U.S. District Judge Lucy Koh.

A federal judge has asked both Yahoo Inc. and plaintiffs pursuing claims against the company over its massive data breach to weigh in on what the company’s disclosure of additional affected customers means to the case.

Yahoo parent company Verizon announced Tuesday that roughly 3 billion users who had a Yahoo account in August 2013 were likely affected by the hack. The disclosure tripled the number previously disclosed by Yahoo.

U.S. District Judge Lucy Koh of the Northern District of California, who is overseeing multidistrict litigation on the breach, issued an order Thursday pushing back the date that the parties are set to file a joint case management statement and ordered Yahoo to expedite producing discovery regarding the recent disclosure. “Yahoo’s recent disclosure may impact the causes of action alleged in this case, which may delay the case schedule,” she wrote in the brief two-page order.

In August, Koh allowed portions of the plaintiffs’ case to survive a motion to dismiss. “All plaintiffs have alleged a risk of future identity theft, in addition to loss of value of their personal identification information,” wrote Koh at the time.

Reached by phone Thursday, John Yanchunis of Morgan & Morgan, lead counsel for the plaintiffs, said “the biggest class action in history just became bigger.”

“We don’t have many more people on the face of the Earth.”

Yanchunis said that besides expanding the size of the affected class, the latest disclosure raises questions about Yahoo’s handling of the breach. Yanchunis said that with the pace of the litigation, he would have expected the company to discover all of its 2013 account holders were affected sooner.

“It certainly raises the question to me of ‘What kind of forensic analysis did they do in 2014 when they discovered the exfiltration?’” he said.

Yahoo’s lead lawyer in the case, Ann Marie Mortimer of Hunton & Williams, didn’t immediately respond to an email message Thursday afternoon.

 

Ross Todd can be contacted at rtodd@alm.com.