Yahoo must face litigation by data breach victims