Public companies experiencing data security incidents have been largely successful in defeating derivative actions and securities class actions related to those cyber incidents. Nevertheless, some recent events may encourage shareholder attorneys to pursue securities fraud class actions after disclosure of a cyber incident, if that disclosure leads to a drop in the stock price. This article addresses two of those events: this week’s announcement of the settlement in the Yahoo!, Inc. securities fraud class action, and the SEC’s recent guidance on public company disclosures of cyber risk.
The $80 Million Yahoo Securities Class Settle Action Settlement
On March 5, Yahoo, Inc. (“Yahoo”) announced a proposed settlement, in In re Yahoo Inc. Securities Litigation, which was filed in U.S. District Court in San Francisco. The $80 million proposed settlement relates to a securities class litigation stemming from Yahoo’s 2013 and 2014 data breaches. While many elements of the Yahoo securities class action may be factually unique, the settlement is a milestone because it is the first significant securities fraud settlement from a cybersecurity breach.
In January 2017,…
