Could the exposed users sue Yelp? It doesn't seem like Yelp fulfilled their duty to protect them if they failed to respond to the subpoena.
Their privacy policy is very easy on the courts.
In fairness to Yelp, their privacy policy can hardly say "we won't give your data up in response to a subpoena", because if the subpoena was legitimate they'd be in contempt. Yelp can certainly challenge the validity of a subpoena, but that's not something they would be putting in a privacy policy.
IANAL, don't use Yelp, have never read their agreements, and don't know if this situation could even be construed to be a criminal investigation.
Isn't this a civil investigation?