In Re: LoanCare Data Security Breach Litigation

• Court: District Court, M.D. Florida
• Decided: March 24, 2025
• Docket: 3:23-cv-01508
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF FLORIDA JACKSONVILLE DIVISION

IN RE: LOANCARE DATA 3:23-cv-01508-CRK-MCR SECURITY BREACH LITIGATION

PRELIMINARY APPROVAL ORDER Kelly, Judge: This matter is before the Court on Plaintiffs’ Second Amended Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law (“Second Am. MPA”), Approval of Class Notice, Scheduling of Final Approval, and Incorporated Memorandum of Law, filed on March 6, 2025. Second Am. MPA, March 6, 2025, ECF No. 126. In the Second Am. MPA, Plaintiffs indicate the parties have reached a proposed class wide settlement of the claims raised in this putative class action (“Settlement Agreement” or “SA” and “Superseding Amendment to the Settlement Agreement” or “Super. Am.”). Plaintiffs’ Notice of Filing of Executed Settlement Agreement, Mar. 19, 2025, ECF No. 131 (“Settlement Agreement” or “SA”); Superseding Amendment to the Settlement Agreement, Mar. 6, 2025, ECF No. 126-2 (“Superseding Amendment to the Settlement Agreement” or “Super. Am.”). Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiffs request that the Court: (1) conditionally certify the class action for settlement purposes only, (2) preliminarily approve the proposed settlement, (3) appoint Plaintiffs as Class Representatives and Plaintiffs’ counsel as Class Counsel for settlement purposes, (4) establish a schedule to complete the tasks necessary to effectuate the proposed

settlement, and (5) provide that, if the settlement is not finally approved or terminates for any other reason, the parties shall retain, without prejudice, all objections, arguments, and defenses with respect to class certification. See SA at ¶¶ 74, 80. Plaintiffs represent that Defendants agree to the requested relief for settlement purposes. Second Am. MPA at 2. I. PROCEDURAL HISTORY

Plaintiffs, Kevin Curry, Gregory Arrowsmith, Namuun Bat, Joshua Dryden, Richard Freire, Andrew Gharibian, Christopher Human, Cody Kettlewood, April Manar, Eisin Jahwer Martinez, Douglas Newell, Jose Peralta, and Ryan Turizo, individually and on behalf of all others similarly situated (the “Class” or “Class Members”), bring this action in a Consolidated Class Action Complaint, see Amended Consolidated Class Action Complaint, Mar. 19, 2024, ECF No. 40 (“Am. Compl.”), against Defendants Fidelity National Financial, Inc. (“Fidelity National Financial” or

“FNF”) and LoanCare, LLC (“LoanCare”) (collectively, “Defendants”).1 On behalf of themselves and the Class, Plaintiffs allege the following claims against Defendants:

1 The initial complaint filed on December 27, 2023, Class Action Compl., Dec. 27, 2023, ECF No. 1, was stricken on January 4, 2024. See Order, Jan. 4, 2024, ECF No. 7. A corrected complaint was filed on January 17, 2024. Corrected Compl., Jan. 17, 2024, ECF No. 18. Following a motion to consolidate, Pl. Joint Mot. to Consol. Actions, Appoint Interim Class Counsel, and Set Scheduling Deadlines, Feb. 9, 2024, ECF No. 24, Plaintiffs filed this Amended Consolidated Class Action. See Am. Compl. Negligence (Counts I and II); Negligence per se (Counts III and IV); Breach of Implied Contract and Breach of the Covenant of Good Faith and Fair Dealing (Count V); Unjust Enrichment (Count VI); and Breach of Fiduciary Duty (Count VII). Am.

Compl. at ¶¶ 212—334. Prior to significant discovery taking place and pursuant to this Court’s mandatory mediation requirements, the Parties met with Rodney A. Max, an experienced class action mediator, to mediate this dispute on July 25, 2024. See Am. Uniform Case Management Report, Apr. 23, 2024, ECF No. 65. That same day, the Parties reached an agreement on the terms of a class wide settlement and filed a

Notice of Class-wide Settlement on July 29, 2024. Notice of Settlement, Jul. 29, 2024, ECF No. 98. On September 27, 2024, Plaintiffs filed an Unopposed Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law (“MPA”), seeking preliminary approval of the settlement as well as approval of the proposed class notice. See generally MPA, Sept. 27, 2024, ECF No. 113. Upon review of the MPA and its supporting documents, the Court set a telephonic hearing for January 6, 2025

(“Hearing”), see Order, Dec. 11, 2024, ECF No. 116. At that Hearing, the Court discussed with all the parties its concerns regarding the MPA and its supporting documents. Following the Hearing the Court denied, without prejudice, the MPA providing the parties until Feb. 6, 2025, to renew their motion and until February 13, 2025, to file a Motion for Attorneys’ Fees. Order, Jan. 6, 2025, ECF No. 117 (“Fee Order”). On January 17, 2025, Plaintiffs Filed an Amended Unopposed Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law, Jan. 17, 2025, ECF No. 118 (“Amended MPA”); along with a Settlement Agreement Amendment, Jan. 17, 2025, ECF No. 118-2. Thereafter the parties moved jointly for

a hearing on the Amended MPA “to the extent that the Court has additional questions” on the Amended MPA. Joint Mot., Jan. 29, 2025, ECF No. 119. On February 6, 2025, the Court denied the motion for a hearing and directed specific questions to the parties in writing, giving the parties until February 20, 2025, to address the Court’s concerns. Order, Feb. 6, 2025, ECF No. 120. The parties filed their Motion for Attorneys’ Fees on Feb. 13, 2025. Motion for Attorneys’ Fees, Feb.

13, 2025, ECF No. 121. After one request for a brief extension to file amended documents, the parties filed their Second Am. MPA along with its Super Am. See generally Second Am. MPA; SA; Super Am. II. TERMS OF SETTLEMENT AGREEMENT Pursuant to the Settlement Agreement and Super Am. the parties agree, for settlement purposes only, to the certification of a settlement class. “Settlement Class” is defined as follows:

66. “Settlement Class” means all persons residing in the United States who received written notice from Defendants that their Personal Information may have been compromised in the Cybersecurity Incident. Excluded from the Settlement Class are (a) all persons who are employees, directors, officers, and agents of LoanCare and FNF; (b) governmental entities; and (c) the Judge assigned to the Action, that Judge’s immediate family, and Court staff.

Super Am. at ¶ 66; Second Am. MPA at 7. Defendants will pay $5,900,000.00 into a Settlement Fund which will be distributed to Settlement Class Members who submit Valid Claims, after deducting any Court-awarded Attorneys’ Fees and Costs, and all Settlement Administration

Costs. SA at ¶¶ 69, 71—72, 75—78. All Settlement Class Members who do not opt- out may submit Claims to receive (a) cash for ordinary losses up to $1,500 and/or for extraordinary losses up to $5,000 (with supporting documentation) or (b) cash payment of $100. Id. at ¶¶ 67, 76—77.2 In addition to the Cash Payments, Settlement Class Members may submit claims for Identity Monitoring services. Id. at ¶ 78. Upon the effective date of the Settlement,3 the Settlement Class Members

who do not opt out prior to the end of the opt out period will release all claims arising out of the Cybersecurity Incident against Defendants. Id. at ¶¶ 62—63, 111—113. Three Hundred and Fifty Thousand Dollars ($350,000.00) will be set aside to fund the Settlement Administration Costs. Id. at ¶ 72. The parties agree that Class Counsel would apply to the Court for an award of attorneys’ fees of up to 33.33% of the Settlement Fund, approximately $1,966,470.66 (33.33% of the $5,900,000 Settlement Fund) plus reimbursement of reasonable costs. Id. at ¶ 108. Settlement

2 Settlement Class Members’ Cash Payments may be pro rata adjusted up or down based on the total dollar amount of the Valid Claims. SA at ¶¶ 75, 110. 3 “Effective Date” means the day after the entry of the Final Approval Order, provided no objections are made to the Settlement. SA at ¶ 35. If there are objections to the Settlement, then the Effective Date shall be the later of: (i) the expiration of the time to appeal the Final Approval with no appeal having been filed; or (ii) if such appeal is filed, the termination of such appeal, on terms that affirm the Final Approval or dismiss the appeal with no material modification to the Final Approval. Id. As used in this paragraph, the phrase “termination of such appeal,” means the date upon which the relevant appellate court issues its remittitur.” Id. Class Members who opt-out of the Settlement prior to the expiration of the opt-out period do not release their claims and will not obtain any benefits, including any Settlement Class Member Benefit, under the Settlement Agreement. Id. at ¶ 113.

III. MOTION TO CERTIFY CLASS In Plaintiffs’ Second Am. MPA, the parties jointly request that the Court provisionally certify the Settlement Class for settlement purposes. See Second Am. MPA at 2, 17—35. For the Court to certify a class it must confirm that (i) a named class member has standing; (2) the class is adequately defined and clearly ascertainable; and (3) the requirements of Rule 23 are met. Sellers v. Rushmore Loan

Mgmt. Servs., LLC, 941 F.3d 1031, 1039 (11th Cir. 2019).4 A. Standing Class representatives must allege that they: “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To satisfy the injury in fact requirement, each plaintiff must allege a concrete harm. Id. at 339—40. The harm must be an actual injury that has

a close relationship to a traditional harm based in common law and be more than conclusory. Id. at 340—42. Although a risk of future harm alone may suffice for

4 Although the burden of proof used at the class certification for settlement stage is unclear, the Eleventh Circuit has used the pleading standard in such cases. See Williams v. Reckitt Benckiser LLC, 65 F.4th 1243, 1254 (11th Cir. 2023) (explaining that the burden of proof at the class certification stage is unclear, but “assum[ing] without deciding that the applicable standard is a pleading standard) (internal citations omitted); see also Smith v. Miorelli, 93 F.4th 1206, 1212 n.7 (11th Cir. 2024). injunctive relief, a plaintiff must allege an actual concrete harm to recover monetary damages. See TransUnion LLC v. Ramirez, 594 U.S. 413, 435—36 (2021).5 A risk of a future harm is an actual concrete harm when the risk is “certainly impending” or

“substantial[.]” Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1339 (11th Cir. 2021) (citing Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014)). In data breach cases, whether a risk is “certainly impending” or “substantial” depends upon whether the information taken is immutable personal identifiers and there is actual misuse of at least one class member’s information. See Tsao, 986 F.3d at 1342—43. In Tsao, the Eleventh Circuit held that a plaintiff did not have Article

III standing because he did not have a substantial risk of future identity theft when only his credit card information, and no personally identifiable information like a social security number, was stolen. Id. at 1343—45; see also In re 21st Century Oncology Customer Data Sec. Breach Litig., 380 F. Supp. 3d 1243, 1254—55 (M.D. Fla. 2019) (considering (1) the motive of the party who accessed the plaintiff’s information, (2) the type of information seized, and (3) whether the unauthorized party misused the plaintiff’s information).6 Likewise, in Equifax, the Eleventh

Circuit found that plaintiffs sufficiently alleged they suffered identify theft based on evidence of actual misuse of some plaintiffs’ data, including social security numbers, in the form of unauthorized charges, accounts made in their names, and drops in

5 TransUnion reaffirmed that plaintiffs must sufficiently allege standing for each type of relief sought. TransUnion, 594 U.S. at 435—36 (citing Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185 (2000)). credit scores. In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1262 (11th Cir. 2021). Although each class member must have Article III standing to recover monetary damages, TransUnion, 594 U.S. at 431, where the risk of future

harm, as discussed in Tsao and Equifax, is “certainly impending” or “substantial[,]” each class member has suffered such harm. Thus, class members may satisfy standing even though they have not suffered actual misuse of their personally identifiable information, if they establish “certainly impending” or “substantial” harm from the data breach, i.e., evidence that some plaintiffs have suffered identity theft due to the breach of immutable personally identifiable information. See Tsao

986 F.3d at 1342—43; In re Equifax, 999 F.3d at 1263. Relatedly, class members’ mitigation efforts in response to misuse of other class members’ immutable information establishes a concrete injury. See In re Equifax, 999 F.3d at 1263 (citing Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931 (11th Cir. 2020) (en banc)). Where there is a substantial risk of identity theft because at least one class member has had his information not only taken but also misused, it is reasonable for other class members whose information was taken in the

same data breach, to take mitigation efforts. Id. at 1263. Therefore, the mitigation efforts of plaintiffs whose information was not misused, coupled with a substantial risk of identity theft stemming from the actual misuse of at least one plaintiff’s information, constitutes concrete harm. See e.g., Gilbert v. Bioplus Specialty Pharmacy Servs., LLC, No. 6:21-CV-2158-RBD-DCI, 2024 WL 1464083, at *8—*9 (M.D. Fla. 2024).7 Plaintiff Christopher Human (“Plaintiff Human”) is one of two Plaintiffs who

allege identify fraud. Am. Compl. at ¶ 57.8 Plaintiff Human’s alleged harm includes allegations of misuse of personal information accessed during the data breach— specifically, his Social Security number. Id. at ¶ 57. As in Equifax, Plaintiff Human alleges that after the data breach someone opened bank accounts in his name at multiple banks by using his Social Security number, $10,000 was stolen from one of his bank accounts, and, in March 2024, an unauthorized individual attempted to

access the only bank account that he did not freeze after this fraudulent activity. Id. at ¶ 57; Compare Tsao, 986 F.3d at 1343—44 (finding plaintiff lacked standing where breach did not involve social security numbers, birth dates, or driver's license numbers); see Green-Cooper, 73 F.4th 883, 889—90 (11th Cir. 2023) (finding that

7 In Gilbert, the court found that the standing threshold was satisfied in an unopposed motion for preliminary approval of a class action settlement. Gilbert, 2024 WL 1464083, at *8—*9. 8 Plaintiff Jose Peralta alleges he experienced identity fraud through unauthorized charges on his credit card and a second Uber account created under his name with financial information that he did not create. Am. Compl. at ¶ 94. Other plaintiffs allege misuse of their information: Plaintiff Kevin Curry alleges that he received a dark web notification notice and that his address was falsely posted on Experian credit monitoring. Id. at ¶ 15. Plaintiff Namuun Bat alleges an incorrect entry on her credit report and a change in address and phone number on her LoanCare online account. Id. at ¶ 28. Plaintiff Joshua Dryden allegedly experienced two unauthorized charges on his credit card, which he canceled, and an incorrect charge on his PayPal account. Id. at ¶ 36. Plaintiff April Manar allegedly experienced fraudulent Medicare charges amounting to $8,000. Id. at ¶ 72. The remaining Plaintiffs—Gregory Arrowsmith, Richard Freire, Andrew Gharibian, Cody Kettlewood, Eisin Jahwer Martinez, Douglas Newell, and Ryan Turizo—did not allege any misuse of their personal information after the Data Breach. Id. at ¶¶ 10—105. because plaintiffs provided affirmative evidence that their credit card and personal information was posted for sale on the dark web, they established both a present injury and a substantial risk of future injury, both sufficient to establish Article III

standing).9 Accordingly, Plaintiff Human’s allegations of injury resulting from identity theft after the data breach would constitute both actual injury for himself and a “certainly impending” or “substantial” risk of future harm for the rest of the class whose information was accessed in the same data breach that affected Plaintiff Human. See In re Equifax, 999 F.3d at 1263; see also Green-Cooper, 73 F.4th at 890. Further, Plaintiffs believe that Defendants have failed to provide real

disclosure on the details of the Data Breach, which diminished their ability to mitigate damages, and placed the burden on Plaintiffs to take mitigation steps by requesting that Plaintiffs contact Defendants. Am. Compl. at ¶¶ 129—31. As a result, Plaintiffs allege that they have taken time-consuming individual efforts to mitigate the impact of the data breach. Id. at ¶¶ 10—105.10 The injury borne by all Settlement Class members and Plaintiffs is fairly traceable to Defendants’ alleged failure to implement and maintain reasonable

security measures, leading to the theft of Plaintiff’s personally identifiable

9 In Green-Cooper, the Eleventh Circuit found that evidence of misuse of a plaintiff’s personal information and credit card data established a present injury, while the existence of this data online created the substantial risk of future injury. Green- Cooper, 73 F.4th at 890. 10 Each Plaintiff alleges they have suffered injury resulting from steps taken to mitigate identity theft resulting from the substantial risk of identity theft, regardless of whether the Plaintiff has suffered misuse of their personal information after the data breach. Am. Compl. at ¶¶ 10—105. information. Id. at ¶¶ 156, 167. Further, the injury of all Settlement Class members can be redressed by a favorable judicial decision. The Settlement Agreement includes awarding a cash payment for valid claims made by Settlement Class members.

Second Am. MPA at 8. If the valid claim includes documentation showing losses that are fairly traceable to the Cybersecurity Incident, the Settlement Class member may receive compensation (up to $1500 and/or up to $5000) depending on whether losses qualify as ordinary or extraordinary. Id. Alternatively, the Settlement Class Member may elect a flat cash payment in the amount of $100. Id. In addition to a cash payment, the proposed Settlement also gives Settlement Class members the option

to request Identity Monitoring. Id. Thus, the remedies included in the Settlement Agreement allow for the injury Plaintiffs are alleged to have suffered to be redressed by a favorable judicial decision. Therefore, Plaintiffs satisfy the requirements for Article III standing in the context of class action certification for settlement. B. The Settlement Class is Adequately Defined and Ascertainable Before assessing a proposed class under Rule 23, the Court must find that the proposed class is “adequately defined and clearly ascertainable.” Cherry v. Dometic

Corp., 986 F.3d 1296, 1302 (11th Cir. 2021). A proposed class is ascertainable when “it is adequately defined such that its membership is capable of determination.” Id. at 1304. Here, the Settlement Class is defined as “all persons residing in the United States who received written notice from Defendants that their Personal Information may have been compromised in the Cybersecurity Incident.” See Super Am. at ¶ 66. Accordingly, individuals can confirm whether they are a member of the Settlement Class based on whether they were sent a notification from Defendants that their personal information was potentially compromised. See Second Am. MPA at 20—21.

Based on this definition, the Settlement Class is adequately defined and clearly ascertainable. C. Rule 23 Federal Rule of Civil Procedure 23 establishes the legal framework for the requirements to certify a class. Under Rule 23(a), the Court must conclude: (1) the class is so numerous that joinder of all members would be impracticable; (2) there are questions of fact and law common to the class; (3) the claims or defenses of the representatives are typical of the claims and defenses of the unnamed members; and (4) the named representatives will be able to represent the interests of the class adequately and fairly.

Fed. R. Civ. P. 23(a)(1)-(4). Additionally, the Court must conclude one of the alternative requirements of Rule 23(b) is established.11 See Amchem Prods., Inc. v.

11 Rule 23(b) provides three alternatives, of which the third, involving superiority and predominance, is relevant here:

(1) prosecuting separate actions by or against individual class members would create a risk of:

(A) inconsistent or varying adjudications with respect to individual class members that would establish incompatible standards of conduct for the party opposing the class; or

(B) adjudications with respect to individual class members that, as a practical matter, would be dispositive of the interests of the other members not parties to the individual adjudications or would substantially impair or impede their ability to protect their interests; Windsor, 521 U.S. 591, 614—18 (1997). For the reasons discussed below, each requirement of Rule 23(a), as well as the predominance and superiority requirements of Rule 23(b)(3) are satisfied.

1. Numerosity The numerosity requirement asks whether joinder of all class members would be impracticable. See Phillips v. Joint Legis. Comm., 637 F.2d 1014, 1022 (5th Cir. 1981).12 Courts consider “the size of the class, ease of identifying its numbers and determining their addresses, facility of making service on them if joined and their

(2) the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole; or

(3) the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy. The matters pertinent to these findings include:

(A) the class members' interests in individually controlling the prosecution or defense of separate actions;

(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and

(D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b).

12 The case law of the former Fifth Circuit—as promulgated prior to the close of business on September 30, 1981—is binding precedent for the Eleventh Circuit. Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc). geographic dispersion.” Kilgo v. Bowman Transp., Inc., 789 F.2d 859, 878 (11th Cir. 1986). Although Plaintiffs need not delineate the precise number of members in the

class action, Plaintiffs bear “the burden of making some showing, affording the district court the means to make a supported factual finding, that the class actually certified meets the numerosity requirement.” Vega v. T-Mobile USA, Inc., 564 F.3d 1256, 1267 (11th Cir. 2009) (emphasis in original). Mere allegations of numerosity are insufficient to meet the numerosity prerequisite for class certification. Id. (citing Evans v. U.S. Pipe & Foundry Co., 696 F.2d 925, 930 (11th Cir. 1983)). There is no

fixed number of individuals required to satisfy the numerosity requirement, however less than twenty-one is generally inadequate and more than 40 is generally adequate. See Cox v. Am. Cast Iron Pipe Co., 784 F.2d 1546, 1553 (11th Cir. 1986). Here, Plaintiffs allegations satisfy the numerosity requirement. Plaintiffs allege the notice of a data breach filed by LoanCare with the Attorney General of Maine explains that Defendants’ information technology network suffered from a data breach where personal information was stolen. Am. Compl. at ¶ 123; Second

Am. MPA at 2—3. This data breach potentially affected 1.3 million individuals, including all Plaintiffs and Settlement Class Members. Am. Compl. at ¶ 128; Second Am. MPA at 2, 21. The affected individuals all have their mortgages subserviced by LoanCare. Second Am. MPA at 3. Further, there is no geographical restriction applied to this class. See Vega, 564 F.3d at 1267-68. The joinder of over a million Settlement Class members would be impracticable, and thus the numerosity requirement is satisfied. 2. Commonality Commonality requires questions of law or fact common to the class. Fed. R.

Civ. P. 23(a)(2). Plaintiffs must demonstrate that the class members “‘have suffered the same injury.’” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349-50 (2011) (citing Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 157 (1982)). The nature of Plaintiffs’ claims must be “capable of class wide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Id. at 350. Here, Plaintiffs have alleged that all Settlement Class members were affected

by the same data breach, which occurred on or about November 19, 2023. Second Am. MPA at 3. Further, Plaintiffs allege that Defendants did not adequately secure their information technology network, and thus all Settlement Class members are now at risk of identity thieves using their personal information to create fake identities, obtain fraudulent loans, or file fraudulent tax refunds. Id. at 19. Plaintiffs allege all the Class Members have suffered actual identity theft or a “certainly

impending” or “substantial” risk of identity theft. Additionally, Plaintiffs allege that the resolution of whether Defendants “security environment” was adequate to protect the personal information of the settlement class members does not vary between class members and may be fairly resolved for all class members at once. Id. at 21—22. Thus, because Plaintiffs allege common questions of fact and law, the commonality requirement is satisfied. 3. Typicality The typicality requirement is satisfied if “the claims or defenses of the class and the class representative arise from the same event or pattern or practice and are based on the same legal theory.” Williams v. Mohawk Indus., Inc., 568 F.3d 1350,

1357 (11th Cir. 2009) (quoting Kornberg v. Carnival Cruise Lines, Inc., 741 F.2d 1332, 1337 (11th Cir. 1984)). Therefore, the class representative must share the same interest and injury as the class members. Id. The typicality requirement can be satisfied “when there is a strong similarity of legal theories” even when there are “substantial factual differences.” Murray v. Auslander, 244 F.3d 807, 811 (11th Cir. 2001) (internal citations omitted). Here, Plaintiffs, as the class representatives, share the same claims of either

actual identity theft or a “certainly impending” or “substantial” risk of identity theft, as the other Settlement Class members, arising from the same cybersecurity event where Defendants allegedly failed to protect sensitive personal information from unauthorized third-party hackers. Second Am. MPA at 2. Accordingly, Plaintiffs share the same interest and injury as the Settlement Class members. Id. at 22. Thus, Plaintiffs’ claims are typical of the other Settlement Class members and the typicality

requirement is satisfied. 4. Adequacy of Representation The class representatives will fairly and adequately represent the interests of the class when: (1) no substantial conflicts of interest exist between the representatives and the class exist, and (2) the representatives will adequately prosecute the action. Valley Drug Co. v. Geneva Pharms., Inc., 350 F.3d 1181, 1189 (11th Cir. 2003) (internal citations omitted). A representative cannot fairly and adequately represent a class when “their interests are actually or potentially antagonistic to, or in conflict with, the interests and objectives of other class

members.” Id. (internal quotations and citations omitted). A conflict of interest exists when “some party members claim to have been harmed by the same conduct that benefitted other members of the class.” Id. Further, class representatives satisfy the adequacy requirement when their counsel is “qualified, experienced, and able to conduct the litigation.” In re HealthSouth Corp. Sec. Litig., 213 F.R.D. 447, 461 (N.D. Ala. 2003). Thus, the adequacy requirement applies to both class representatives and

their counsel. London v. Wal-Mart Stores, Inc., 340 F.3d 1246, 1253 (11th Cir. 2003). Here, Defendants have not identified any interests of Plaintiffs or Plaintiffs’ counsel that conflicts with the interests of the Settlement Class. Plaintiffs assert that they have the same interests in recovering damages as the Settlement Class because Plaintiffs were similarly injured by the same cybersecurity event which affected the Settlement Class. See Second Am. MPA at 22—23. Based on a review of the filings in this case, the Court has not found any indication that Plaintiffs or Plaintiffs’

counsel stand to benefit from the cybersecurity event that harmed members of the Settlement Class. Further, Defendants do not contest the ability of Plaintiffs or Plaintiffs’ counsel to diligently prosecute this action. Based on a review of the filings in this case, as well as the attestations of Plaintiffs’ counsel regarding their experience in similar cases, see Amended Joint Declaration of Interim Co-Lead Class in Support of Plaintiffs’ Unopposed Second Amended Motion for Preliminary Approval of Class Action Settlement at ¶¶ 36—42, Mar. 6, 2025, ECF No. 126-3 (“Joint Decl.”), the Court is satisfied that Plaintiffs are acting through adequate counsel. See Second

Am. MPA at 22—23; see also Declaration of Michael Lynch, Esq. Re: Angeion Group Qualifications and the Proposed Notice Plan at ¶¶ 2—6, Mar. 6, 2025, ECF No. 126- 4 (“Lynch Decl.”). Specifically, Plaintiffs’ counsel are experienced in complex class action litigation and have devoted substantial time to investigate this action. Joint Decl. at ¶¶ 36—38. Additionally, Angeion has administered over forty other privacy and data related class actions. Id. at ¶ 6. Thus, Plaintiffs are acting through qualified

counsel and Angeion is qualified as a settlement administrator. D. Rule 23(b) If Rule 23(a) is satisfied, Rule 23(b) specifies three types of class actions that are permitted. See Rule 23(b)(1—3). Plaintiffs assert that the Settlement Class is permitted under Rule 23(b)(3). See Second Am. MPA at 24. A Rule 23(b)(3) class action may proceed only if “the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members,

and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). 1. Predominance Common questions of law and fact predominate over individual questions when the common questions of law and fact directly impact every class member's effort to establish liability and on every class member's entitlement to relief. Klay v. Humana, Inc., 382 F.3d 1241, 1255 (11th Cir. 2004). In assessing whether class or individual issues predominate, the Court “must take into account the claims, defenses, relevant facts, and applicable substantive law.” Id. at 1254 (internal

citations omitted). Next, the Court must “classify these issues as common questions or individual questions by predicting how the parties will prove them at trial.” Sellers v. Rushmore Loan Mgmt. Servs., LLC, 941 F.3d 1031, 1040 (11th Cir. 2019) (citing Brown v. Electrolux Home Prods., Inc., 817 F.3d 1225, 1234 (11th Cir. 2016)). Individual questions predominate over common questions when “after adjudication of the class wide issues, plaintiffs must still introduce a great deal of individualized

proof or argue a number of individualized legal points to establish most or all of the elements of their individualized claims.” Id. (citing Klay, 382 F.3d at 1255). The common issues of law and fact in this case center around Defendants’ alleged failure to secure their information technology network from unauthorized access by third-party hackers, see Am. Compl. at ¶ 141; Pl. Second Am Mot. at 2—3, including (i) whether Defendants’ data systems and security policies and practices were adequate and reasonable; (ii) the extent of Defendants’ knowledge regarding

any potential vulnerabilities in their data systems; and (iii) whether Plaintiffs and the Settlement Class members suffered losses due to third-party hackers alleged possession of their personal information. See Second Am. MPA at 24—25. The answers to these questions are common to each Settlement Class member since each member is alleged to have had their personal information taken by third-party hackers in the same data breach. Id. Further, Plaintiffs and Defendants have not identified any individual factual questions arising from the claims of the Settlement Class members that would interfere with the resolution of the common issues, such as the “certainly impending” or “substantial” risk of identity theft. Thus, because the

common questions of law and fact predominate over any individual questions, the predominance requirement is satisfied. 2. Superiority The superiority requirement entails weighing “the relative advantages of a class action suit over whatever other forms of litigation might be realistically available to the plaintiffs.” Klay, 382 F.3d at 1269. Rule 23(b)(3) lists factors the

Court considers when deciding if the superiority requirement has been met: (A) the class members' interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). Plaintiffs assert that a class action is the only reasonable method to adjudicate the claims of all Settlement Class members fairly and efficiently. Second Am. MPA at 25. There are over a million class members who have allegedly been affected by the data breach. Id. at 2—3. The injury to all Settlement Class members stems from the same data breach, and the nature of the injury is the same (i.e., loss of confidentiality in their personal information). Id. Furthermore, if individual class members were to proceed with individual lawsuits, the potential recovery of damages would be relatively small. Id. Thus, a class action and class settlement would be superior to other methods available due to the substantial economies of time, effort, and expense for the litigants and the judiciary. See Klay, 382 F.3d at 1270—72.

IV. SETTLEMENT A. Preliminary Approval of Settlement Terms Under Rule 23(e), a court may approve a proposed class action settlement, which binds class members, “only after a hearing and only on finding that [the proposed class action settlement] is fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). At the preliminary approval stage, the Court need not make a final

determination of the fairness, reasonableness, and adequacy of the proposed settlement, but the Court must find the proposed settlement is “sufficiently fair, reasonable, and adequate on its face to warrant presentation to the class members.” Kuhr v. Mayo Clinic Jacksonville, No. 3:19-CV-453-J-34MCR, 2020 WL 5912350, at *8 (M.D. Fla. Oct. 6, 2020) (citing William B. Rubenstein, Newberg on Class Actions § 11:25 (4th ed.) (citing The Manual for Complex Litigation § 30.41 (3d ed.)) (“If the preliminary evaluation of the proposed settlement does not disclose grounds to doubt

its fairness or other obvious deficiencies...the court should direct that notice under Rule 23(e) be given to the class members of a formal fairness hearing, at which arguments and evidence may be presented in support of and in opposition to the settlement”). Here, Plaintiffs assert the settlement was negotiated at arm’s length and Plaintiffs’ counsel consulted with data security experts when assessing their claims. Second Am. MPA at 27—28; Joint Decl. at ¶ 25. Further, Plaintiffs note the settlement was reached with the assistance of a mediator who engaged in informal discovery with Plaintiffs’ counsel and attorneys’ fees and costs were not discussed

until after the parties agreed to all other material terms of the settlement. Second Am. MPA at 27—28; Joint Decl. at ¶¶ 22, 24. Thus, other than as excepted below, the terms of the Settlement Agreement and Super Am., on its face, appear to be sufficiently fair, reasonable, and adequate to warrant presentation to the Settlement Class. Upon review of the MPA and its supporting documents, the Court set a

Hearing for January 6, 2025, see Order, Dec. 11, 2024, ECF No. 116. At that Hearing, the Court discussed with all the parties its concerns regarding the MPA and its supporting documents. Following the Hearing the Court denied, without prejudice, the MPA providing the parties until Feb. 6, 2025, to renew their motion and until February 13, 2025, to file a Motion for Attorneys’ Fees. See Fee Order. On January 17, 2025, Plaintiffs Filed an Amended MPA along with a Settlement Agreement Amendment, Jan. 17, 2025, ECF No. 118-2. Thereafter the parties moved jointly for

a hearing on the Amended MPA “to the extent that the Court has additional questions” on the Amended MPA. Joint Mot., Jan. 29, 2025, ECF No. 119. On February 6, 2025, the Court denied the motion for a hearing and directed specific questions to the parties in writing, giving the parties until February 20, 2025, to address the Court’s concerns. Order, Feb. 6, 2025, ECF No. 120 (“Feb. 6 Order”). The parties filed their Motion for Attorneys’ Fees on Feb. 13, 2025. Motion for Attorneys’ Fees, Feb. 13, 2025, ECF No. 121 (“Fee Motion”). After one request for a brief extension to file amended documents, the parties filed their Second Am. MPA along with its Super Am. See generally Second Am. MPA; SA; Super Am.

The Court’s finding that the settlement is otherwise sufficiently fair and reasonable to present to the class does not reflect that the amount of attorneys’ fees requested by the parties is reasonable.13 Because the Settlement Agreement and Super Am. are not contingent on the approval of the requests for costs and attorneys’ fees, see Second Am. MPA at 17 (citing Fee Motion), the Court need not determine the reasonableness of the request for attorneys’ fees at this time. However, it is worth

noting that despite Plaintiffs’ counsel’s repeated request for up to 33.33% in attorneys’ fees, the Court has noted previously that it has concerns regarding the adequacy of the settlement fund if Plaintiffs’ counsel is awarded 33.33% of the gross settlement fund. It is unclear to the Court, given that the Plaintiffs request up to 33.33% of the fund in attorneys’ fees, how the fund could be adequate for the size of this class and the estimated claims rates supplied. Specifically, the remainder of $3,933,530, would not be sufficient to cover the proposed claims rate at 4% ($5,200,000), or Angeion’s estimated claims rate of 3.17% ($4,121,000). Further, the apparent deficiency only takes into consideration claims made under Cash Payment B for $100 per claimant and does not take into consideration the availability of larger claims under Cash Payment A, which allows for up to $1,500 for ordinary losses and up to $5,000 for extraordinary losses.

13 The Court ordered Plaintiffs to file their Fee Motion by February 13, 2025. See Fee Order. Feb. 6 Order. Further, even though the Court raised its concerns with the amount of fees requested in its order on February 6, 2025, Plaintiffs’ counsel filed its Fee Motion on February 13, 2025, leaving the Court’s concerns unaddressed. See Feb. 6 Order

at 3—5; Fee Motion. In addition to the concerns raised by the Court in the Feb. 6 Order, the Court notes that in addition to attorneys’ fees, attorneys’ costs, all settlement administration costs (i.e., Angeion’s costs and fees), and the cost of providing Identity Monitoring to class members who request it are also to be paid out of the Settlement Fund. Super Am. at ¶¶ 65, 72, 75, 83 k—m.14 Additionally, in the Eleventh Circuit the typical percentage range for attorneys’ fees in common fund fee

award cases, like this one, is between twenty and thirty percent. Camden I Condo. Ass'n, Inc. v. Dunkle, 946 F.2d 768, 774 (11th Cir. 1991) (holding that “[t]he majority of common fund fee awards fall between 20% to 30% of the fund.”). Furthermore, in Waters v. Intern. Precious Metals Corp., the Eleventh Circuit directed courts “to view this range as a ‘benchmark’ which ‘may be adjusted in accordance with the individual circumstances of each case,’ using the [Johnson] factors.” Waters v. Intern. Precious Metals Corp., 190 F.3d 1291, 1294 (11th Cir. 1999) (citing Johnson v. Georgia

Highway Express, Inc., 488 F.2d 714 (5th Cir. 1974)). Thus, the Court will carefully weigh the percentage requested when it rules on the final motion for attorneys’ fees.

14 The Settlement Agreement subjects the Cash Payments to pro rata increases or decreases based on whether there is an excess or a deficit in the Settlement Fund after payments have been made. Super Am. at ¶ 75. When the Court rules on the final motion for attorneys’ fees and costs, the Court will consider the possibility that a class members’ Cash Payment may be lowered if the attorneys’ fees award is too high. B. Class Notice Rule 23(e) “requires a court to direct notice in a reasonable manner to all class members who would be bound by the [proposed Settlement Agreement].” Fed. R. Civ.

P. 23(e)(1)(B). Because of the finality of the Final Approval Hearing and the subsequent Final Order, the notice to class members must be “reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.” Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306, 314 (1950). Further, for any class action certified under Rule 23(b)(3), the court must direct

“the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B).15 The individual notice to class members may be by one or more of the

15 In full, Rule 23(c)(2)(B) sets out notice requirements for any class certified under Rule 23(b)(3)—or upon ordering notice under Rule 23(e)(1) to a class proposed to be certified for purposes of settlement under Rule 23(b)(3)—the court must direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort. The notice may be by one or more of the following: United States mail, electronic means, or other appropriate means. The notice must clearly and concisely state in plain, easily understood language:

(i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through an attorney if the member so desires; (v) that the court will exclude from the class any member who requests exclusion; (vi) the time and manner for requesting exclusion; and following: United States mail, electronic means, or other appropriate means. Fed. R. Civ. P. 23(c)(2)(B). Individual notice to class members identifiable through reasonable effort is mandatory in Rule 23(b)(3) class actions, and this may not be

relaxed based on high cost. See Eisen v. Carlisle & Jacquelin, 417 U.S. 156, 173— 177 (1974). 1. Individual Notice to Class Members The Settlement Agreement and Super Am. includes five different ways in which information of the class action settlement is distributed to class action members: 1) Email Notice, 2) Long Form Notice, 3) Postcard Notice, 4) a Settlement

Website displaying notice of the class action settlement, and 5) a toll-free telephone line. Second Am. MPA at 8—10; see also SA at ¶¶ 85—92. Each of these will enable a class member to find more information about this Settlement. Id.; see also Lynch Decl. at ¶¶ 13—23. There are two ways in which individual notice will be transmitted to class members. First, class members will receive individual notice through Email Notice for class members whose emails are known to Defendants. See SA at ¶ 85. Second,

for class members whose email addresses are unknown or whose emails are bounced back, a Postcard Notice will be mailed out to these class members whose postal addresses are known to Defendants. Id. If Postcard Notices sent to class members

(vii) the binding effect of a class judgment on members under Rule 23(c)(3).

Fed. R. Civ. P. 23 (c)(2)(B). are returned as undeliverable, the Settlement Administrator will perform address skip tracing to determine new postal addresses associated with these class members. Id. ¶ 91; see also Lynch Decl. at ¶ 19. The Settlement Administrator will re-mail the

Postcard Notice to these class members based on newly discovered postal addresses revealed by the address skip tracing. Id. For class members whose email and postal addresses are unknown to Defendants, public notice will be directed through the Settlement Website. See id. at ¶¶ 70, 87. The Settlement Website will remain online and operable for at least six months after Final Approval. Id. at ¶¶ 70, 87.

The Settlement Website will also be user-friendly and compliant with the Americans with Disabilities Act (ADA). See Lynch Decl. at ¶¶ 21—22. Class members will also be able to submit claims and documentation via the Settlement Website, as well. Id. In addition, class members will also be able to call the toll-free telephone line with Settlement-related inquiries, and/or request a copy of the Long Form Notice and/or Claim Form. See SA at ¶¶ 70, 83, 87. The Long Form Notice will also be available to class members on the Settlement Website, and by mail upon

request to the Settlement Administrator via the Settlement Website and/or the toll- free telephone line. See id. at ¶¶ 44, 83; see also Lynch Decl. at ¶ 23. Thus, the Notice Program, including the aspects described above, constitutes the best notice reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections. 2. Information in the Class Notice The Email Notice and Postcard Notice will include: a description of the material terms of the Settlement; how to submit a Claim Form; the Claim Form Deadline; the last day of the Opt-Out Period for Settlement Class Members to opt-out of the Settlement Class; the last day of the Objection Period for Settlement Class Members to object to the Settlement and/or Application for Attorneys’ Fees and Costs; the Final Approval Hearing date; and the Settlement Website address at which Settlement Class Members may access this Agreement and other related documents and information.

SA at ¶ 86. Plaintiffs’ and Defendants counsel will insert the correct dates and deadlines as ordered by this Court, and if the date or time of the Final Approval Hearing changes, the settlement administrator will update the website to reflect the new date or time. Id. The Long Form Notice will also include a procedure for class members to opt- out of the Settlement Class, as well as a procedure to object to the Settlement and/or Application for Attorneys’ Fees and Costs. Id. at ¶ 88; Super Am. at ¶ 89. C. CAFA Notice The Class Action Fairness Act (CAFA), as set forth in 28 U.S.C. § 1715, prescribes additional notice requirements for Defendants participating in a class action suit. The parties agree that the Settlement Administrator will provide a CAFA Notice to the appropriate State official of each State in which a class member resides and the appropriate Federal Official. See SA at ¶¶ 19, 83. A representative of the Settlement Administrator (i.e., Angeion) also attests that “[w]ithin ten (10) days of [the] Settlement Agreement [being] filed with this Court, Angeion will cause notice of the settlement to be disseminated to the appropriate state and federal officials pursuant to the requirements of the Class Action Fairness Act, 28 U.S.C. §1715.” Lynch Decl. at ¶ 26. The Court will confirm with the parties at the Final Approval Hearing whether

the statutory ninety-day period has expired prior to entering any order finally approving the Settlement, if the Court determines that final approval of the Settlement is warranted. See 28 U.S.C. § 1715(d) (“An order giving final approval of a proposed settlement may not be issued earlier than 90 days after the later of the dates on which the appropriate Federal official and the appropriate State official are served with the notice required under subsection (b)”).

CONCLUSION Therefore, it is, 1. ORDERED that Plaintiffs’ Motion for Attorneys’ Fees, see ECF No. 121, is denied, and Plaintiffs will refile as described below; and it is further 2. ORDERED that Plaintiff's Second Amended Unopposed Motion for Preliminary Approval of Class Action Settlement, Certification of the Settlement Class, Approval of Class Notice, Scheduling of Final

Approval Hearing, and Incorporated Memorandum of Law (ECF No. 126) is GRANTED in part to the extent set forth below, and otherwise DENIED; and it is further 3. ORDERED that the Court, having found that Plaintiff has met the prerequisites to class certification set forth in Rule 23, Federal Rules of Civil Procedure, conditionally certifies, for purposes of settlement only, the Settlement Class. The Settlement Class is defined as follows: All persons residing in the United States who received written notice from Defendants that their Personal Information may have been compromised in the Cybersecurity Incident; and it is further, 4. ORDERED that the following individuals are excluded from the Settlement Class: (a) all persons who are employees, directors, officers, and agents of LoanCare and FNF; (b) governmental entities; and (c) the Judge and Magistrate Judge assigned to the Action, that Judge’s and

Magistrate’s Judge’s immediate family, and Court staff; (c) persons who properly execute and file a timely request for exclusion from the Settlement Class; (d) the legal representatives, successors, or assigns of any such excluded persons; (e) Plaintiffs’ counsel and Defendants’ counsel; and it is further 5. ORDERED that the Court designates Plaintiffs Kevin Curry, Gregory

Arrowsmith, Namuun Bat, Richard Freire, Andrew Gharibian, Cody Kettlewood, Eisin Jahwer Martinez, Douglas Newell, Christopher Human, April Manar and Jose Peralta as Class Representatives, with Plaintiffs’ Counsel Mariya Weekes of Milberg Coleman Bryson Phillips Grossman, PLLC and Bryan L. Bleichner of Chestnut Cambronne PA as Class Counsel; and it is further 6. ORDERED that the Court preliminarily approves the terms of the Settlement Agreement and Super Am. to the extent set forth below, as being a fair, reasonable, and adequate resolution of the dispute between

the parties; and it is further 7. ORDERED that the Final Approval Hearing (Fairness Hearing) will be held at 10:00 a.m. on Thursday, September 4, 2025, in a courtroom to be announced at the United States Courthouse, 300 North Hogan Street, Jacksonville, Florida 32202, at which time the Court will consider whether the proposed settlement should be finally approved as fair,

reasonable, and adequate, and whether a final judgment should be entered. The Court may adjourn and/or continue the Final Approval Hearing, or convert the hearing to a virtual Zoom hearing, without further notice to the Settlement Class Members. Any member of the Settlement Class wishing to attend the Fairness Hearing must consult the Clerk of the Court, the Court's docket, or the Settlement Administrator's website to confirm the time and manner of the Hearing

and to obtain the Zoom information if necessary; and it is further 8. ORDERED that the reasonableness and fairness of Class Counsel's request for fees and costs not to exceed 33.33% of the Total Settlement Amount shall be determined at the Final Approval Hearing; and it is further 9. ORDERED that the Court appoints Angeion Group, Inc. as the Settlement Administrator to supervise and administer the Notice Program, as well as to further administer the Settlement Agreement

and Super Am. should the Court grant Final Approval; and it is further 10. ORDERED that Defendants are to file a letter on the docket indicating the date and to whom the CAFA notice was sent; and it is further 11. ORDERED that the Court approves the Final Class Notice for distribution to those individuals on the Class List with a valid email address/mailing address as determined by the Settlement

Administrator in accordance with the Settlement Agreement and Super Am. and this Order; and it is further 12. ORDERED that the Court approves the Claim Form and Claims Process in accordance with the Settlement Agreement and Super Am. and this Order; and it is further 13. ORDERED that the following deadlines shall govern the distribution of the Final Class Notice:

(a) On or before March 28, 2025, Plaintiffs and Defendants shall file a joint status report on the docket, indicating that (1) they have conferred and agreed upon a finalized class list, and (2) indicates the size of the finalized Settlement Class.

(b) No later than April 24, 2025, the Settlement Administrator shall email /mail the Final Class Notice, in accordance with the Settlement Agreement and this order, to each Settlement Class Member at the email address/ mailing address set forth on the Class List, as updated by the Settlement Administrator. (c) No later than May 5, 2025, Settlement Administrator shall complete any remailing of returned postcards/emails.

(d) All claim forms are due on June 4, 2025.

(e) The opt-out period ends on July 7, 2025.

(f) The objection period ends on August 5, 2025;

and it is further

14. ORDERED that after conferral with Defendants, Plaintiffs shall file their Motion for Final Approval of the Settlement Agreement, and their renewed motion for attorneys’ fees on or before Monday July 21, 2025; and it is further 15. ORDERED that Class Counsel is authorized to represent and act on behalf of the Settlement Class with respect to all acts required by the Settlement Agreement and this Order or such other acts which are reasonably necessary to consummate the spirit of the Settlement Agreement; and it is further 16. ORDERED that all litigation, including discovery, other than further proceedings with respect to the Settlement Agreement and Super Am., is stayed pending further order of this Court; and it is further 17. ORDERED that any Settlement Class Member may opt out by utilizing the procedures outlined in the Final Class Notice. To be legally effective, all requests for exclusion must be postmarked on or before July 7, 2025, the end of the opt-out period; and it is further 18. ORDERED that if the Court finally approves the Settlement Agreement, all persons falling within the Settlement Class who do not request to be excluded shall be bound by the terms of the Settlement

Agreement and Super Am., any Judgment entered thereon, and any orders entered by the Court in connection with the settlement set forth in the Settlement Agreement. Persons who submit valid and timely notices of their intent to be excluded from the Settlement Agreement and Super Am. shall neither receive any benefits, nor be bound by the terms, of the Settlement Agreement; and it is further

19. ORDERED that any Settlement Class Member may appear and be heard as to why the proposed Settlement Agreement and Super Am., or any provision thereof, should not be approved as fair, reasonable, and adequate; provided, however, that no Settlement Class Member or any other person, shall be heard or entitled to contest the approval of the proposed Settlement Agreement and Super Am., or, if approved, the Judgment to be entered thereon, unless on or before Tuesday, August

5, 2025, that person has caused to be filed written objections in the manner and form outlined in the Final Class Notice, stating all supporting bases and reasons, with the Clerk of the Court; and it is further 20. ORDERED that attendance at the Final Approval Hearing is not necessary for an objection to be considered by the Court; however, persons wishing to be heard orally in opposition to the approval of the Settlement Agreement and Super Am. are required to indicate in their written objection their intention to appear at the Final Approval

Hearing. All written objections shall conform to the requirements of the Final Class Notice and shall identify all witnesses, documents or other evidence of any kind that are to be presented at the Final Approval Hearing in connection with such objections and shall further set forth the substance of any testimony to be given by such witnesses; and it is further

21. ORDERED that any Settlement Class Member who does not make his or her objection in the manner provided in the preceding paragraph of this Order shall be deemed to have waived such objection and shall be foreclosed from making any objections to the fairness, adequacy, or reasonableness of the Settlement Agreement and Super Am.; and it is further 22. ORDERED that the Court may, for good cause, extend any of the

deadlines set forth in this Order without further notice to the Settlement Class; and it is further 23. ORDERED that if the Settlement Agreement and Super Am. are not consummated for any reason, the instant Order shall be void and of no further effect and the parties and Settlement Class Members shall be returned to the positions each occupied prior to this Order and the January 6, 2025, Hearing, without prejudice to any legal argument any party may have asserted in this action; and it is further 24. ORDERED that the Settlement Agreement and Super Am. and all

negotiations, proceedings, documents prepared and statements made in connection with the Settlement Agreement and Super Am. shall be without prejudice to any party and shall not be admissible into evidence, and shall not be deemed or construed to be an admission or confession by any party, or any member of the Settlement Agreement and Super Am., of any fact, matter or proposition of law, and shall not be used in

any manner for any purpose. DONE AND ORDERED in NEW YORK, NEW YORK on March 24, 2025.

Appendix

NOTICE OF PROPOSED CLASS ACTION SETTLEMENT UNITED STATES DISTRICT COURT, MIDDLE DISTRICT OF FLORIDA In Re: LoanCare Data Security Breach Litigation, No. 3:23-cv-1508-CRK- MCR A court has authorized this notice. This is not a solicitation from a lawyer. If You Were Sent a Notice of Data Security Incident Letter From LoanCare, LLC, You Could Be Eligible for a Cash Payment and Identity Monitoring from a Class Action Settlement. WHO IS A SETTLEMENT CLASS MEMBER? In the lawsuit In Re: LoanCare Data Security Breach Litigation, Case No. 3:23-cv- 1508-CRK-MCR (M.D. Fla.), you are a Settlement Class Member if you were subject to, and previously received a notice letter notifying you of, the Cybersecurity Incident that LoanCare, LLC (“LoanCare”) and Fidelity National Financial, Inc. (“FNF”) (collectively “Defendants”) discovered in November 2023 (“Settlement Class”). WHAT ARE THE SETTLEMENT CLASS MEMBER BENEFITS AND TERMS? Under the Settlement, Defendants have agreed to pay $5,900,000.00 into a Settlement Fund which will be distributed to Settlement Class Members who submit Valid Claims, after deducting any Court-awarded Attorneys’ Fees and Costs, and all Settlement Administration Costs. All Settlement Class Members may submit Claims to receive (a) cash for ordinary losses up to $1,500 and/or for extraordinary losses up to $5,000 (with supporting documentation) or (b) cash payment of $100.00. Settlement Class Members’ Cash Payment may be pro rata adjusted up or down based on the total dollar amount of the Valid Claims. In addition to the Cash Payments, Settlement Class Members may submit claims for Identity Monitoring services. You must timely submit a Valid Claim to receive any of the Settlement Class Member Benefits. More information about the types of Claims and how to file is available at the Settlement Website. WHAT ARE YOUR RIGHTS AND OPTIONS? Submit a Claim Form. To qualify for Settlement Class Member Benefits, you must timely mail a Claim Form or timely complete and submit a Claim Form online at www.-----------------.com (“Settlement Website”). Your Claim Form must be postmarked or submitted online no later than__________, 2025. Angeion Group, Inc. is the Settlement Administrator. You may also enter an appearance through an attorney if the member so desires. Opt Out or Object. You may exclude yourself from the Settlement and retain your ability to sue Defendants on your own by mailing a written request for exclusion to the Settlement Administrator that is post marked no later than _______, 2025. If you do not exclude yourself, you will be bound by the Settlement and give up your right to sue regarding the Released Claims. If you do not exclude yourself, you have the right to object to the Settlement. Written objections must be signed, postmarked no later than ________, 2025, and provide the reasons for the objection. Please visit the Settlement Website for more details. Class Claims, Issues, or Defenses: Plaintiffs allege Defendants failed to employ reasonable security practices to protect Plaintiffs’ and Class Members’ Private Information and that class certification is warranted. Defendants counter that they employed proper security measures, that Plaintiffs were not harmed as a result of the Cybersecurity Incident, and that each of Plaintiffs’ claims warrants an individual determination. Do Nothing. If you do nothing, you will not receive Settlement Class Member Benefits and will lose the right to sue the Released Parties regarding the Released Claims. You will be bound by the Court’s decision because this is a conditionally certified class action. Attend the Final Approval Hearing. The Court will hold a Final Approval Hearing at ____.m. EST on _______, 2025, to determine if the Settlement is fair, reasonable, and adequate. All persons who timely object to the Settlement may appear at the Final Approval Hearing. Who are the attorneys for the Plaintiffs and the proposed Settlement Class? The Court appointed Mariya Weekes of Milberg Coleman Bryson Phillips Grossman PLLC and Bryan Bleichner of Chestnut Cambronne PA as Class Counsel to represent the Settlement Class. The attorneys’ fees will be paid exclusively from the Settlement Fund as awarded and approved by the Court. Class Counsel may also request reimbursement of their reasonable litigation costs and expenses to be paid from the Settlement Fund. The attorneys’ fees will be in an amount of up to $1,966,470.66 (33.33% of the $5,900,000 Settlement Fund). The Motion for Final Approval of the Settlement, with the incorporated Application for Attorneys’ Fees and Costs will be posted on the Settlement Website after it is filed with the Court. Who is the Judge overseeing this Settlement? Judge Claire R. Kelly, sitting by designation in the United States District Court for the Middle District of Florida. Where may I locate a copy of the Settlement Agreement, learn more about the Action, or learn more about submitting a Claim? Visit www.---------------.com or call toll-free 1-XXXXXX- XXXX. This Notice is a summary of the proposed Settlement.

/s/ Claire R. Kelly Claire R. Kelly, Judge*

Dated: March 24, 2025 New York, New York

* Judge Claire R. Kelly, of the United States Court of International Trade, sitting by designation.