$117.5 Million Yahoo Data Breach Settlement, the Largest Common Fund Ever Recovered in a Data Breach Case
Won by Morgan & Morgan (lead counsel) and CaseyGerry.
As court-appointed lead plaintiffs' counsel, Morgan & Morgan's John Yanchunis negotiated the $117.5 million settlement resolving claims from Yahoo's 2013-2016 data breaches, the largest theft of personal data in history, touching roughly 3 billion accounts worldwide. Judge Lucy Koh approved the fund in 2020 after rejecting an earlier version as inadequate.
What happened
Between 2013 and 2016, hackers working in successive waves stole data associated with essentially every Yahoo account in existence, names, email addresses, phone numbers, birth dates, hashed passwords, and the security questions and answers that guard password resets. Roughly 3 billion accounts were compromised in what remains the largest data breach ever disclosed, and Yahoo compounded the damage by sitting on the news for years, revealing the intrusions only in 2016 as Verizon was negotiating to buy the company.
The consolidated class action that followed in the Northern District of California became the proving ground for a question courts had dodged for a decade: what is stolen personal data actually worth? Judge Lucy Koh appointed John Yanchunis, head of Morgan & Morgan's complex litigation group in Tampa, to lead the plaintiffs' side, a role that put a personal injury firm best known for Florida jury trials at the center of the biggest privacy case in the country.
The litigation was neither quick nor smooth. Yahoo and its successor entities fought dismissal, fought certification, and then offered a settlement that Judge Koh threw out in January 2019 as inadequately funded and insufficiently transparent, a rare rejection that forced the parties back to the table. The revised deal Yanchunis's team negotiated put $117.5 million into a non-reversionary common fund: at least $55 million earmarked for victims' out-of-pocket losses, $24 million for two years of credit monitoring, and the remainder covering notice, administration, and court-approved fees.
Judge Koh granted final approval in 2020, finding the reworked settlement fair to a class of as many as 194 million people in the United States and Israel holding roughly 896 million accounts. In court filings, Yanchunis called it the biggest common fund ever obtained in a data breach case, a claim no one seriously disputed, since nothing close to it existed.
The Yahoo settlement did more than move money. It established the template, real cash funds, credit monitoring with teeth, judicial scrutiny of claims-made gimmicks, that Yanchunis and other privacy lawyers would carry into Equifax, Capital One, and T-Mobile. For Morgan & Morgan, it marked the firm's arrival as a national force in data privacy litigation, far from the courtroom lanes it was built in.
Sources
This account is drawn from contemporaneous public reporting and the court record.
More proven verdicts from Morgan & Morgan
All Morgan & Morgan proven verdicts →A jury found the owners of the Park Social bar liable for a 2017 staircase fall that left a 57-year-old patron a partial quadriplegic, returning a $644,751,855 premises-liability verdict that the defendants have appealed to Florida's Sixth District Court of Appeal.
A federal jury in San Francisco found Google liable for invasion of privacy and intrusion upon seclusion after the company kept collecting data from third-party apps for users who had switched off the Web & App Activity setting. On September 3, 2025, the jury awarded $425,651,947 in compensatory damages and declined to award punitive damages. The award is a single class-wide figure shared by two nationwide classes of about 98 million users, not one person's recovery. The judge refused to set the verdict aside in August 2026, and Google has appealed to the Ninth Circuit.
Hours before opening arguments in the first federal opioid bellwether trial, Cuyahoga and Summit counties in Ohio secured a $260 million settlement from distributors AmerisourceBergen, Cardinal Health, and McKesson, plus manufacturer Teva.
Morgan & Morgan's John Yanchunis served as court-appointed co-lead counsel in the multidistrict litigation over Capital One's 2019 data breach, which exposed the personal information of roughly 98 million U.S. customers. The $190 million settlement won final approval in 2022 as one of the largest data breach recoveries in U.S. history.
Related class action verdicts
John Eddie Williams, Jr. served as one of five private attorneys retained by the State of Texas to sue the major tobacco companies, producing a $15.3 billion settlement in January 1998, the largest single-case settlement in U.S. history at the time.
As court-appointed co-lead plaintiffs' counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik negotiated a settlement requiring 3M Company to pay up to $12.5 billion to public water systems contaminated by PFAS compounds in firefighting foam, the largest drinking-water settlement in American legal history.
As court-appointed co-lead counsel in AFFF MDL 2873, Paul J. Napoli of Napoli Shkolnik helped negotiate a $1.185 billion class settlement with DuPont, Chemours, and Corteva to compensate public water systems across the United States for PFAS contamination tied to firefighting foam.