Yahoo Inc. (YHOO.O) can’t escape claims that it should pay punitive damages over data breaches that left information on 3 billion customers in hackers’ hands.

Customers make a plausible argument that “high-ranking executives and managers at Yahoo’’ engaged in “malicious conduct,’’ the standard for seeking punishment damages on top of ordinary compensation for consumer harm, U.S. District Judge Lucy Koh in San Jose, California, said in a ruling.

Yahoo reached an US$80 million settlement this month with investors over claims that executives concealed the data breaches to artificially inflate the price of the internet firm’s shares. Under the accord, investors are slated to get 12 cents for each share of Yahoo stock they owned.

Verizon Communications Inc. bought Yahoo’s online businesses, which includes its email service, sports and finance new sites for US$4.5 billion in 2017 to combine it with its AOL Inc. operation. Verizon acquired AOL in 2015. The combined companies operate under the name Oath.

The remainder of Yahoo, which include stock in China’s Alibaba Group Holding Inc. and Yahoo Japan worth more than US$40 billion, went into New York-based Altaba Inc. Verizon and Altaba agreed to evenly split all costs tied to lawsuit liability over the data breaches as part of the Yahoo acquisition deal.

“The claims are baseless, and can’t comment beyond that because of pending litigation,” said Bob Varettoni, a Verizon spokesman.

The customers’ case is In re: Yahoo Inc. Customer Data Security Breach Litigation, No. 16-md-02752, U.S. District Court for the Northern District of California (San Jose). The investors’ case is In Re Yahoo! Inc. Securities Litigation, No. 17-373, U.S. District Court for the Northern District of California (San Jose).