act, and claims of breach of implied covenant of good faith and fair dealing.

In total, Koh opted grant six of Yahoo!'s motions to dismiss and denied another 10. The ruling will trim down the plaintiff class, but also means Yahoo!/Oath will still have to defend itself in court, or agree to pay out a settlement to make the suit go away. ®