AIUI, the damages are not punitive. They are meant to cover the actual harms associated with Yahoo's negligence. Unless you've actually had your identity stolen

AIUI, the damages are not punitive. They are meant to cover the actual harms associated with Yahoo's negligence. Unless you've actually had your identity stolen due to the breach, your losses are capped at whatever action you had to take to counteract risks added by the breach. That is, the cost of acquiring credit monitoring services.