Yahoo customers affected by three massive data breaches that resulted in the theft of more than three billion users' data are allowed to sue the company, a judge has ruled.

California judge Lucy Koh rejected a bid by Verizon, which bought the internet giant last year, to dismiss a large portion of the claims, including breach of contract, deceit and concealment, and negligence.

At the heart of the case, Yahoo was accused of taking too long to notify users of the breaches, which put customers at risk of identity theft and fraud. The filing, dated Friday, cited several customers whose data was stolen by criminals and used for filing fraudulent tax returns or credit card charges. Other customers had to pay out to credit bureaus to freeze their accounts.

Koh said that customers may have "taken measures to protect themselves" had they known about the breaches sooner.

The case began in 2016 after the company admitted it was hacked in 2014, in which 500 million user accounts were stolen.

Later in the year, the company revealed that it was hacked again -- a year earlier in 2013 -- in which one billion accounts were stolen. Yahoo later said that all its three billion users were affected by that breach.

A separate attack on the company's systems allowed hackers to steal portions of the company's source code. Attackers used that code to generate cookies, allowing access to accounts without requiring a user's password.

Verizon did not immediately respond to a request for comment.

Source: ZD Net