Both plaintiffs are bringing the class-action complaints on behalf of all users affected by the breach. The news was first reported by the Mercury News.
The hack, announced on Thursday, took place in late 2014. Security experts say the security breach -- which included personal information like email addresses, dates of birth, and security questions -- may be the biggest ever.
David Casey, who is representing plaintiffs Jennifer Myers and Paul Dugas in the San Diego class-action case, said a handful of people had contacted his firm before Yahoo admitted accounts were compromised, claiming their personal information was somehow compromised.
"We have had a number of people approach us who had things accessed such as their tax accounts or credit cards, and they couldn't figure out how people were getting into those," Casey told CNNMoney. "When this was disclosed, they went 'Whoa, there's an explanation.'"
The complaint alleges Yahoo took an "unusually long period of time" uncovering the breach, and in the two years since it was hacked and disclosed, people were at risk of identity theft.
Plaintiff Ronald Schwartz, a New Yorker filing his claim in San Jose, claims the breaches put him and others at risk of identity theft. "Yahoo was so grossly negligent in securing its users' personal information that it says that it did not even discover the incident until the summer of 2016," the complaint states.
Casey said he anticipates hundreds of similar cases will be filed across the country. Eventually the federal court system will likely combine them all into one class-action case.
Suzanne Philion, a spokesperson for Yahoo, said the company does not comment on ongoing litigation. Verizon agreed to buy the Yahoo's core properties for $4.83 billion in July, and it's unclear how the security breach will impact the sale.