Yahoo Inc. will face punitive damages over data breaches that affected more than 3 billion email user accounts after a federal judge refused to dismiss most of the claims.

In a Friday order, U.S. District Judge Lucy Koh of the Northern District of California found that plaintiffs had sufficiently pleaded allegations that Yahoo should face punitive damages for its negligence. In particular, the judge cited, Yahoo’s former chief information security officers knew there were problems with Yahoo’s data security. She specifically referenced internal documents between one of the former chief information security officers and Yahoo’s general counsel that contradicted the company’s public statements.