In Re: LoanCare Data Security Breach Litigation

Opinion

UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF FLORIDA JACKSONVILLE DIVISION

IN RE: LOANCARE DATA 3:23-cv-01508-CRK-MCR SECURITY BREACH LITIGATION

OPINION This matter is before the Court on Plaintiffs’ Unopposed Mot. for Final Approval of Class Action Settlement and Memorandum of Law (“Final Mot.”) and Plaintiffs’ Unopposed Renewed Application for Attny’s Fees and Costs (“Renewed Fee Mot.”), filed on July 21, 2025. Final Mot., Jul. 21, 2025, ECF No. 136; Renewed Fee Mot., Jul. 21, 2025, ECF No. 137. In the Final Mot., Plaintiffs indicate the parties have reached a class-wide settlement of the claims raised in this putative class action (“Settlement Agreement” or “SA” and “Superseding Amendment to the Settlement Agreement” or “Super. Am.”). SA, Jul. 21, 2025, ECF No. 136-1; Super. Am., Jul. 21, 2025, ECF No. 137-2. Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiffs request that the Court: (1) certify the settlement class, (2) finally appoint Plaintiffs as Class Representatives and Plaintiffs’ counsel as Class Counsel, (3) finally appoint Angeion as the Settlement Administrator, and (5) finally approve the Settlement Agreement. See Final Mot. at 12–22. Plaintiffs represent that Defendants do not oppose the requested relief for settlement purposes. Id. at 1–2. I. Procedural History Plaintiffs, Kevin Curry, Gregory Arrowsmith, Namuun Bat, Joshua Dryden, Richard Freire, Andrew Gharibian, Christopher Human, Cody Kettlewood, April

Manar, Eisin Jahwer Martinez, Douglas Newell, Jose Peralta, and Ryan Turizo, individually and on behalf of all others similarly situated (the “Class” or “Class Members”), bring this action in a Consolidated Class Action Complaint, see Amended Consolidated Class Action Complaint, Mar. 19, 2024, ECF No. 40 (“Am. Compl.”), against Defendants Fidelity National Financial, Inc. (“Fidelity National Financial” or “FNF”) and LoanCare, LLC (“LoanCare”) (collectively, “Defendants”).1 On behalf of

themselves and the Class, Plaintiffs allege the following claims against Defendants: Negligence (Counts I and II); Negligence per se (Counts III and IV); Breach of Implied Contract and Breach of the Covenant of Good Faith and Fair Dealing (Count V); Unjust Enrichment (Count VI); and Breach of Fiduciary Duty (Count VII). Am. Compl. at ¶¶ 212–334. Prior to significant discovery taking place and pursuant to this Court’s mandatory mediation requirements, the parties met with Rodney A. Max, an

experienced class action mediator, to mediate this dispute on July 25, 2024. See Am. Uniform Case Management Report, Apr. 23, 2024, ECF No. 65. That same day, the

1 The initial complaint filed on December 27, 2023, Class Action Compl., Dec. 27, 2023, ECF No. 1, was stricken on January 4, 2024. See Order, Jan. 4, 2024, ECF No. 7. An amended complaint was filed on March 19, 2024. Am. Compl., Mar. 19, 2024, ECF No. 40, following a motion to consolidate, Pl. Joint Mot. to Consol. Actions, Appoint Interim Class Counsel, and Set Scheduling Deadlines, Feb. 9, 2024, ECF No. 24. See Am. Compl. Parties reached an agreement on the material terms of a class-wide settlement and filed a Notice of Class-wide Settlement on July 29, 2024. Notice of Settlement, Jul. 29, 2024, ECF No. 98 (“Notice of Settlement”).

On September 27, 2024, Plaintiffs filed an Unopposed Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law (“MPA”), seeking preliminary approval of the settlement as well as approval of the proposed class notice. See generally MPA, Sept. 27, 2024, ECF No. 113. Upon review of the MPA and its supporting documents, the Court set a telephonic hearing for January 6, 2025 (“Hearing”), see Order, Dec. 11, 2024, ECF No. 116. At that Hearing, the Court

discussed with all the parties its concerns regarding the MPA and its supporting documents. Following the Hearing, the Court denied, without prejudice, the MPA providing the parties until February 6, 2025, to renew their motion and until February 13, 2025, to file a Motion for Attorneys’ Fees. Order, Jan. 6, 2025, ECF No. 117 (“Fee Order”). On January 17, 2025, Plaintiffs Filed an Amended Unopposed Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law, Jan. 17, 2025, ECF No. 118 (“Amended MPA”); along with a Settlement

Agreement Amendment, Jan. 17, 2025, ECF No. 118-2. Thereafter, the parties moved jointly for a hearing on the Amended MPA “to the extent that the Court has additional questions” on the Amended MPA. Joint Mot., Jan. 29, 2025, ECF No. 119. On February 6, 2025, the Court denied the motion for a hearing and directed specific questions to the parties in writing, giving the parties until February 20, 2025, to address the Court’s concerns. Order, Feb. 6, 2025, ECF No. 120 (“Feb. 6 Order”). The parties filed their Motion for Attorneys’ Fees on Feb. 13, 2025. Motion for Attorneys’ Fees, Feb. 13, 2025, ECF No. 121. After one request for a brief extension to file amended documents, the parties filed their Second Amended Motion for Preliminary

Approval of Class Action Settlement and Memorandum of Law (“Second Am. MPA”) along with a Super Am. See generally Second Am. MPA, March 6, 2025, ECF No. 126; SA; Super Am. On March 24, 2025, this Court preliminarily approved Plaintiffs’ Second Am. MPA and denied Plaintiffs’ motion for attorneys’ fees, ordering Plaintiffs to refile a renewed motion for attorneys’ fees along with their Final Mot. Prelim. Approval Order, Mar. 24, 2025, ECF No. 132. The Court set forth the procedures and

time frames for dissemination of the Court’s Class Notice to the Settlement Class and set a Fairness hearing to be held on September 4, 2025, in Jacksonville, Florida. Prelim. Approval Order at 31–33. On July 21, 2025, Plaintiffs filed their Final Mot. and their Renewed Fee Mot. See Final Mot.; Renewed Fee Mot. On Thursday September 4, 2025, the Court held a Fairness Hearing in Jacksonville, Florida. See Fairness Hearing, Sept. 4, 2025, ECF No. 151 (“Fairness Hearing”). II. The Settlement Terms2

a. Class Definitions and Exclusions As conditionally certified in the Preliminary Approval Order, the Settlement Class is defined as follows:

2 Except where otherwise noted, all terms, conditions, defined terms, and agreements contained in the SA and Super. Am. are incorporated by reference and all capitalized terms used in this Opinion shall have the meanings set forth in the SA and Super. Am. 66. “Settlement Class” means all persons residing in the United States who received written notice from Defendants that their Personal Information may have been compromised in the Cybersecurity Incident. Excluded from the Settlement Class are (a) all persons who are employees, directors, officers, and agents of LoanCare and FNF; (b) governmental entities; and (c) the Judge assigned to the Action, that Judge’s immediate family, and Court staff.

Prelim. Approval Order at 4 (citing Super. Am. at ¶ 66; Second Am. MPA at 7). As defined in the Prelim. Approval Order, the Settlement Class included approximately 1.3 million individuals affected by the data breach. Prelim. Approval Order at 14 (citing Am. Compl. at ¶ 128; Second Am. MPA at 2, 21). b. Recovery Defendants will pay $5,900,000, including $350,000 to cover Settlement Administration Costs, into a Settlement Fund which will be distributed to Settlement Class Members who submit Valid Claims, after deducting any Court-awarded Attorneys’ Fees and Costs, and all Settlement Administration Costs. SA at ¶¶ 69, 71–72, 75–78. All Settlement Class Members who do not opt-out may submit claims to receive (a) cash for ordinary losses up to $1,500 and/or for extraordinary losses up to $5,000 (with supporting documentation) or (b) cash payment of $100. Id. at ¶¶ 67, 76–77.3 In addition to the Cash Payments, Settlement Class Members may submit claims for Identity Monitoring services. Id. at ¶ 78. Upon the effective date of the Settlement,4 the Settlement Class Members who do not opt out prior to the end of the

3 Settlement Class Members’ Cash Payments may be pro rata adjusted up or down based on the total dollar amount of the Valid Claims. SA at ¶¶ 75, 110. 4 “Effective Date” means the day after the entry of the Final Approval Order, provided no objections are made to the Settlement. SA at ¶ 35. If there are objections to the opt out period will release all claims arising out of the Cybersecurity Incident against Defendants. Id. at ¶¶ 62–63, 111–113. Settlement Class Members who opt-out of the Settlement prior to the

expiration of the opt-out period do not release their claims and will not obtain any benefits, including any Settlement Class Member Benefit, under the Settlement Agreement. Id. at ¶ 113. Three Hundred and Fifty Thousand Dollars ($350,000) will be set aside to fund the Settlement Administration Costs. Id. at ¶ 72. The parties agree that Class Counsel would apply to the Court for an award of attorneys’ fees of up to 33.33% of the Settlement Fund, approximately $1,966,470.66 (33.33% of the

$5,900,000 Settlement Fund) plus reimbursement of reasonable costs. Id. at ¶ 108. c. The Release by the Settlement Class Plaintiffs and the Settlement Class Members who did not opt out agree to release any and all actual, potential, filed or unfiled, known or unknown, fixed or contingent, claimed or unclaimed, suspected or unsuspected claims, demands, liabilities, rights, causes of action, damages, punitive, exemplary or multiplied damages, expenses, costs, indemnities, attorneys’ fees and/or obligations, whether in law or in equity, accrued or unaccrued, direct, individual or representative, of every nature and description whatsoever, based on any federal, state, local, statutory or common law or any other law, against the Released Parties, or any of them, arising out of or relating to actual or alleged facts, transactions, events, matters, occurrences, acts, disclosures, statements, representations, omissions or failures to act relating to the Cybersecurity Incident.

Settlement, then the Effective Date shall be the later of: (i) the expiration of the time to appeal the Final Approval with no appeal having been filed; or (ii) if such appeal is filed, the termination of such appeal, on terms that affirm the Final Approval or dismiss the appeal with no material modification to the Final Approval. Id. Id. at ¶¶ 61, 63, 113. III. Adequacy of Class Notice Rule 23(e) requires a court to “direct notice in a reasonable manner to all class

members who would be bound” by the proposed settlement. See Fed. R. Civ. P. 23(e)(1). With regard to Rule 23(b)(3) classes, the Rule states that the court must direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.... The notice must clearly and concisely state in plain, easily understood language: (i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through an attorney if the member so desires; (v) that the court will exclude from the class any member who requests exclusion; (vi) the time and manner for requesting exclusion; and (vii) the binding effect of a class judgment on members under Rule 23(c)(3).

Fed. R. Civ. P. 23(c)(2)(B). Thus, the Rule requires that “[i]ndividual notice must be sent to all class members whose names and addresses may be ascertained through reasonable effort.” Eisen v. Carlisle & Jacquelin, 417 U.S. 156, 173 (1974). Additionally, due process requires that the “notice must be ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.’” See id. at 174 (quoting Mullane v. Central Hanover Bank & Trust Co., 339 U.S. 306, 314 (1950)). “In every case, reasonableness is a function of anticipated results, costs, and amount involved.” In re Nissan Motor Corp. Antitrust Litig., 552 F.2d 1088, 1099 (5th Cir. 1977).5 Reasonableness also depends on the information available to the parties. See id. at 1098. Notice was adequately disseminated in accordance with both statutory

guidelines as well as the notice plan that this Court preliminarily approved. First, notice pursuant to 28 U.S.C. § 1715, the Class Action Fairness Act (“CAFA”), was adequately disseminated by the Settlement Administrator on October 7, 2024. Decl. of H. Jacob Hack Re: Notice and Administration at ¶ 6, Jul. 21, 2025, ECF No. 136-3 (“Notice Decl.”). This notice was sent to the Attorney General of all states and territories as well as the Attorney General of the United States, advising each of the

proposed class action settlement. Id. at ¶ 6, Ex. A; see also 28 U.S.C. § 1715(a). Second, in accordance with the Preliminary Approval Order, the Settlement Administrator disseminated email notice to the 1,313,513 potential Settlement Class Members who had a valid email address and disseminated Postcard Notice, via the United States Postal Service (“USPS”), first class mail, postage prepaid, to the 147,273 potential Settlement Class Members who either had an invalid email address or did not have an email address. See id. at ¶¶ 9, 11. Of the 1,165,905 Email Notices

sent, 12,801 could not be delivered, but on May 5, 2025, the Settlement Administrator sent Postcard Notice via the USPS, first class mail, postage prepaid, to the mailing address of the 12,801 potential Settlement Class Members whose email notice could not be delivered. Id. at ¶¶ 10, 12. Prior to mailing, the Settlement Administrator

5 In Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc), the Eleventh Circuit adopted as binding precedent all the decisions of the former Fifth Circuit handed down prior to the close of business on September 30, 1981. made reasonable efforts to obtain updated addresses for the potential Class Members identified on the Class List. Id. at ¶ 13. Of the 6,152 Postcard Notices returned as undeliverable by the USPS and 2,756 were re-mailed to updated addresses. Id. at ¶

14. In total 1,313,178 of the 1,313,513, or 99.97%, potential Settlement Class Members on the Class List received either Postcard Notice or Email Notice. Id. at ¶ 15. Additionally, on April 24, 2025, the Settlement Administrator established a settlement website to which potential Settlement Class Members had access. Id. at ¶ 16. Through this website, potential Settlement Class Members had access to view

general information about this class action Settlement, review relevant Court documents, and view important dates and deadlines pertinent to the Settlement. Id. at ¶ 16. Further, the Settlement Administrator established a toll-free hotline dedicated to providing essential information to potential Settlement Class Members as well as answering frequently asked questions. Id. at ¶ 17. Because the parties adequately disseminated the CAFA notice, complied with the agreed-to notice provisions as preliminarily approved by the Court, and given that there are no

developments or changes in the facts to alter the Court’s previous conclusion, the Court will finally conclude that the notice provided in this case meets the requirements of Rule 23(c)(2)(B). IV. Final Motion to Certify Class In Plaintiffs’ Final Mot., the parties jointly request that the Court certify the Settlement Class for settlement purposes. See Final Mot. at 12 (citing Second Am. MPA at 18–24). For the Court to certify a class it must confirm that (i) a named class member has standing; (2) the class is adequately defined and clearly ascertainable; and (3) the requirements of Rule 23 are met. Sellers v. Rushmore Loan Mgmt. Servs.,

LLC, 941 F.3d 1031, 1039 (11th Cir. 2019).6 A. Standing Class representatives must allege that they: “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To satisfy the injury in fact requirement, each plaintiff must

allege a concrete harm. Id. at 339–40. The harm must be an actual injury that has a close relationship to a traditional harm based in common law and be more than conclusory. Id. at 340–42. Although a risk of future harm alone may suffice for injunctive relief, a plaintiff must allege an actual concrete harm to recover monetary damages. See TransUnion LLC v. Ramirez, 594 U.S. 413, 435–36 (2021).7 A risk of a future harm is an actual concrete harm when the risk is “certainly impending” or “substantial[.]” Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1339 (11th

Cir. 2021) (citing Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014)).

6 Although the burden of proof used at the class certification for settlement stage is unclear, the Eleventh Circuit has used the pleading standard in such cases. See Williams v. Reckitt Benckiser LLC, 65 F.4th 1243, 1254 (11th Cir. 2023) (explaining that the burden of proof at the class certification stage is unclear, but “assum[ing] without deciding that the applicable standard is a pleading standard) (internal citations omitted); see also Smith v. Miorelli, 93 F.4th 1206, 1212 n.7 (11th Cir. 2024). 7 TransUnion reaffirmed that plaintiffs must sufficiently allege standing for each type of relief sought. TransUnion, 594 U.S. at 435—36 (citing Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185 (2000)). In data breach cases, whether a risk is “certainly impending” or “substantial” depends upon whether the information taken is immutable personal identifiers and there is actual misuse of at least one class member’s information. See id. at 1342–43.

In Tsao, the Eleventh Circuit held that a plaintiff did not have Article III standing because he did not have a substantial risk of future identity theft when only his credit card information, and no personally identifiable information like a social security number, was stolen. Id. at 1343–45; see also In re 21st Century Oncology Customer Data Sec. Breach Litig., 380 F. Supp. 3d 1243, 1254–55 (M.D. Fla. 2019) (considering (1) the motive of the party who accessed the plaintiff’s information, (2) the type of

information seized, and (3) whether the unauthorized party misused the plaintiff’s information). Likewise, in In re Equifax, the Eleventh Circuit found that plaintiffs sufficiently alleged they suffered identify theft based on evidence of actual misuse of some plaintiffs’ data, including social security numbers, in the form of unauthorized charges, accounts made in their names, and drops in credit scores. In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1262 (11th Cir. 2021). Although each class member must have Article III standing to recover monetary damages,

TransUnion, 594 U.S. at 431, where the risk of future harm, as discussed in Tsao and In re Equifax, is “certainly impending” or “substantial[,]” each class member has suffered such harm. Thus, class members may satisfy standing even though they have not suffered actual misuse of their personally identifiable information, if they establish “certainly impending” or “substantial” harm from the data breach, i.e., evidence that some plaintiffs have suffered identity theft due to the breach of immutable personally identifiable information. See Tsao 986 F.3d at 1342–43; In re Equifax, 999 F.3d at 1263. Relatedly, class members’ mitigation efforts in response to misuse of other

class members’ immutable information establishes a concrete injury. See In re Equifax, 999 F.3d at 1263 (citing Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931 (11th Cir. 2020) (en banc)). Where there is a substantial risk of identity theft because at least one class member has had his information not only taken but also misused, it is reasonable for other class members whose information was taken in the same data breach, to take mitigation efforts. Id. Therefore, the mitigation efforts of

plaintiffs whose information was not misused, coupled with a substantial risk of identity theft stemming from the actual misuse of at least one plaintiff’s information, constitutes concrete harm. See e.g., Gilbert v. Bioplus Specialty Pharmacy Servs., LLC, No. 6:21-CV-2158-RBD-DCI, 2024 WL 1464083, at *8–*9 (M.D. Fla. 2024).8 Plaintiff Christopher Human (“Plaintiff Human”) is one of two Plaintiffs who allege identify fraud. Am. Compl. at ¶ 57.9 Plaintiff Human’s alleged harm includes

8 In Gilbert, the court found that the standing threshold was satisfied in an unopposed motion for preliminary approval of a class action settlement. Gilbert, 2024 WL 1464083 at *8–*9. 9 Plaintiff Jose Peralta alleges he experienced identity fraud through unauthorized charges on his credit card and a second Uber account created under his name with financial information that he did not create. Am. Compl. at ¶ 94. Other plaintiffs allege misuse of their information: Plaintiff Kevin Curry alleges that he received a dark web notification notice and that his address was falsely posted on Experian credit monitoring. Id. at ¶ 15. Plaintiff Namuun Bat alleges an incorrect entry on her credit report and a change in address and phone number on her LoanCare online account. Id. at ¶ 28. Plaintiff Joshua Dryden allegedly experienced two unauthorized charges on his credit card, which he canceled, and an incorrect charge on his PayPal allegations of misuse of personal information accessed during the data breach– specifically, his Social Security number. Id. As in In re Equifax, Plaintiff Human alleges that after the data breach someone opened bank accounts in his name at

multiple banks by using his Social Security number, $10,000 was stolen from one of his bank accounts, and, in March 2024, an unauthorized individual attempted to access the only bank account that he did not freeze after this fraudulent activity. Id.; compare Tsao, 986 F.3d at 1343–44 (finding plaintiff lacked standing where breach did not involve social security numbers, birth dates, or driver’s license numbers); see Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 889–90 (11th Cir. 2023) (finding

that because plaintiffs provided affirmative evidence that their credit card and personal information was posted for sale on the dark web, they established both a present injury and a substantial risk of future injury, both sufficient to establish Article III standing).10 Accordingly, Plaintiff Human’s allegations of injury resulting from identity theft after the data breach would constitute both actual injury for himself and a “certainly impending” or “substantial” risk of future harm for the rest of the class whose information was accessed in the same data breach that affected

account. Id. at ¶ 36. Plaintiff April Manar allegedly experienced fraudulent Medicare charges amounting to $8,000. Id. at ¶ 72. The remaining Plaintiffs—Gregory Arrowsmith, Richard Freire, Andrew Gharibian, Cody Kettlewood, Eisin Jahwer Martinez, Douglas Newell, and Ryan Turizo—did not allege any misuse of their personal information after the Data Breach. Id. at ¶¶ 10–105. 10 In Green-Cooper, the Eleventh Circuit found that evidence of misuse of a plaintiff’s personal information and credit card data established a present injury, while the existence of this data online created the substantial risk of future injury. Green- Cooper, 73 F.4th at 890. Plaintiff Human. See In re Equifax, 999 F.3d at 1263; see also Green-Cooper, 73 F.4th at 890. Further, Plaintiffs believe that Defendants failed to provide adequate

disclosure on the details of the Data Breach, which diminished their ability to mitigate damages, and placed the burden on Plaintiffs to take mitigation steps by requesting that Plaintiffs contact Defendants. Am. Compl. at ¶¶ 129–31. As a result, Plaintiffs allege that they have taken time-consuming individual efforts to mitigate the impact of the data breach. Id. at ¶¶ 10–105.11 The injury borne by all Settlement Class Members and Plaintiffs is fairly

traceable to Defendants’ alleged failure to implement and maintain reasonable security measures, leading to the theft of Plaintiff’s personally identifiable information. Id. at ¶¶ 156, 167. Further, the injury of all Settlement Class members can be redressed by a favorable judicial decision. The Settlement Agreement includes awarding a cash payment for valid claims made by Settlement Class members. SA at ¶¶ 76–78. If the valid claim includes documentation showing losses that are fairly traceable to the Cybersecurity Incident, the Settlement Class member may receive

compensation (up to $1500 and/or up to $5000) depending on whether losses qualify as ordinary or extraordinary. Id. Alternatively, the Settlement Class Member may elect a flat cash payment in the amount of $100. Id. In addition to a cash payment,

11 Each Plaintiff alleges they have suffered injury resulting from steps taken to mitigate identity theft resulting from the substantial risk of identity theft, regardless of whether the Plaintiff has suffered misuse of their personal information after the data breach. Am. Compl. at ¶¶ 10–105. the proposed Settlement also gives Settlement Class members the option to request Identity Monitoring. Id. Thus, the remedies included in the Settlement Agreement allow for the injury Plaintiffs are alleged to have suffered to be redressed by a

favorable judicial decision. Therefore, Plaintiffs satisfy the requirements for Article III standing in the context of class action certification for settlement. B. The Settlement Class is Adequately Defined and Ascertainable Before assessing a proposed class under Rule 23, the Court must find that the proposed class is “adequately defined and clearly ascertainable.” Cherry v. Dometic Corp., 986 F.3d 1296, 1302 (11th Cir. 2021). A proposed class is ascertainable when

“it is adequately defined such that its membership is capable of determination.” Id. at 1304. Here, the Settlement Class is defined as “all persons residing in the United States who received written notice from Defendants that their Personal Information may have been compromised in the Cybersecurity Incident.” See Super Am. at ¶ 66. Accordingly, individuals can confirm whether they are a member of the Settlement Class based on whether they were sent a written notification from Defendants that

their personal information was potentially compromised. See Second Am. MPA at 20–21. Based on this definition, the Settlement Class is adequately defined and clearly ascertainable. C. Rule 23 Federal Rule of Civil Procedure 23 establishes the legal framework for the requirements to certify a class. Under Rule 23(a), the Court must conclude: (1) the class is so numerous that joinder of all members would be impracticable; (2) there are questions of fact and law common to the class; (3) the claims or defenses of the representatives are typical of the claims and defenses of the unnamed members; and (4) the named representatives will be able to represent the interests of the class adequately and fairly.

Fed. R. Civ. P. 23(a)(1)–(4). Additionally, the Court must conclude one of the alternative requirements of Rule 23(b) is established.12 See Amchem Prods., Inc. v.

12 Rule 23(b) provides three alternatives, of which the third, involving superiority and predominance, is relevant here:

(1) prosecuting separate actions by or against individual class members would create a risk of:

(A) inconsistent or varying adjudications with respect to individual class members that would establish incompatible standards of conduct for the party opposing the class; or

(B) adjudications with respect to individual class members that, as a practical matter, would be dispositive of the interests of the other members not parties to the individual adjudications or would substantially impair or impede their ability to protect their interests;

(2) the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole; or

(3) the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy. The matters pertinent to these findings include:

(A) the class members' interests in individually controlling the prosecution or defense of separate actions; Windsor, 521 U.S. 591, 614–18 (1997). For the reasons discussed below, each requirement of Rule 23(a), as well as the predominance and superiority requirements of Rule 23(b)(3) are satisfied.

1. Numerosity The numerosity requirement asks whether joinder of all class members would be impracticable. See Phillips v. Joint Legis. Comm., 637 F.2d 1014, 1022 (5th Cir. 1981). Courts consider “the size of the class, ease of identifying its numbers and determining their addresses, facility of making service on them if joined and their geographic dispersion.” Kilgo v. Bowman Transp., Inc., 789 F.2d 859, 878 (11th Cir. 1986). Although Plaintiffs need not delineate the precise number of members in the

class action, Plaintiffs bear “the burden of making some showing, affording the district court the means to make a supported factual finding, that the class actually certified meets the numerosity requirement.” Vega v. T-Mobile USA, Inc., 564 F.3d 1256, 1267 (11th Cir. 2009) (emphasis in original). Mere allegations of numerosity are insufficient to meet the numerosity prerequisite for class certification. Id. (citing Evans v. U.S. Pipe & Foundry Co., 696 F.2d 925, 930 (11th Cir. 1983)). There is no

(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and

(D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b). fixed number of individuals required to satisfy the numerosity requirement, however less than twenty-one is generally inadequate and more than 40 is generally adequate. See Cox v. Am. Cast Iron Pipe Co., 784 F.2d 1546, 1553 (11th Cir. 1986).

Here, Plaintiffs allegations satisfy the numerosity requirement. Plaintiffs allege the notice of a data breach filed by LoanCare with the Attorney General of Maine explains that Defendants’ information technology network suffered from a data breach where personal information was stolen. Am. Compl. at ¶ 123; Second Am. MPA at 2–3. This data breach potentially affected 1.3 million individuals, including all Plaintiffs and Settlement Class Members. Id. at ¶ 128; Second Am. MPA

at 2, 21. The affected individuals all have their mortgages subserviced by LoanCare. Second Am. MPA at 3. Further, there is no geographical restriction applied to this class. See Vega, 564 F.3d at 1267–68. The joinder of over a million Settlement Class members would be impracticable, and thus the numerosity requirement is satisfied. 2. Commonality Commonality requires questions of law or fact common to the class. Fed. R. Civ. P. 23(a)(2). Plaintiffs must demonstrate that the class members “‘have suffered the same injury.’” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349–50 (2011) (citing

Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 157 (1982)). The nature of Plaintiffs’ claims must be “capable of class wide resolution–which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Id. at 350. Here, Plaintiffs have alleged that all Settlement Class members were affected by the same data breach, which occurred on or about November 19, 2023. Second Am. MPA at 3. Further, Plaintiffs allege that Defendants did not adequately secure their information technology network, and thus all Settlement Class members are now at risk of identity thieves using their personal information to create fake

identities, obtain fraudulent loans, or file fraudulent tax refunds. Id. at 19. Plaintiffs allege all the Class Members have suffered actual identity theft or a “certainly impending” or “substantial” risk of identity theft. Additionally, Plaintiffs allege that the resolution of whether Defendants “security environment” was adequate to protect the personal information of the settlement class members does not vary between class members and may be fairly resolved for all class members at once. Second Am. MPA

at 21–22. Thus, because Plaintiffs allege common questions of fact and law, the commonality requirement is satisfied. 3. Typicality The typicality requirement is satisfied if “the claims or defenses of the class and the class representative arise from the same event or pattern or practice and are based on the same legal theory.” Williams v. Mohawk Indus., Inc., 568 F.3d 1350, 1357 (11th Cir. 2009) (quoting Kornberg v. Carnival Cruise Lines, Inc., 741 F.2d 1332, 1337 (11th Cir. 1984)). Therefore, the class representative must share the same

interest and injury as the class members. Id. The typicality requirement can be satisfied “when there is a strong similarity of legal theories” even when there are “substantial factual differences.” Murray v. Auslander, 244 F.3d 807, 811 (11th Cir. 2001) (internal citations omitted). Here, Plaintiffs, as the class representatives, share the same claims of either actual identity theft or a “certainly impending” or “substantial” risk of identity theft, as the other Settlement Class members, arising from the same cybersecurity event where Defendants allegedly failed to protect sensitive personal information from unauthorized third-party hackers. Second Am. MPA at 2. Accordingly, Plaintiffs

share the same interest and injury as the Settlement Class members. Id. at 22. Thus, Plaintiffs’ claims are typical of the other Settlement Class members and the typicality requirement is satisfied. D. Rule 23(b) If Rule 23(a) is satisfied, Rule 23(b) specifies three types of class actions that are permitted. See Fed. R. Civ. P. 23(b)(1–3). Plaintiffs assert that the Settlement

Class is permitted under Rule 23(b)(3). See Second Am. MPA at 24. A Rule 23(b)(3) class action may proceed only if “the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). 1. Predominance Common questions of law and fact predominate over individual questions

when the common questions of law and fact directly impact every class member’s effort to establish liability and on every class member’s entitlement to relief. Klay v. Humana, Inc., 382 F.3d 1241, 1255 (11th Cir. 2004). In assessing whether class or individual issues predominate, the Court “must take into account the claims, defenses, relevant facts, and applicable substantive law.” Id. at 1254 (internal citations omitted). Next, the Court must “classify these issues as common questions or individual questions by predicting how the parties will prove them at trial.” Sellers v. Rushmore Loan Mgmt. Servs., LLC, 941 F.3d 1031, 1040 (11th Cir. 2019) (citing Brown v. Electrolux Home Prods., Inc., 817 F.3d 1225, 1234 (11th Cir. 2016)).

Individual questions predominate over common questions when “after adjudication of the class wide issues, plaintiffs must still introduce a great deal of individualized proof or argue a number of individualized legal points to establish most or all of the elements of their individualized claims.” Sellers, 941 F.3d at 1040 (citing Klay, 382 F.3d at 1255). The common issues of law and fact in this case center around Defendants’

alleged failure to secure their information technology network from unauthorized access by third-party hackers, see Am. Compl. at ¶ 141; Second Am. MPA at 2–3, including (i) whether Defendants’ data systems and security policies and practices were adequate and reasonable; (ii) the extent of Defendants’ knowledge regarding any potential vulnerabilities in their data systems; and (iii) whether Plaintiffs and the Settlement Class members suffered losses due to third-party hackers alleged possession of their personal information. See Second Am. MPA at 24–25. The

answers to these questions are common to each Settlement Class member since each member is alleged to have had their personal information taken by third-party hackers in the same data breach. Id. Further, Plaintiffs and Defendants have not identified any individual factual questions arising from the claims of the Settlement Class members that would interfere with the resolution of the common issues of the class, i.e., the “certainly impending” or “substantial” risk of identity theft. Thus, because the common questions of law and fact predominate over any individual questions, the predominance requirement is satisfied. 2. Superiority

The superiority requirement entails weighing “the relative advantages of a class action suit over whatever other forms of litigation might be realistically available to the plaintiffs.” Klay, 382 F.3d at 1269. Rule 23(b)(3) lists factors the Court considers when deciding if the superiority requirement has been met: (A) the class members’ interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). Plaintiffs assert that a class action is the only reasonable method to adjudicate the claims of all Settlement Class members fairly and efficiently. Second Am. MPA at 25. There are over a million class members who have allegedly been affected by the data breach. Id. at 2–3. The injury to all Settlement Class members stems from the same data breach, and the nature of the injury is the same (i.e., loss of confidentiality in their personal information). Id. Furthermore, if individual class members were to proceed with individual lawsuits, the potential recovery of damages would be relatively small. Id. Thus, a class action and class settlement would be superior to other methods available due to the substantial economies of time, effort, and expense for the litigants and the judiciary. See Klay, 382 F.3d at 1270–72. Finally, there have been no objections to class certification, thus, for the reasons stated above the Court will finally certify the class for settlement purposes. V. Fairness and Adequacy of the Settlement

a. Standard of Review Rule 23(e)(2) also establishes four core concerns guiding the primary considerations for evaluating whether a proposed class action settlement is fair, reasonable, and adequate. See Ponzio v. Pinon, 87 F.4th 487, 494 (11th Cir. 2023). These four core concerns include whether: (A) the class representatives and class counsel adequately represented the class; (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate (taking into account the costs, risks and delay of trial and appeal, the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims, the terms of any proposed award of attorney’s fees, including timing of payment, and any agreement required to be identified under Rule 23(e)(3)); and (D) the proposal treats class members equitably relative to each other.

Id. (internal quotations marks omitted); see also Fed. R. Civ. P. 23(e)(2)(A-D). The Eleventh Circuit also requires courts to consider the Bennett factors in evaluating whether a proposed class action settlement is fair, reasonable and adequate. Id.; see also In re Equifax, 999 F.3d at 1273 (instructing “district courts to consider several additional factors called the Bennett factors.”). The Bennett factors are: (1) the likelihood of success at trial; (2) the range of possible recovery; (3) the point on or below the range of possible recovery at which a settlement is fair, adequate and reasonable; (4) the complexity, expense and duration of litigation; (5) the substance and amount of opposition to the settlement; and (6) the stage of proceedings at which the settlement was achieved.

Id. (citing Bennett v. Behring Corp., 737 F.2d 982, 986 (11th Cir. 1984)). The Bennett factors complement the four core concerns where appropriate. Ponzio, 87 F.4th at 495. For example, the Eleventh Circuit held that “Bennett factors (1), (2), (4), and (6) can inform whether the relief provided to the class is adequate” and “Bennett factors (3) and (5) can inform whether the proposal treats class members equitably relative to each other.” Id. at 495 (internal quotation marks omitted). b. Analysis i. Adequacy of Representation & Arm’s-Length Negotiations

Pursuant to Rule 23(e)(2)(A) and (B), when evaluating whether to approve a class settlement, courts must consider whether “the class representative and class counsel have adequately represented the class,” and whether “the proposal was negotiated at arm’s length.” As previously addressed in the Preliminary Approval Order, the Court finds that the Class is represented by adequate counsel. See Prelim. Approval Order at 16–18. The Court’s preliminary determination is further confirmed by Class Counsel’s conduct since that time in effectuating notice to the Settlement Class Members, preparing the Final Approval Motion, and appearing at the Fairness Hearing. Thus, the Court remains satisfied that the Settlement Class is represented by adequate counsel.

Additionally, the Court finds that the settlement was achieved through arm's- length negotiations. Here, the parties reached the settlement with the involvement of a qualified and neutral mediator. Final Mot. at 15–16. Further, a review of the record reveals no evidence of fraud or collusion between the parties, and while the parties settled early in the litigation of this case, they did so after engaging in informal discovery and exchanging confidential information. Thus, Class Counsel

had an adequate information base upon which to conduct negotiations. See Rule 23(e)(2)(A), adv. comm. note (2018 amend.) (“For example, the nature and amount of discovery in this or other cases, or the actual outcomes of other cases, may indicate whether counsel negotiating on behalf of the class had an adequate information base.”). The Court is satisfied that the prompt settlement of this action is the result of good faith, arm’s-length negotiations, based on an accurate assessment of the

evidence by competent counsel. ii. Adequacy of the Relief Next, the Court must consider whether the relief provided for the Settlement Class is adequate by analyzing: (i) the costs, risks and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3).

Fed. R. Civ. P. 23(e)(2)(C). Several of the Bennett factors also address the “costs, risks and delay of trial and appeal,” by weighing the likelihood of success and range of possible recovery for the class at trial, measured against the trial’s anticipated complexity, cost and duration. Bennett, 737 F.2d at 986. Nevertheless, “[i]t is not necessary to try the merits of the case in connection with reviewing the settlement.” Elkins v. Equitable Life Ins. Co. of Iowa, No. CivA96-296-Civ-T-17B, 1998 WL 133741, at *25 (M.D. Fla. Jan. 27, 1998) (citing In re Corrugated Container Antitrust Litig., 643 F.2d 195, 212 (5th Cir. April 3, 1981)). “Thus, the Court can limit its inquiry to determining ‘whether the possible rewards of continued litigation with its

risks and costs are outweighed by the benefits of the settlement.’” Id. (quoting Ressler v. Jacobson, 822 F. Supp. 1551, 1553 (M.D. Fla. 1992)). Here, the Settlement Class Members were given various options to choose from to remedy their personal identifiable information being exposed because of the data breach incident. Specifically, the Settlement Class Members had the option to request different Cash Payments–Cash Payment A for ordinary damages up to $1,500

or for extraordinary damages up to $5,000, or Cash Payment B for a flat payment of $100 subject to a pro rata adjustment up or down–dependent upon the extent of their injury. SA at ¶¶ 75–78. Further, Settlement Class Members were also able to make a claim for three years of Identity Monitoring in addition to either of the Cash Payments.13 Final Mot. at 7–8; SA at ¶ 75. Although Cash Payment B will be pro rata decreased due to the number of claims, attorneys’ fee award, and Settlement Administrator costs, Cash Payment B is for individuals who did not suffer out of

pocket ordinary losses or extraordinary losses. SA at ¶ 76. Additionally, the Settlement Agreement seeks to protect Settlement Class Members against further losses by providing Identity Monitoring. Id. at ¶ 78. Given the Cash Payment

13 Settlement Class members who already elected to receive 2 years of Identity Monitoring previously offered by Defendants in connection with its initial Cybersecurity Incident notification letter are only eligible to receive 1 year of Identity Monitoring. SA at ¶ 78. options, as well as the Identity Monitoring option to protect Settlement Class Members from their personal identifying information being used going forward, the Court is satisfied that the award to the Settlement Class adequately compensates

Settlement Class Members for their damages. Although the Settlement Class appears to have a strong case of liability against Defendants, getting to trial was not guaranteed. First, there is no guarantee that this class action would have proceeded to trial as data breach class actions face hurdles in obtaining class certification. Green-Cooper, 73 F.4th at 893 (remanding class certification of the California class to the District Court to address whether the

named Plaintiff had standing), cert. denied sub nom. Brinker Int’l, Inc. v. Steinmetz, 144 S. Ct. 1457, 218 L. Ed. 2d 689 (2024); see e.g., In re Countrywide Fin. Corp. Customer Data Sec. Breach Litig., No. 3:08-MD-01998, 2010 WL 3341200, at *6 (W.D. Ky. Aug. 23, 2010) (approving a class action settlement, inter alia, because “proceeding through the litigation process in this case is unlikely to produce the plaintiffs’ desired results [while] in contrast, the settlement offers a reasonable resolution that properly addresses the tricky issues presented by data breaches.”).

Second, even if this case proceeded to trial, full recovery at trial was not assured. Defendants, evidence by their motion to dismiss, would likely have raised defenses related to Plaintiffs’ possible inability to show deceptive acts or unfair practices by Defendants under the Florida Deceptive and Unfair Trade Practices Act (“FDUTPA”). See FNF and LoanCare’s Am. Mot. to Dismiss and Incorporated Memo. of Law at 39–40, Apr. 17, 2024, ECF No. 59 (“Def. MTD”) (citing In re Mednax Servs., Inc., Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183, 1212 (S.D. Fla. 2022)). Further, Defendants likely would have raised defenses to Plaintiffs’ California Consumer Privacy Act Claims (“CCPA”), questioning Plaintiffs’ ability to show that

the data breach incident resulted from any violation of Defendants’ “duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information” as required by the CCPA. See id. at 38 (quoting Cal. Civ. Code § 1798.150(a)(1)). Thus, the Court finds that the recovery agreed to here, although less than what conceivably could have been obtained at trial, is a fair and reasonable settlement considering the risks, costs and delay of proceeding to trial.

The Court is also satisfied that the settlement provides adequate relief with respect to the “terms of any proposed award of attorney’s fees, including timing of payment.”14 See Fed. R. Civ. P. Rule 23(e)(2)(C)(iii). The Court has previously expressed its concerns with the size of the percentage of recovery requested by Class Counsel. See Feb. 6 Order at 3–5; Prelim. Approval Order at 23–24. Nevertheless, in the SA the parties agree the Settlement is not contingent on approval of Class

14 Here, the attorneys’ fees will be paid out of the Settlement Fund by the Settlement Administrator via wire transfer within five days of

the day after the entry of the Final Approval Order, provided no objections are made to the Settlement. If there are objections to the Settlement, then the Effective Date shall be the later of: (i) the expiration of the time to appeal the Final Approval with no appeal having been filed; or (ii) if such appeal is filed, the termination of such appeal, on terms that affirm the Final Approval or dismiss the appeal with no material modification to the Final Approval.

SA at ¶¶ 35, 108. Counsel’s request and the remaining provisions of the Settlement Agreement shall remain in force whether the Court denies Class Counsel’s attorneys’ fee request or awards less than is requested. See SA at ¶ 109. Thus, and based on the Court’s

determination of a reasonable attorneys’ fee award discussed below, this factor does not weigh against approval of the Settlement. iii. Equitable Treatment of Class Members The Court also must examine whether “the proposal treats class members equitably relative to each other.” See Fed. R. Civ. P. 23(e)(2)(D). Here, Settlement Class Members may submit a claim for different Cash Payments based on the nature

and extent of their injury. SA at ¶¶ 75–78. Additionally, Settlement Class Members may submit a claim for up to three years of Identity Monitoring. Id. at ¶ 78. Settlement Class members who already elected to receive 2 years of Identity Monitoring previously offered by Defendants in connection with its initial Cybersecurity Incident notification letter are only eligible to receive 1 year of Identity Monitoring. Id. Thus, the settlement properly accounts for differences among individual Class Members and treats Class Members equitably in the division of the

settlement. Additionally, the Court is satisfied that the release is not likely to disproportionately impact any particular Class Members. See Fed. R. Civ. P. 23(e)(2)(D), adv. comm. note (2018 amend.) (“Matters of concern could include whether the apportionment of relief among class members takes appropriate account of differences among their claims, and whether the scope of the release may affect class members in different ways that bear on the apportionment of relief.”). iv. Substance and Amount of Opposition to the Settlement

The reaction of the class is important when a court determines whether a proposed settlement is “fair, reasonable and adequate.” Lipuma v. Am. Express Co., 406 F. Supp. 2d 1298, 1324 (S.D. Fla. 2005). A low percentage of objections demonstrates the reasonableness of a settlement. Id. Here, two of the 1,316,512 putative Class Members filed written objections to the Settlement, no one objected at the Fairness Hearing, and 4415 individuals elected to opt-out. Specifically, one written objection filed by Mr. Clayton Craft, objected to the Settlement Agreement on the basis that it “fails to adequately address the fundamental issues at stake in this data security breach.” Craft Objection, Apr. 28, 2025, ECF No. 135 (“Craft Objection”). Mr. Craft’s objection argues for systemic change within Defendants’ business operations related to data privacy and data collection. See id. However,

arguing for systemic change is not a valid basis to object to this settlement, as the settlement adequately addresses the harm done to the individual class members and provides a remedy for the injuries. Individuals who had ordinary or extraordinary damages, causing them to incur out of pocket expenses, may recover their money, while all other Class Members may collect a flat cash payment as well as Identity Monitoring. SA at ¶¶ 76–78. Thus, the settlement adequately remedies the harms

15 Here, 41 individuals filed timely exclusion requests, and three individuals filed late exclusion requests. See Exclusion Report, Aug. 22, 2025, ECF No. 146-1 (“Exclusion Report”). At the Fairness Hearing, Defendants’ counsel consented to allowing the three individuals who filed late exclusion requests to be excluded from the class. Thus, the total number of individuals who have opted out of this class is 44. incurred by the settlement class members. The lack of any substantial opposition to the proposed Settlement indicates that it is fair, adequate, and reasonable. VI. Attorneys’ Fees and Costs

In this action, Class Counsel have repeatedly requested an attorneys’ fee award of 33.33% of the total settlement fund. See Renewed Fee Mot. at 1; Mot. for Attorneys’ Fees at 1, Feb. 13, 2025, ECF No. 121. For the reasons that follow, the Court finds that a reasonable fee award in this case is 22% of the total settlement fund, specifically, $1,298,000. a. Standard of Review

Rule 23(h) provides that “[i]n a certified class action, the court may award reasonable attorney’s fees and nontaxable costs that are authorized by law or by the parties’ agreement.” Fed. R. Civ. P. 23(h). A prevailing plaintiff under the Fair Debt Collection Practices Act (“FDCPA”) and the Florida Consumer Collection Practices Act (“FCCPA”) may recover “the costs of the action, together with a reasonable attorney’s fee as determined by the court.” See 15 U.S.C. § 1692k(a)(3); Fla. Stat. § 559.77(2). Moreover, the Eleventh Circuit instructs that attorneys who create a

common fund are entitled to be compensated for their efforts from a percentage of that fund. See Camden I Condo. Ass’n v. Dunkle, 946 F.2d 768, 774 (11th Cir. 1991). In Camden, the Eleventh Circuit recognized that the “majority of common fund fee awards fall between 20% and 30% of the fund.” Id. The court noted that “district courts are beginning to view the median of this 20% to 30% range, i.e., 25% as a ‘bench mark’ percentage fee award which may be adjusted in accordance with the individual circumstances of each case.” Camden, 946 F.2d at 775. Nevertheless, the court instructed district courts to “articulate specific reasons for selecting the percentage upon which the attorneys’ fee award is based. The district court’s reasoning should

identify all factors upon which it relied and explain how each factor affected its selection of the percentage of the fund awarded as fees.” Camden, 946 F.2d at 775; see also Johnson v. NPAS Solutions, LLC, 975 F.3d 1244, 1261 (11th Cir. 2020). The Camden court enumerated the following factors for a district court to consider in determining the appropriate percentage of the fund to award as attorneys’ fees: (i) the time and labor required; (ii) the novelty and difficulty of the questions

involved; (iii) the skill requisite to perform the legal services properly; (iv) the preclusion of other employment by the attorney due to acceptance of the case; (v) the customary fee; (vi) whether the fee is fixed or contingent; (vii) time limitations imposed by the client or the circumstances; (viii) the amount involved and the results obtained; (ix) the experience, reputation, and ability of the attorneys; (x) the “undesirability” of the case; (xi) the nature and length of the professional relationship with the client; and (xii) awards in similar cases. Id. at 773 n.3. In addition to the

above factors, the Camden court also listed the following pertinent considerations “the time required to reach a settlement, whether there are any substantial objections by class members or other parties to the settlement terms or the fees requested by counsel, any non-monetary benefits conferred upon the class by the settlement, and the economics involved in prosecuting a class action.” Id. at 775. Although each of the above factors may be an appropriate consideration, “[t]he factors which will impact upon the appropriate percentage to be awarded as a fee in any particular case will undoubtedly vary.” Id. b. Analysis

i. Time, Labor & Skill Required Plaintiffs initiated this action on December 27, 2023. See Stricken Compl., Dec. 27, 2023, ECF No. 1. Approximately 7 months later, Defendants filed a Notice of Settlement on July 29, 2024. See Notice of Settlement. The Notice of Settlement was filed after the parties engaged in limited motion practice involving a motion to dismiss, as well as informal discovery.

Although this case does require knowledge of the issues that are associated with data breaches, this case moved very rapidly to settlement. The parties engaged in limited motion practice as discussed above, avoided formal discovery, and spent two months finalizing the details of the Settlement Agreement. Thus, in light of the short amount of time Class Counsel spent actively litigating this case, the Court views 22% of the Settlement Fund as reasonable compensation for the time and labor expended.

In analyzing this factor, the Court has also engaged in a lodestar “cross check” analysis. See Waters v. Int’l Precious Metals Corp., 190 F.3d 1291, 1298 (11th Cir. 1999) (“[W]hile we have decided in this circuit that a lodestar calculation is not proper in common fund cases, we may refer to that figure for comparison.”); see also In re Home Depot Inc., 931 F.3d 1065, 1091 (11th Cir. 2019) (“Courts often use a cross- check to ensure that the fee produced by the chosen method is in the ballpark of an appropriate fee.”); Brian T. Fitzpatrick, An Empirical Study of Class Action Settlement and Their Fee Awards, 7 J. of Empirical Legal Stud. 811, 833 (2010) (“Fitzpatrick Article”) (observing that in 49% of the 444 settlements studied “district

courts said they considered the lodestar calculation as a factor in assessing the reasonableness of the fee percentages awarded”). Further, the Fitzpatrick Article finds that where courts have used the lodestar as a cross check on the reasonableness of the fee percentages awarded, the lodestar multiplier “ranged from 0.07 to 10.3 with a mean of 1.65 and a median of 1.34.” See id. at 833–34. Here, Class Counsel assert that they have worked “approximately 1,347.45 hours” on this matter and have

expended a total of “$966,866.51” in lodestar. Joint Decl. of Class Counsel in Support of Plaintiffs’ Unopposed Renewed Application for Attorneys’ Fees and Costs at ¶ 19, Jul. 21, 2025, ECF No. 137-3 (“Joint Decl.”). Accepting Class Counsel’s claimed “$966,866.51” in lodestar as true, Class Counsel’s fee request–33.33% of the total Settlement Fund–would result in a multiplier of approximately 2.034. In contrast, awarding a fee of 22%, towards the lower end of the benchmark range, would result in a multiplier of approximately 1.342. Thus, the Court finds the 1.342 multiplier,

which is right at the median articulated in the Fitzpatrick Article, appropriate given the circumstances of this case.16 Additionally, this award is still $331,133.49 more than Class Counsel billed, such that although it is less than what Class Counsel

16 Some portion of Class Counsel’s hours billed were avoidable as the refiling of multiple documents was required due to errors or oversights by Class Counsel. See Feb. 6 Order at 2—7 (discussing various documents that needed to be refiled); see also ECF Nos. 130, 147. requests, it in no way penalizes Counsel for expeditiously reaching a settlement in this case. ii. The Novelty and Difficulty of the Questions Involved

Data breach cases in particular present unique challenges with respect to issues like causation, certification, and damages. In re Citrix Data Breach Litig., No. 19-61350-CIV, 2021 WL 2410651, at *3 (S.D. Fla. June 11, 2021). However, because this case settled so quickly, approximately 7 months from its filing, Class Counsel avoided protracted litigation involving the complexities normally associated with data breach class actions.

iii. The Experience, Reputation, and Ability of the Attorneys

Federal class action litigation requires counsel that are skilled in both the procedural issues surrounding Rule 23 and the federal rules in general, as well as the substantive matters of the legal claims at issue. Here, Class Counsel are experienced in both complex class action litigation as well as data breach actions. See Am. Joint Declaration of Inter[i]m Co-Lead Class [Counsel] in Support of Plaintiffs’ Unopposed Amended Motion for Preliminary Approval of Class Action Settlement and Notice Plan at ¶¶ 36–37, Feb. 13, 2025, ECF No. 121-3 (“Am. Joint Decl.”). Further, Class Counsels’ firm resumes show vast experience in complex class action litigation, including dozens of complex class action cases in which Class Counsel took part. iv. Preclusion of Other Employment by the Attorney Due to Acceptance of the Case

Class Counsel states they had to “for[ego] the opportunity to work on other cases” because of taking on this matter. Joint Decl. at ¶ 11. However, Class Counsel has not specified what work they had to forego because of this case, or why this case caused them to pass up on taking on additional work. See generally Renewed Fee Mot.; Joint Decl. v. The Customary Fee and the Awards in Similar Cases In the Renewed Fee Mot., Class Counsel assert that “[t]he attorneys’ fee award sought here is within the range of fees typically awarded in similar cases in the Eleventh Circuit” and that “[c]ourts within the Eleventh Circuit have routinely awarded attorneys’ fees comprising one-third of the settlement fund in similar data breach class action settlements.” Renewed Fee Mot. at 11–12. The benchmark range

in the Eleventh Circuit for attorneys’ fees awards in class action settlements is between 20% and 30%. See Camden, 946 F.2d at 774; see e.g., In re Home Depot Inc., 931 F.3d at 1076 (“In this Circuit, courts typically award between 20–30%, known as the benchmark range.”); Faught v. Am. Home Shield Corp., 668 F.3d 1233, 1242 (11th Cir. 2011) (“And this court has often stated that the majority of fees in these cases are reasonable where they fall between 20–25% of the claims.”). Additionally, of the 444 class action settlements analyzed in the Fitzpatrick Article the “average award

was 25.4 percent, and the median was 25 percent.” See Fitzpatrick Article at 833. The author concludes the article with his assessment that: “District courts typically awarded fees using the highly discretionary percentage-of-the-settlement method, and fee awards varied over a wide range under this method, with a mean and median around 25 percent.” See Fitzpatrick Article at 845. Turning to the awards in similar cases, Class Counsel cite to various cases that

approved attorneys’ fee request of over 30%, arguing that these cases are “similar” to this case. See Renewed Fee Mot. at 11–12. However, after reviewing the cases cited by Class Counsel, the Court does not find them particularly “similar” to this case. For example, in In re Fortra File Transfer Software Data Sec. Breach Litig., the court noted the settlement was reached after “extensive legal and factual investigation by the Parties” and the settlement came after a full day of mediation and “weeks of

additional negotiations…” In re Fortra File Transfer Software Data Sec. Breach Litig., No. 24-MD-03090-RAR, 2025 WL 457896, at *8 (S.D. Fla. Feb. 11, 2025). In contrast, here the parties did not engage in extensive factual investigation but instead reached an agreement on the “material terms of a settlement” after a one-day mediation session prior to “incurring significant costs” associated with discovery. Joint Decl. at ¶¶ 4, 7. Further, Class Counsel’s citation to Gilbert, et al. v. BioPlus Specialty Pharmacy Servs., is inapposite as the award in that case, while one third

of the Settlement Fund, was substantially less than the award here. Gilbert, et al. v. BioPlus Specialty Pharmacy Servs., LLC, No. 6:21-cv-02158-RBD-DCI at ECF No. 116 (M.D. Fla.) (Jan. 15, 2025) (awarding class counsel $424,128.96 in attorney’s fees and $15,000.00 in expenses).17

17 Additionally, at the Fairness Hearing Class Counsel brought up various cases that they argue support an award of 33.33% in attorneys’ fees. However, after a review of vi. Whether the Fee is Fixed or Contingent

Although not determinative, “[a] contingency fee arrangement often justifies an increase in the award of attorneys’ fees.” In re Sunbeam Sec. Litig., 176 F. Supp. 2d 1323, 1335 (S.D. Fla. 2001) (quoting Behrens v. Wometco Enters., Inc., 118 F.R.D. 534, 548 (S.D. Fla. 1988), aff’d 899 F.2d 21 (11th Cir. 1990)). Because this case was prosecuted by Class Counsel on a purely contingent basis, this factor weighs in favor of a larger fee award. However, while Class Counsel did assume a risk in taking this case, as noted above, the case proceeded relatively quickly to a settlement, with the parties having settled prior to “incurring significant costs associated” with formal

discovery. See Joint Decl. at ¶ 4. A fair amount of the time spent on this case was devoted to finalizing the settlement and seeking both preliminary and final approval of the settlement, where the risk to Class Counsel of not receiving compensation for their time was greatly diminished. See Timesheets at Ex. A–P, Aug. 5, 2025, ECF No. 142.

the cases cited by Class Counsel, the cases all involve different sets of facts with some involving weeks long negotiations and others requesting attorneys’ fees totaling well under $1,000,000. See e.g., In re Arthur Gallagher Data Breach Litig., No. 1:22-cv- 0137 (N.D. Ill.) (Class Counsel negotiated for approximately two years); see also Lomedico, et al., v. MarineMax, Inc., No. 8:24-cv-01784 (M.D. Fla.) (requesting attorneys’ fees totaling $339,000). vii. Time Limitations Imposed by the Client or the Circumstances

Counsel has not indicated that the circumstances were so urgent that it delayed attention to other legal work. See generally Joint Decl. Indeed, following the filing of the Complaint and the Notice of Settlement, this case did not proceed at a particularly rapid or expedited pace and Counsel requested and received multiple extensions of time. See ECF Nos. 102, 110, 123. viii. The amount Involved and the Results Obtained, Including Non-Monetary Benefits

“The result achieved is a major factor to consider in making a fee award.” Pinto v. Princess Cruise Lines, Ltd., 513 F. Supp. 2d 1334, 1342 (S.D. Fla. 2007) (citing Hensley v. Eckerhart, 461 U.S. 424, 436 (1983)). Here, Class Counsel achieved a good Settlement for the Settlement Class Members. Specifically, the Settlement Agreement provides Settlement Class Members with an opportunity to select three years of Identity Monitoring, which is a key benefit given the nature of the data breach incident and the personal identifying information that was exposed. SA at ¶ 78. Additionally, Class Counsel tout that after “a full day of arms-length negotiations, the Parties reached an agreement on the material terms of a settlement to resolve the Action and provide substantial relief to Plaintiffs and Settlement Class Members,” however with a Settlement Class of over 1 million individuals, and the Settlement Administrator’s own estimation of a 1%–4% claims rate for similar cases, it was feasible that Settlement Class Members’ Cash Payment B, of $100, would be pro rata decreased after attorneys’ fees and Settlement Administrator Costs were taken from the Settlement Fund. See Joint Decl. at ¶ 7; Feb. 6 Order at 3–5 (discussing the possible issues regarding an attorneys’ fee request of 33.33% in relation to the estimated number of class members who may file a claim).

ix. The “Undesirability” of the Case

This factor rewards Class Counsel for taking on a case that others were inclined to refuse. In re Sunbeam Sec. Litig., 176 F. Supp. 2d at 1336. (“Such aversion could be due to any number of things, including social opprobrium surrounding the parties, thorny factual circumstances, or the possible financial outcome of the case.”). Class Counsel does not argue that this case was undesirable to other attorneys, nor is there anything in the record that leads to the conclusion that this case was undesirable or avoided by other counsel. See Renewed Fee Mot. at 8–20. x. The Nature and Length of the Professional Relationship with the Client

Class Counsel has not indicated that they previously represented any of the named Plaintiffs in any capacity. Thus, this factor is not relevant to the fee award in this case. xi. The Reaction of the Class As discussed above, only two of the 1,316,512 putative Class Members filed written objections to the Settlement, no one objected at the Fairness Hearing, and only 41 individuals elected to opt-out. See Craft Objection; Jennifer Choi Objection, Jul. 28, 2025, ECF No. 138 (“Choi Objection”); Notice Decl. at ¶ 21. While the Craft Objection has been overruled for the reasons set forth above, the Choi Objection bears on the amount of attorneys’ fees that Class Counsel requests. See Choi Objection. Specifically, Ms. Choi argues that “[a] whopping nearly $2M award for attorneys’ fees seems exorbitant” in “an action intended for [the] benefit of Settlement Class

Members.” Id. However, the Court must look beyond just the size of the attorneys’ fee request in a vacuum and analyze the request based on the criteria discussed above. After analyzing the criteria above and having decided that an attorneys’ fees award of 22% of the total Settlement Fund is adequate, Ms. Choi’s objection is overruled as moot. In light of the foregoing analysis the Court finds 22% of the Settlement Fund

an adequate award of attorneys’ fees in this matter. Given that (1) the parties agreed to the material terms of the settlement in one day, (2) Class Counsel has not adequately shown that they had to forego any other work, (3) the award of 22% falls within the benchmark range in the Eleventh Circuit and is only slightly below the average identified in other class actions, (4) there were no time limitations imposed by the client, and (6) Class Counsel has not shown that this case was undesirable to other attorneys, the Court finds 22% of the Settlement Fund an adequate award of

attorneys’ fees in this matter. VII. Conclusion For the foregoing reasons, Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement and Incorporated Memorandum of Law is granted as the Court finds the Settlement Agreement, and the Superseding Amendment to the Settlement Agreement fair, reasonable, and adequate to warrant final approval. Further, the Court grants Plaintiffs’ Unopposed Renewed Application for Attorneys’ Fees and Costs, in part, to the extent set forth above. Judgment will enter accordingly.

/s/ Claire R. Kelly Claire R. Kelly, Judge*

Dated: September 9, 2025 New York, New York

* Judge Claire R. Kelly, of the United States Court of International Trade, sitting by designation.