E-FILED 1 MARK C. MOLUMPHY (SBN 168009) 1/2/2018 4:26 PM [email protected] 2 ALEXANDRA P. SUMMER (SBN 266485) Clerk of Court [email protected] Superior Court of CA, 3 STEPHANIE D. BIEHL (SBN 306777) County of Santa Clara [email protected] 17CV307054 4 COTCHETT, PITRE & McCARTHY, LLP Reviewed By: R. Walker 840 Malcolm Road, Suite 200 Envelope:1099793 5 Burlingame, California 94010 Telephone: (650) 697-6000 6 FRANCIS A. BOTTINI, JR. (SBN 175783) 7 [email protected] ALBERT Y. CHANG (SBN 296065) 8 [email protected] YURY A. KOLESNIKOV (SBN 271173) 9 [email protected] BOTTINI & BOTTINI, INC. 10 7817 Ivanhoe Avenue, Suite 102 La Jolla, California 92037 11 Telephone: (858) 914-2001 12 Co-Lead Counsel for Plaintiffs 13 [Additional Counsel Appear On Signature Page] 14 SUPERIOR COURT OF THE STATE OF CALIFORNIA 15 COUNTY OF SANTA CLARA 16 IN RE YAHOO! INC. Lead Case No.: 17-CV-307054 17 SHAREHOLDER LITIGATION _____________________________________ (REDACTED)-VERIFIED AMENDED 18 CONSOLIDATED SHAREHOLDER CLASS ACTION AND DERIVATIVE 19 THIS DOCUMENT RELATES TO: COMPLAINT FOR BREACH OF FIDUCIARY DUTIES, INSIDER 20 ALL ACTIONS TRADING, UNJUST ENRICHMENT, AND CORPORATE WASTE 21 [CONDITIONALLY LODGED UNDER 22 SEAL, CRC, RULE 2.550(b)(3)] 23 Judge: Honorable Brian C. Walsh Department: D1 24 25 DEMAND FOR JURY TRIAL 26 27 28 Verified Amended Consolidated Shareholder Class Action and Derivative Complaint 1 TABLE OF CONTENTS 2 I. NATURE AND SUMMARY OF THE ACTION ................................................................. 5 3 II. JURISDICTION AND VENUE ........................................................................................... 14 4 III. THE PARTIES ...................................................................................................................... 15 IV. SUBSTANTIVE ALLEGATIONS ...................................................................................... 18 5 A. YAHOO COLLECTS MASSIVE PERSONAL INFORMATION FROM USERS AND PROMISES TO 6 SAFEGUARD SUCH INFORMATION ........................................................................................ 18 7 B. YAHOO ’S BOARD WAS AWARE OF THE DUTY TO NOTIFY ITS CUSTOMERS UPON BECOMING AWARE OF A DATA BREACH ................................................................................................ 20 8 C. THE COMPANY UNDERFUNDED DATA SECURITY INFRASTRUCTURE , LEAVING ITS SYSTEMS 9 VULNERABLE TO LARGE -SCALE INTRUSIONS ....................................................................... 23 10 D. THE COMPANY EXPERIENCES THE LARGEST KNOWN HACKS OF A SINGLE WEBSITE IN HISTORY — THE SIBERIA INTRUSION ................................................................................... 27 11 E. THE INFORMATION SECURITY TEAM NOTIFIED SENIOR MANAGEMENT AND THE BOARD OF 12 ALL RELEVANT DETAILS REGARDING THE SIBERIA INTRUSION ........................................... 31 13 F. THE BOARD RECEIVED REPEATED UPDATES REGARDING THE SIBERIA INTRUSION , BUT DID NOTHING TO ENSURE LEGAL COMPLIANCE OR TO NOTIFY AFFECTED USERS ...................... 32 14 G. THE BOARD AND MANAGEMENT KEEP YAHOO USERS , SHAREHOLDERS , AND THE SEC IN 15 THE DARK ABOUT SIBERIA ................................................................................................... 39 16 H. YAHOO FACES INTENSE PRESSURE TO SELL THE COMPANY ’S OPERATING BUSINESS .......... 41 17 I. THE YAHOO BOARD CONCEALS THE SIBERIA INTRUSION IN CONNECTION WITH THE VERIZON TRANSACTION ....................................................................................................... 44 18 J. VERIZON PUBLICLY RAISES CONCERNS ABOUT A POTENTIAL HACK OF YAHOO ’S SYSTEMS 19 AND THE BOARD AND MANAGEMENT STALL TO CONSIDER HOW TO PROTECT THEMSELVES ........................................................................................................................ 48 20 K. ON SEPTEMBER 22, 2016, THE BOARD ISSUES A FALSE PRESS RELEASE IN HOPES OF 21 BUYING TIME TO FIGURE OUT HOW TO CONCEAL THE TRUTH ............................................ 55 22 L. THE BOARD DEVISES A PLAN TO CONTINUE CONCEALING THE SIBERIA INTRUSION BY CONDUCTING A FLAWED INVESTIGATION ............................................................................ 56 23 M. THE BOARD ’S PREVIOUS CONSCIOUS , BAD -FAITH DECISION TO FAIL TO PROPERLY 24 RESPOND TO THE SIBERIA INTRUSION RESULTS IN EVEN MORE PROBLEMS AT YAHOO ....... 62 25 N. YAHOO ’S SECURITY IS BREACHED ONCE AGAIN IN 2015 AND 2016 VIA “F ORGED COOKIES ” AND YAHOO ONCE AGAIN DELAYS NOTIFYING ITS USERS OF THE BREACH ....... 64 26 O. THE BOARD ISSUES A FALSE ANNUAL REPORT DISCLOSING THE ERRONEOUS FINDINGS OF 27 THE SHAM INVESTIGATION ................................................................................................... 65 28 Conclusion #1: Siberia Intrusion Was Not Thoroughly Investigated and Analyzed .............. 66 -2- Verified Amended Consolidated Shareholder Class Action and Derivative Complaint Conclusion #2: Certain Senior Executives Did Not Comprehend the Siberia Intrusion ....... 67 1 Conclusion #3: The Board and AFC Did Not Fully Appreciate the Siberia Intrusion .......... 69 2 Conclusion #4: No Evidence of Suppression of Siberia Intrusion ......................................... 70 3 P. 4 .................................................................................................................... 71 5 Q. THE BOARD IN BAD FAITH REWARDS MAYER, FILO, MCINERNEY, AND GOLDMAN, DESPITE KNOWING THESE INDIVIDUALS INTENTIONALLY SUPPRESSED THE SIBERIA INTRUSION ...... 73 6 R. VERIZON USES YAHOO’S OFFICERS’ AND DIRECTORS’ BREACHES OF FIDUCIARY DUTY TO 7 GAIN AN ADVANTAGE IN THE BARGAINING NEGOTIATIONS................................................. 74 8 S. CRIMINAL INDICTMENT REVEALS ADDITIONAL DETAILS ABOUT THE 2014 DATA BREACH 80 9 V. SOME OF THE INDIVIDUAL DEFENDANTS ENGAGED IN UNLAWFUL 10 INSIDER SELLING WHILE IN POSSESSION OF MATERIAL NON-PUBLIC INFORMATION ABOUT THE DATA BREACHES ........................................................ 82 11 VI. THE BOARD APPROVES A FALSE PROXY TO EFFECTUATE THE SALE OF YAHOO’S CORE ASSETS WITHOUT DISCLOSING THE TRUTH ABOUT THE 12 BOARD’S AND MANAGEMENT’S KNOWLEDGE OF THE SIBERIA INTRUSION ........................................................................................................................... 91 13 VII. CLASS ACTION ALLEGATIONS ................................................................................. 94 14 VIII. DERIVATIVE AND DEMAND FUTILITY ALLEGATIONS .................................... 95 15 A. DEMAND IS FUTILE BECAUSE THE FULL BOARD KNOWINGLY FAILED TO NOTIFY YAHOO USERS OF THE SIBERIA INTRUSION AND OF THE FORGED COOKIE DATA BREACHES ............ 95 16 B. DEMAND IS EXCUSED BECAUSE THE ENTIRE BOARD FAILED TO PROMPTLY NOTIFY USERS 17 OF THE FORGED COOKIE DATA BREACH .............................................................................. 99 18 C. THE BOARD IS INCAPABLE OF ASSESSING DEMAND AGAINST DEFENDANTS MAYER, BELL, GOLDMAN, AND FILO FOR INSIDER TRADING ..................................................................... 100 19 D. DEMAND IS FUTILE AGAINST THE BOARD FOR APPROVING THE SPA WITH ACTUAL OR 20 CONSTRUCTIVE KNOWLEDGE THAT THE REPRESENTATIONS AND WARRANTIES THEREIN WERE FALSE WHEN MADE ................................................................................................ 101 21 E. DEMAND IS FUTILE AS TO THE ENTIRE BOARD FOR CONDUCTING A SHAM INVESTIGATION 22 AND CONCEALING THE TRUTH FROM THE PUBLIC. ............................................................. 103 23 F. DEMAND IS FUTILE AS TO THE BOARD FOR CONSCIOUSLY ALLOWING DEFENDANT MCINERNEY TO NEGOTIATE A PERSONAL RELEASE FOR HIMSELF AND OTHER DIRECTORS 24 AND OFFICERS .................................................................................................................... 106 25 G. DEMAND IS FUTILE AS TO THE BOARD FOR APPROVING CHANGE OF CONTROL PAYMENTS WHILE KNOWINGLY CONCEALING THE GOLDEN-PARACHUTE RECIPIENTS’ KNOWLEDGE OF 26 THE SIBERIA INTRUSION. .................................................................................................... 107 27 H. DEMAND IS FUTILE AS TO THE ENTIRE BOARD BECAUSE ALL DIRECTORS REVIEWED AND APPROVED MULTIPLE FALSE AND MISLEADING STATEMENTS THAT CONTINUED TO 28 CONCEAL THE TRUE FACTS REGARDING THE SIBERIA INTRUSION ..................................... 107 -3- Verified Amended Consolidated Shareholder Class Action and Derivative Complaint I. DEMAND IS FUTILE AS TO MAYER AND FILO BECAUSE THEY ARE INTERESTED ................. 108 1 J. DEMAND IS FUTILE AS TO MCINERNEY BECAUSE HE IS INTERESTED AND BREACHED HIS 2 DUTY OF CANDOR AND LOYALTY ...................................................................................... 110 3 K. DEMAND IS FUTILE AS TO BRAHAM , HARTENSTEIN , AND HILL BECAUSE THEY ARE NOT INDEPENDENT AND ACTED IN BAD FAITH .......................................................................... 111 4 L. DEMAND IS FUTILE AS TO THE ENTIRE BOARD WITH RESPECT TO THE AIDING AND 5 ABETTING CLAIM AGAINST VERIZON ................................................................................ 111 6 IX. CAUSES OF ACTION ........................................................................................................ 112 FIRST CAUSE OF ACTION 7 DERIVATIVE CLAIM FOR BREACH OF FIDUCIARY DUTY .................................. 112 8 SECOND CAUSE OF ACTION DERIVATIVE CLAIM FOR CORPORATE WASTE .................................................... 113 9 THIRD CAUSE OF ACTION 10 DIRECT CLASS CLAIM FOR BREACH OF FIDUCIARY