The only “surprise” in the Yahoo class action complaint, filed Friday, September 23, 2016, is that Yahoo issued a press release announcing the breach a mere one day earlier. The class action complaint, undersigned by three law firms in San Francisco, Boca Raton, and New York, seeks certification for: “All persons within the United States whose personal information was accessed following the data breach that Yahoo announced in a press release on September 22, 2016.” Indeed, the complaint makes a number of allegations relating directly to the September 22 press release, including what appears to be a copy-and-paste of the entire release’s language. The stated causes of action are cookie-cutter with the word “Yahoo” pasted among otherwise generic allegations about the breach and alleged damages.
Retention of counsel to work with a company’s public relations staff and outside consultants is critically important, as the plaintiff’s counsel are waiting in the wings to capitalize on the increasing number of cyberattacks in the 21st Century. Breach counsel can help ensure that a press release, while being factually accurate, does not hand plaintiffs’ counsel key facts adding up to a concrete injury or identifiable harm sufficient to survive a motion to dismiss based on lack of standing. Any communications to the public about a data breach will be Exhibit A against the company. Experienced data breach lawyers know the language that will be seized upon. While there is no guarantee that a good press release will stave off litigation, it is important to avoid the initial communications about the breach being a basis for standing.