Two Russian intelligence officials and two hackers have been charged in the U.S.in connection with one of the breaches.
Verizon, Yahoo's new parent company, had asked USA federal courts to dismiss all the victims' claims of negligence and breach of contract, but a judge rejected that request late last week, allowing the bulk of the lawsuit to move forward.
Verizon Communications Inc. bought Yahoo's online businesses, which includes its email service, sports and finance new sites for US$4.5 billion in 2017 to combine it with its AOL Inc. operation.
Plaintiffs accused Yahoo of taking too long to disclose three data breaches that occurred from 2013 and 2016. The breaches were not made public until after Verizon announced its plans to purchase the company for almost $4.5 billion. However, some other claims were dismissed.
Yahoo customers contend that as a result of the lax security, their data has been used to steal money from bank accounts, create credit problems and resulted in fraudulent tax filings.
Customers make a plausible argument that high-ranking executives and managers at Yahoo engaged in "malicious conduct, " the standard for seeking punitive damages on top of ordinary compensation, U.S. District Judge Lucy Koh said in a ruling in San Jose.
Additionally, Koh granted a motion to dismiss claims made under the California Customer Records Act, and claims of breach of implied covenant of good faith and fair dealing. An amended complaint from plaintiffs came after Yahoo raised its estimates over the extent of compromised accounts. She had previously denied Yahoo's bid to dismiss some unfair competition claims.
"Plaintiffs' allegations are sufficient to show that they would have behaved differently had defendants disclosed the security weaknesses of the Yahoo Mail System", Koh said.
"Even if his annual fee did not provide for security measures above and beyond those for free accounts, Plaintiff Mortensen pleads that Defendants' representations about security formed part of the reason for him to use Yahoo!".