John A. Yanchunis

A breach happens once. Its consequences happen millions of times, one person at a time, and can keep happening for years. John A. Yanchunis has built the law of data-breach recovery around that asymmetry, joining incident forensics, standing doctrine, class procedure, cybersecurity reform, and settlement administration on a scale large enough to serve a national population without losing sight of the sensitive information stripped from its owners’ control. When the largest intrusions in history have reached a courtroom, the courts have repeatedly reached for him. Little in his beginnings predicted the digital docket. Yanchunis graduated from the University of Florida in 1976, tapped for Florida Blue Key, the university’s leadership society, and earned his law degree magna cum laude from South Texas College of Law in 1980, where he helped edit the law journal. A two-year clerkship with United States District Judge Carl O. Bue, Jr. in Houston gave him a federal trial judge’s view of complex litigation, and his early practice immersed him in insurance coverage, years spent learning from the inside how insurers assess risk, value claims, and defend themselves. When he crossed permanently to the plaintiffs’ side he brought that fluency with him, and for decades now, at Morgan & Morgan in Tampa, he has led the firm’s national class-action practice, with consumer protection as its spine and data privacy as its edge.

Yahoo, and the price of persistence

The case that fixed his place in privacy law was Yahoo: intrusions spanning years that ultimately compromised billions of accounts, the largest data breach ever litigated. Appointed lead counsel over a crowded field, Yanchunis steered the case through years of motion practice, and when the court rejected an initial settlement as inadequate, he went back and negotiated a better one, a revised $117.5 million fund, approved in 2020, that joined compensation and credit monitoring with commitments directed at the company’s security practices. The episode became a template for the field: proof that a breach settlement must survive genuine judicial scrutiny of its benefits, and that class counsel’s job is not finished until it does.

The modern breach canon

The rest of the canon carries his name. He held leadership in the Equifax litigation, where the consumer fund began at $380.5 million in 2020 as part of a broader regulatory resolution covering nearly half the American population. He was co-lead counsel in the Capital One breach litigation, which produced a $190 million fund. In the Office of Personnel Management case he helped secure $63 million in 2022 for federal employees and applicants whose background-investigation files, among the most detailed information the government collects about anyone, had been exposed. In 2025 came a $45 million settlement with MGM Resorts. Each matter demanded exactness: what information left, which future risks followed, how causation could be shown across a class, and what mix of cash, reimbursement, monitoring, restoration services, and security obligations could answer an injury whose full cost might not surface for years. The negotiations run on two clocks at once, the immediate one, on which victims need identity restoration and reimbursement now, and the long one, on which a stolen Social Security number or background file remains dangerous for a lifetime, and his settlement structures are built to serve both. His mass-disaster range extends beyond data: in 2021 he helped resolve the Merrimack Valley gas-explosion litigation for $143 million, compensation for whole neighborhoods driven from their homes by an over-pressurized pipeline.

The interface on trial

What distinguishes Yanchunis’s recent work is its movement beyond breach response into the design of data collection itself. On September 3, 2025, a San Francisco federal jury returned a $425.65 million verdict in Rodriguez v. Google, a class trial on behalf of some ninety-eight million users over the collection of app-activity data from people who had switched off a privacy control. The interface itself went before the jury: what users were told, which setting they changed, what data kept moving, and how the company used it. Trying a privacy case to verdict, rather than settling in the shadow of uncertainty, required exactly the courtroom confidence that four decades of trial work had built, and the result stands among the largest privacy verdicts ever returned. “We hope this result sends a message to the tech industry,” Yanchunis said afterward, “that Americans will not sit idly by as their information is collected and monetized against their will.” It marked a turn in the field he had helped create: from compensating the aftermath of intrusion to holding the architecture of surveillance to the promises printed on its own screens.

His standing in the profession rests on more than his docket. A two-term member of the Florida Bar’s Board of Governors, he chaired the Bar’s consumer protection committee, served on the Florida Board of Bar Examiners from 1997 to 2002 by appointment of the state supreme court, with emeritus reappointments every year since, and advises the Bar as an ethics expert on class-action questions. The résumé also carries an older credential he mentions with equal pride: Eagle Scout, later president of the Boy Scouts’ West Central Florida Council, the long-scale civic instinct of a man who treats stewardship as a permanent assignment.

Rules for the unruled

Where legislation has lagged, his settlements have functioned as private regulation, funding security overhauls, mandating assessments, forcing companies to treat the personal information of strangers as something held in trust rather than harvested at will. Where doctrine was unformed, his cases shaped it, from the standing battles of the early breach era to the jury instructions of the Google trial. Three decades into this work, with the class-action department he leads fielding cases from every corner of the digital economy, he keeps performing the same essential conversion: turning the diffuse, delayed, easily dismissed injuries of the information age into claims a court can see, value, and remedy. A breach happens once; Yanchunis has made sure that, in the law’s eyes, it happens to everyone it touched, and that each of them counts.