Yahoo Inc. will face punitive damages over data breaches that affected more than 3 billion email user accounts after a federal judge refused to dismiss most of the claims.

In a Friday order, U.S. District Judge Lucy Koh of the Northern District of California found that plaintiffs had sufficiently pleaded allegations that Yahoo should face punitive damages for its negligence. In particular, the judge cited, Yahoo's former chief information security officers knew there were problems with Yahoo's data security. She specifically referenced internal documents between one of the former chief information security officers and Yahoo's general counsel that contradicted the company's public statements.

“These circumstances make plausible plaintiffs' claim that high-ranking executives and managers at Yahoo, including its CISO, committed oppressive, fraudulent, or malicious conduct,” Koh wrote.

Lead plaintiffs attorney John Yanchunis of Morgan & Morgan in Tampa, Florida, called the decision a “significant win.”

“The order is extremely well written, a tremendous amount of analysis,” he said. “The claims that allow us to get punitive damages are pretty significant. We tether those to negligence claims, and she found if we could provide conduct of reckless nature, we could get punitives from a jury. And that's substantial here.”

Last month, Yahoo, represented by Hunton & Williams, brought in Gibson, Dunn & Crutcher as additional counsel in the case. Ann Marie Mortimer of Hunton & Williams and Theodore Boutrous of Gibson Dunn did not respond to requests for comment.

The case involves three breaches that occurred between 2013 and 2016.

In 2016, Yahoo disclosed that 500 million accounts had been hacked in 2014, compromising names, email addresses, phone numbers, birth dates and passwords.

Months later, Yahoo disclosed another breach from 2013 that affected 1 billion accounts. On Oct. 3, Yahoo parent company Verizon upped that figure to about 3 billion accounts.

In 2017, Yahoo notified users about a third breach that had occurred in 2015 and 2016.

In August, Koh largely refused to dismiss the consolidated complaint.

Friday's order pertained to 11 of the 13 claims in an amended complaint filed on Dec. 19. Those included claims that Koh had previously allowed plaintiffs to amend, plus punitive damages that were added to the case.

Koh didn't uphold all the claims. She dismissed claims that Yahoo violated California's breach notification law by failing to timely disclose the full scope of the 2013 breach, calling those allegations “too uncertain to divine any date of discovery, whether specific or estimated.”

“We're in discovery, and we may be able to come back to her and convince her that that claim should survive,” Yanchunis said.