IN RE ONIX GROUP, LLC DATA BREACH LITIGATION

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

CIVIL ACTION

IN RE ONIX GROUP, LLC DATA BREACH LITIGATION NO. 23-2288-KSM

MEMORANDUM

Marston, J. December 13, 2024

This is a putative class action brought by Plaintiffs Eric Meyers, Donald Owens, Aida Wimbush, Ashtyn Mark, Leah Simione, Melissa Lyston, and Angela Haynie (“Plaintiffs”). (See Doc. No. 18.) Plaintiffs allege that Defendant Onix Group, LLC (“Defendant”) failed to adequately safeguard sensitive personal information entrusted to it by its customers, despite the foreseeability of a data breach. (Doc. No. 29-1 at 8.) Plaintiffs, on behalf of a putative class, and Defendants have negotiated a settlement agreement to resolve the allegations in the Complaint. On June 14, 2024, the Court granted Plaintiffs’ unopposed motion for preliminary approval of the class and settlement agreement. (Doc. No. 44; Doc. No. 45.) Plaintiffs now seek final approval of the class and settlement agreement. (Doc. No. 46.) In addition, they seek approval of attorneys’ fees, reimbursement of expenses to class counsel, and a service award to Plaintiffs as the class representatives. (Doc. No. 47.) For the reasons below, the Court will approve the terms of the settlement agreement and grant the motion for attorneys’ fees, reimbursement of expenses, and the service award. I. Background A. Procedural History Beginning in June 2023, numerous class actions were filed in this Court on behalf of consumers whose information was stolen following a third party cyberattack against Defendant,

a conglomerate operating in the hospitality, commercial real estate development, and healthcare industries. (See, e.g., Doc. No. 1, Owens v. Onix Group, LLC, Civil Action No. 2:23-cv-2301- KSM; Doc. No. 1, Bernard v. Onix Group, LLC, Civil Action No. 5:23-cv-02556-KSM; Doc. No. 18 at ¶ 2.) On July 19, 2023, this Court consolidated these class actions under the new case name “In re Onix Group, LLC Data Breach Litigation.” (Doc. No. 14.) In the fall of 2023, Plaintiffs filed a consolidated complaint asserting claims for negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and violations of state consumer protection and privacy statutes. (Doc. No. 18.) Plaintiffs alleged that they entrusted Defendant with their sensitive personal information, such as names, addresses, social security numbers, medication information, health insurance information,

and other clinical information, but that Defendant failed to implement adequate security practices to protect the information from cybercriminals. (Id. at ¶¶ 20–24.) Plaintiffs argued that a large depository of highly valuable health care information is a foreseeable target for cybercriminals, and that Defendant should have known that its repository of information for hundreds of thousands of patients posed a significant risk of being targeted for a data breach. (Id. at ¶ 28.) On December 1, 2023, following mediation with an experienced mediator, Bennett G. Picker, Esquire of Stradley Ronon Stevens & Young LLP, the parties agreed to a settlement in principle, and on February 20, 2024, Plaintiffs filed an initial unopposed motion for preliminary approval of the class action settlement. (Doc. No. 29; Doc. No. 29-1 at 9.) On May 15, 2024, the Court held a hearing on the motion, and on May 21, 2024, at the Court’s direction, the parties filed a revised settlement agreement, short-form notice, long-form notice, and claim form. (Doc. No. 34; Doc. No. 35.) Ten days later, at the Court’s further direction to provide additional clarity in the settlement notices and claim form, the parties filed second amended settlement documents.1 (Doc. No. 37.) After receiving these filings, the Court granted preliminary

settlement approval, preliminarily certified a Rule 23 class, and authorized the settlement administrator to notify the class of the settlement. (Doc. No. 45 at 3.) On September 3, 2024, Plaintiffs filed a motion for final approval of the settlement agreement and a motion for an award of attorneys’ fees in the amount of $416,666.66; for litigation costs and expenses in the amount of $12,032; and for service awards to each of the seven class representatives in the amount of $1,000. (Doc. No. 46; Doc. No. 47 at 2.) The Court held a fairness hearing with counsel on November 20, 2024. (Doc. No. 53.) Two class members attended the hearing. B. Settlement Agreement

The settlement agreement identifies the following settlement class: All 308,942 natural persons whose Private Information was compromised in the Data Breach and who have not been confirmed to be deceased. Excluded from the Settlement Class are: (1) the Judges presiding over the Action and members of their immediate families and their staff; (2) Onix, its subsidiaries, parent companies, successors, predecessors, and any entity in which Onix or its parents, have a controlling interest, and its current or former officers and directors; (3) natural persons who properly execute and submit a Request for Exclusion prior to the expiration of the Opt-Out Period; and (4) the successors or assigns of any such excluded natural person.

1 In addition, on June 13, 2024, at the Court’s direction to ensure that deadlines in the settlement agreement were more certain, the parties filed a second amended settlement agreement. (Doc. No. 42.) The parties refiled the settlement agreement on June 14, 2024, to correct a clerical error. (Doc. No. 43.) (Doc. No. 43-1 at ¶ 1.42.) In the settlement agreement, Defendant agreed to create a $1,250,000 non-reversionary settlement fund. (Id. at ¶¶ 1.43, 3.14.) Under its terms, class members have the option to file a claim for one of the following benefits from the settlement fund: (1) class members may claim

12 months of credit monitoring and insurance services (“CMIS”), which includes at minimum three credit bureau monitoring services and $1 million in identity theft insurance; (2) class members may submit a “documented loss payment” claim seeking up to $5,000 per person for the reimbursement of losses supported by reasonable documentation which were more likely than not the result of the data breach at issue; or (3) class members may submit a claim for a pro rata cash payment without any supporting documentation.2 (Id. at ¶ 3.3.) In addition to these benefits, Defendant agreed to “adopt, continue, and/or implement certain data security and privacy improvements designed to protect against similar data security incident in the future.” (Id. at ¶ 2.1.) Defendant has agreed to confirm compliance with these measures to class counsel at their request on an ongoing basis for at least two years. (Id.)

The settlement fund will first be used to pay for administrative expenses, fee award and costs, service awards, and taxes. (Id. at ¶ 3.8.) The remaining amount (the “net settlement fund”) will be used to pay for CMIS, documented losses, and the pro rata cash payments. (Id.) All class members who opt for pro rata cash payment will receive an equal amount, which is calculated by subtracting the costs associated with the first two settlement benefit options from

2 The initial settlement agreement filed listed “documented loss payment” as Option 1, and credit monitoring services as Option 2. (Doc. No. 29-2 at ¶ 3.3(a), (b).) Because awards for credit monitoring services will be paid out prior to awards for documented loss payments (Doc. No. 43-1 at ¶ 3.8), the Court requested that the listed order of settlement payment options be reversed (May 15, 2024 Hr’g Tr. at 14:10–14), and the parties implemented this change in their amended settlement agreement (see Doc. No. 43-1 at ¶ 3.3). The parties also revised the proposed Claim Form, short-form and long-form notice accordingly. (See Doc. Nos. 43-2, 43-3, 43-4.) the net settlement fund, and then dividing the net amount evenly by the total number of claims submitted.3 (Id.) C. Notice On June 25, 2024, defense counsel provided the settlement administrator, the Angeion

Group, LLC (“Angeion”), with a data file containing the names and addresses of the class members. (Doc. No. 46-2 at 1.) About one month later, Angeion mailed the short-form notice to class members via the United States Postal Service (“USPS”). (Id. at 2.) Around 61,000 notices were returned as undeliverable, but Angeion found updated addresses for most of these class members and re-mailed over 40,000 short-form notices. (Id.) Based on these mailing numbers, Angeion calculates that 93.28% of class members were presumed to have been notified successfully. (Id.) In addition to mailing notices, Angeion also activated a case-specific settlement website and toll-free hotline. (Id. at 2–3.) The website received almost 7,000 page views, and the hotline received 861 calls. (Id. at 3.) In total, there were only nine opt-out requests and two objections.4 (Doc. No. 46-2; Doc. No. 48; Doc. No. 54.)

D. Release If this settlement is approved, class members who did not exclude themselves from the settlement will be bound by a release that is tailored to cover the claims that were asserted or that

3 To the extent any amount remains in the net settlement fund more than 120 days after the distribution of all settlement payments, a subsequent settlement payment will be evenly made to all class members who opted for option 3 and who deposited the initial payment they received. (Doc. No. 43-1 at ¶ 3.10.) If the remaining amount left in the settlement fund is not economically distributable—i.e., the amount of payment for each person is less than $3.00—the parties will petition the Court for permission to distribute the remaining funds to a cy pres approved non-profit recipient. (Id.)

4 The Court addresses each objection in Section IV. As explained in that Section, one objection complained about an identity theft that predated the data breach at issue here. (Doc. No. 48.) The other objection was filed over two months past the deadline for objections. (Doc. No. 54.) could have been asserted by the class related to this data breach incident. Specifically, the release is limited to: all Released Claims, including Unknown Claims, against each of the Released Parties, and [the Class Members] agree to refrain from instituting, directing or maintaining any lawsuit, contested matter, adversary proceeding, or miscellaneous proceeding against each of the Released Parties that relates to the Data Incident or otherwise arises out of the same facts and circumstances set forth in the operative Class Action Complaint in this Action. This Settlement releases claims against only the Released Parties. This Settlement does not release, and it is not the intention of the Parties to this Settlement to release, any claims against any third party. Nor does this Release apply to any Class Member who timely excludes himself or herself from the Settlement, or to any Class Member (or the estate of any Class Member) who is deceased.

(Doc. No. 43-1 at ¶ 4.1.) “Released Claims,” in turn, is defined as:

any claim, liability, right, demand, suit, obligation, damage, including consequential damage, loss or cost, punitive damage, attorneys’ fees, costs, and expenses, action or cause of action, of every kind or description—whether known or Unknown (as the term “Unknown Claims” is defined herein), suspected or unsuspected, asserted or unasserted, liquidated or unliquidated, legal, statutory, or equitable—that was or could have been asserted on behalf of the Settlement Class in the Action related to or arising from the Data Incident, regardless of whether the claims or causes of action are based on federal, state, or local law, statute, ordinance, regulation, contract, common law, or any other source, and regardless of whether they are foreseen or unforeseen, suspected or unsuspected, or fixed or contingent, arising out of, or related or connected in any way with the claims or causes of action of every kind and description that were brought, alleged, argued, raised or asserted in any pleading or court filing in the Action.

(Id. at ¶ 1.36.)

II. Final Certification of the Class for Settlement Purposes A. Legal Standard The Court may certify class actions for the sole purpose of settlement. In re CertainTeed Corp. Roofing Shingle Prods. Liab. Litig., 269 F.R.D. 468, 476 (E.D. Pa. 2010) (citing In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 786 (3d Cir. 1995)). When parties present the court with a class settlement agreement, the court must first determine whether the requirements for class certification under Rule 23(a) and (b) are met, and separately determine that the settlement is fair, reasonable, and adequate. Then v. Great Arrow Builders,

LLC, 2:20-CV-00800-CCW, 2022 WL 562807 at *1 (W.D. Pa. Feb. 23, 2022) (citing In re Nat’l Football Players Concussion Injury Litig., 775 F.3d 570, 581 (3d Cir. 2014)). Rules 23(a) and 23(b) of the Federal Rules of Civil Procedure set forth the requirements for class certification. Under Rule 23(a), a class action is allowable only if: (1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a); see also Reyes v. Netdeposit, LLC, 802 F.3d 469, 482 (3d Cir. 2015) (“All potential classes must initially satisfy four prerequisites to be certified: (1) numerosity, (2) commonality, (3) typicality, and (4) adequacy of representation.”). Plus, the class must be currently and readily ascertainable based on objective criteria. Marcus v. BMW of N. Am. LLC, 687 F.3d 583, 593 (3d Cir. 2012). If the Rule 23(a) and ascertainability conditions are met, a case may proceed as a class action if one of the conditions of Rule 23(b) is also satisfied. Here, Plaintiffs seek class certification under Rule 23(b)(3), which requires that “the court find[ ] that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3); see also Reyes, 802 F.3d at 482 (explaining that plaintiff must demonstrate “predominance and superiority” for certification under Rule 23(b)(3)). B. Analysis

Plaintiffs propose a class of: All 308,942 natural persons whose Private Information was compromised in the Data Breach and who have not been confirmed to be deceased. Excluded from the Settlement Class are: (1) the Judges presiding over the Action and members of their immediate families and their staff; (2) Onix, its subsidiaries, parent companies, successors, predecessors, and any entity in which Onix or its parents, have a controlling interest, and its current or former officers and directors; (3) natural persons who properly execute and submit a Request for Exclusion prior to the expiration of the Opt-Out Period; and (4) the successors or assigns of any such excluded natural person.

(Doc. No. 43-1 at ¶ 1.42; Doc. No. 46-1 at 8.) This class is ascertainable and meets all six requirements of Rules 23(a) and 23(b). The Court addresses each in turn. 1. Ascertainability Plaintiffs have the burden of showing, by a preponderance of the evidence, that “(1) the class is ‘defined with reference to objective criteria’; and (2) there is ‘a reliable and administratively feasible mechanism for determining whether putative class members fall within the class definition.’” Byrd v. Aaron’s Inc., 784 F.3d 154, 163 (3d Cir. 2015) (citing Carrera v. Bayer Corp., 727 F.3d 300, 306 (3d Cir. 2013)). The class here is ascertainable because the parties used Defendant’s records to determine the exact number and identities of individuals whose data could have been compromised, and they used public records and related business services to confirm the number of deceased individuals. (Doc. No. 29-1 at 10; Doc. No. 43-1 at ¶ 1.42; May 15, 2024 Hr’g Tr. at 18:9–19:10.) 2. Rule 23(a) Requirements Numerosity

While “[t]here is no magic number of class members needed for a suit to proceed as a class action,” the Third Circuit has held that “numerosity is generally satisfied if there are more than 40 class members.” In re Nat’l Football League Players Concussion Inj. Litig., 821 F.3d 410, 426 (3d Cir. 2016). Here, the proposed class is sufficiently numerous because it consists of over 308,000 people. (Doc. No. 43-1 at ¶ 1.42; Doc. No. 46-1 at 8.) The Court is satisfied that this is more than enough people to render joinder impracticable. Fed. R. Civ. P. 23(a); see Corra v. ACTS Ret. Servs., Inc., No. 22-2917, 2024 WL 22075, at *3 (E.D. Pa. Jan. 2, 2024) (holding that a proposed class of over 20,000 members “easily satisfies the numerosity requirement”). Commonality

As the Third Circuit has explained, “[a] putative class satisfies Rule 23(a)’s commonality requirement if the named plaintiffs share at least one question of fact or law with the grievances of the prospective class.” In re Nat’l Football League Players, 821 F.3d at 426–27 (quoting Rodriguez v. Nat’l City Bank, 726 F.3d 372, 382 (3d Cir. 2013)). It is “easy enough” to meet the requirement when all members of the class have claims that are capable of class-wide resolution. Id. Commonality is met in this case because “the proposed class members all suffered from the same data breach. There are common questions as to how the data breach occurred, whether [Defendant] had a duty to protect [consumers], and whether the [consumers] were harmed by the breach.” Fulton-Green v. Accolade, Inc., No. CV 18-274, 2019 WL 316722, at *3 (E.D. Pa. Jan. 24, 2019). Typicality

There is a “‘low threshold’ for typicality”; provided “the interests of the class and the class representative are aligned,” courts will find typicality even when class members’ claims are only legally similar, and not factually similar. In re Nat’l Football League Players, 821 F.3d at 427–28 (quoting Newton v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 259 F.3d 154, 182–83 (3d Cir. 2001)). The representative Plaintiffs’ claims here are “virtually identical” to those of the class because their claims “arise from the same conduct”—each Plaintiff’s claim “stems from [Defendant’s] security measures and whether they were adequate to protect” the Plaintiff’s sensitive data. In re Wawa, Inc. Data Sec. Litig., No. CV 19-6019, 2023 WL 6690705, at *4 (E.D. Pa. Oct. 12, 2023). Thus, the typicality requirement is met. Adequacy of Representation Courts considering adequacy of representation examine the “qualifications” of both the class representatives and class counsel. In re Nat’l Football League Players, 821 F.3d at 428. First, when considering the adequacy of class representatives, courts seek “to root out

conflicts of interest within the class” and to “uncover conflicts of interest between the named parties and the class they seek to represent.” Id. at 428, 430 (quoting Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 625 (1997)). “A class representative must represent a class capably and diligently,” but this is a low bar: “‘a minimal degree of knowledge’ about the litigation is adequate.” Id. at 430 (quoting New Directions Treatment Servs. v. City of Reading, 490 F.3d 293, 313 (3d Cir. 2007)). “[T]he linchpin of the adequacy requirement is the alignment of interests and incentives between the representative plaintiffs and the rest of the class.” In re Cmty. Bank of N. Va., 795 F.3d at 393 (quoting Dewey v. Volkswagen Aktiengesellschaft, 681 F.3d 170, 183 (3d Cir. 2012)). Here, this requirement is satisfied because the representative Plaintiffs have been actively participating in the litigation of this case by providing documents, answering their lawyer’s questions, and reviewing the complaint and settlement terms. (Doc. No. 46-1 at 13–14.) The Court discerns no conflict of interest between the class representatives and other potential class members—their interests are aligned in attempting to prove the factual

averments in the complaint and establishing Defendant’s liability. (Id.) Second, with respect to class counsel, the important factors are whether the attorneys “(1) possessed adequate experience; (2) vigorously prosecuted the action; and (3) acted at arm’s length from the defendant.” In re GMC, 55 F.3d at 801. The Third Circuit has indicated that courts should consider the non-exhaustive list of factors in Rule 23(g) for appointing counsel in determining the adequacy of representation. See In re Nat’l Football League Players, 821 F.3d at 429. Those factors include counsel’s work in the instant class action, experience in handling class actions or other kinds of complex litigation, knowledge of the applicable laws, and resources available for representing the class. Fed. R. Civ. P. 23(g)(1)(A). The court also “may consider any other matter pertinent to counsel’s ability to fairly and adequately represent the

interests of the class.” Fed. R. Civ. P. 23(g)(1)(B). Here, class counsel—Benjamin F. Johns, Esquire, and Gary M. Klinger, Esquire—are qualified to “fairly and adequately represent the interests of the class.” Fed. R. Civ. P. 23(a)(4). To begin, Johns and Klinger were previously appointed by the Court as interim class counsel and diligently pursued this matter even before their appointment. (Doc. No. 14 at 7.) Indeed, they have collectively spent over 585 hours in diligent pursuit of this case. (Doc. No. 47-1 at 15.) Next, class counsel have substantial experience handling class litigation, including many actions arising from data breaches. (See Doc. No. 29-3.) Last, the parties worked with experienced mediator Bennett Picker, Esquire to facilitate arms’ length negotiations, which also weighs in favor of finding adequacy. See Fulton-Green, 2019 WL 4677954, at *6 (collecting cases). Thus, the Court finds that the proposed class’s interests have been advanced by experienced, dedicated counsel, working at arms’ length from Defendant in accordance with Rule 23(a)(4). ***

In sum, the Court finds that the Rule 23(a) conditions for class certification are met. 3. Rule 23(b)(3) Requirements In addition to meeting the requirements of Rule 23(a), the putative class must also satisfy Rule 23(b)(3), which requires the Court to find that “the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for the fair and efficient adjudication of the controversy.” Fed. R. Civ. P. 23(b)(3). The Court addresses the predominance and superiority requirements in turn. Predominance The key issue under the predominance factor is “whether proposed classes are

sufficiently cohesive to warrant adjudication by representation.” Amchem, 521 U.S. at 623. The Third Circuit has counseled that courts should be “more inclined to find the predominance test met in the settlement context.” In re Nat’l Football League Players, 821 F.3d at 434 (quoting Sullivan v. DB Invs., Inc., 667 F.3d 273, 304 n.29 (3d Cir. 2011) (en banc)). Here, predominance is satisfied. In this data breach litigation, Defendant’s conduct is common to all class members, and all class members were harmed by that conduct. “The issues facing each class member are the same: demonstrating the degree of the [ ] data breach and proving [Defendant’s] culpability.” In re Wawa, 2023 WL 6690705, at *5; (Doc. No. 46-1 at 21–22). Taken together, these common questions of law and fact predominate over individual factual questions, such as the specific degree of damages incurred. See Corra, 2024 WL 22075, at *5 (holding that common questions predominate in certifying the class even though “there may be slight differences among class members regarding degree of damages or the exact type of injury suffered”).

Superiority Last, the parties have demonstrated that “a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). When evaluating this requirement, courts consider “the class members’ interests in individually controlling litigation, the extent and nature of any litigation, the desirability or undesirability of concentrating the litigation, and the likely difficulties in managing a class action.” In re Nat’l Football League Players, 821 F.3d at 435 (citing Rule 23(b)(3)(A)–(D)). Superiority can be satisfied where the settlement prevents “duplicative lawsuits and enables fast processing of a multitude of claims.” Id. (quoting In re Nat’l Football League Players’ Concussion Inj. Litig., 307 F.R.D. 351, 382 (E.D. Pa. 2015)); see also Sullivan, 667 F.3d at 312.

Here, these factors weigh in favor of class litigation. With over 308,000 potential class members and considering the “cost and complexity of the litigation,” many potential plaintiffs would likely “have small claims that would be impractical to litigate on an individual basis.” Corra, 2024 WL 22075, at *5; In re Wawa, 2023 WL 6690705, at *5; (Doc. No. 29-1 at 10). Moreover, “where, as here, the Court is confronted with a request for settlement-only class certification, [the Court] need not inquire whether the case, if tried, would present intractable management problems, see Fed. R. Civ. P. 23(b)(3)(D), for the proposal is that there be no trial.” Corra, 2024 WL 22075, at *5 (quoting Amchem, 521 U.S. at 620) (cleaned up). Thus, superiority is met in this case. ***

For these reasons, the Court finds that the requirements of Rules 23(a) and 23(b)(3) are satisfied, and the class shall be certified. III. Adequacy of Class Notice Because the Court has granted final certification to the class, we must now evaluate the adequacy of notice to the class members. Fein v. Ditech Fin., LLC, No. 5:16-cv-00660, 2017 WL 4284116, at *6 (E.D. Pa. Sept. 27, 2017). For class notice to be adequate, it must meet two requirements. First, Rule 23(c)(2)(B) requires that the class receive “the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.”5 Fed. R. Civ. P. 23(c)(2)(B). Second, principles of due process “require[ ] that notice be ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.’” In re Nat’l Football League Players, 821 F.3d at 435 (quoting Mullane v. Cent. Hanover Bank & Trust Co., 339 U.S. 306, 314 (1950)). The notice documents must provide a

detailed description of the settlement, the circumstances leading to it, and the consequences of objecting or opting out. See In re Diet Drugs Prods. Liab. Litig., 369 F.3d 293, 310–12 (3d Cir. 2004). In granting preliminary approval to the parties’ settlement agreement, the Court found that the notice plan met these requirements. Now that the plan has been executed, the Court sees no reason to change that conclusion. After defense counsel gave Angeion the list of class members’ names and addresses, Angeion sent the short-form notice to class members via first-

5 In addition, Federal Rule of Civil Procedure 23(e)(1) requires the Court to “direct notice in a reasonable manner to all class members” of a proposed settlement agreement. Fed. R. Civ. P. 23(e)(1). Because this requirement overlaps with the requirements of Rule 23(c)(2)(B), the Court considers these requirements together. class mail. (Doc. No. 46-2 at 1–2.) Although 60,897 notices were returned as undeliverable, Angeion located updated addresses for most of these class members and re-mailed about 40,000 short-form notices. (Id. at 2.) Based on these numbers, Angeion calculated that 93.28% of the class members were presumptively notified successfully. (Id.) The Court thus finds that the

notice efforts here satisfied the requirements of Rule 23 and due process because notice via first- class mail was “the best notice practicable under the circumstances and was reasonably calculated to provide actual notice to all class members.” Lunemann v. Kooma III LLC, No. CV 23-3704-KSM, 2024 WL 3744359, at *6 (E.D. Pa. Aug. 8, 2024); see Stechert v. Travelers Home & Marine Ins. Co., No. 17-cv-0784-KSM, 2022 WL 2304306, at *8 (E.D. Pa. June 27, 2022) (finding that the notice effort met the requirements of due process and Rule 23 when there was an 89.84% delivery rate). The Court also finds the content of the notice was sufficient. The short-form notice described the nature of the dispute and settlement benefits, clearly explained how class members may submit a claim for a settlement payment, explained how class members can exclude

themselves from or object to the settlement, and informed class members of the time and location of the final fairness hearing.6 (See Doc. No. 43-3.) The long-form notice, which was available on the settlement website, included additional, consistent information, such as more detailed descriptions of class members’ legal rights and options; information on who is included in the settlement; more detailed information on each of the settlement benefit options; descriptions of

6 Consistent with the Court’s direction, the parties also revised the short-form notice to make it clear that class members are only entitled to one form of compensation, and that the tear-off claim form appended to the short-form notice is only for the pro rata cash payment option. (Doc. No. 43-3 at 2–3.) The long-form notice was also revised to clarify that class members are entitled to only one form of settlement payment and that the prospective relief benefit is for a period of two years; it provides additional detail on how to submit a settlement claim which is consistent with the short-form notice and Claim Form directions. (Doc. No. 43-4 at 3, 6–7.) how the settlement benefits will be paid and attorneys’ fees; and the identities of class counsel. (See Doc. No. 43-4; Doc. No. 43-1 at ¶ 6.7.) These notice documents contained the required information and ensured that “interested parties [were apprised] of the pendency of the action and afford[ed] them an opportunity to present their objections.” In re Nat’l Football League

Players, 821 F.3d at 435 (quoting Mullane, 339 U.S. at 314). In sum, the Court finds that the notice efforts here satisfied the requirements of Rule 23 and due process. IV. Final Approval of the Settlement Agreement Having granted final certification of the Rule 23 class and found notice adequate, the Court now evaluates the fairness of the proposed settlement. A. The GMC, Girsh, and Prudential Factors Under Federal Rule of Civil Procedure 23(e), a court may approve a class action settlement only after “finding that it is fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2).7 District courts have discretion to decide whether to grant final approval to a proposed settlement.

Girsh v. Jepson, 521 F.2d 153, 156 (3d Cir. 1975). Settlements are entitled to “an initial presumption of fairness” if “the court finds that: (1) the negotiations occurred at arm’s length; (2) there was sufficient discovery; (3) the proponents of the settlement are experienced in similar litigation; and (4) only a small fraction of the class objected.” In re GMC, 55 F.3d at 785.

7 The Court is mindful that Federal Rule of Civil Procedure 23(e)(2) enumerates certain considerations for approving a class action settlement that substantially overlap with the Girsh factors. See Hall v. Accolade, Inc., No. 17-3423, 2020 U.S. Dist. LEXIS 52632, at *19 n.12 (E.D. Pa. Mar. 24, 2020) (“The Girsh factors predate the recent revisions to Rule 23, which now explicitly identifies the factors that courts should apply in scrutinizing proposed class settlements, and the earlier discussion in Girsh substantially overlaps with the factors now identified in Rule 23.”). Since the Court previously examined the Rule 23(e) factors at the preliminary settlement approval stage (see Doc. No. 44 at 15–21) and since those factors substantially overlap with the Girsh factors discussed infra, the Court does not address the Rule 23(e) factors again here. However, when, as here, the parties seek settlement approval and final class certification simultaneously, the Court must examine the fairness of the settlement agreement “even more scrupulous[ly] than usual.” In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 534 (3d Cir. 2004).

Here, the Court is satisfied that the proposed settlement meets the criteria for final approval. The settlement agreement is entitled to an initial presumption of fairness because: (1) the parties negotiated the settlement at arms’ length with the assistance of mediator Bennett Picker, Esquire (Doc. No. 29-1 at 18), (2) prior to reaching a settlement, experienced class counsel thoroughly investigated the class members’ claims, conducted lengthy interviews of Plaintiffs and other class members, and reviewed all documents produced by Defendants regarding the security breach (id. at 19), (3) class counsel have significant experience in similar litigation (see supra Section II(b)(ii)), and (4) there were only two objections in a settlement class of over 308,000 people (Doc. No. 43-1 at ¶ 1.42; Doc. No. 48; Doc. No. 54). Thus, the GMC factors weigh in favor of approval, and so an initial presumption of fairness attaches.

Although the settlement is entitled to an initial presumption of fairness, the Court must consider the following factors set forth by the Third Circuit in Girsh v. Jepson to confirm that the settlement is fair, reasonable, and adequate: (1) the complexity, expense and likely duration of the litigation; (2) the reaction of the class to the settlement; (3) stage of the proceedings and the amount of discovery completed; (4) risks of establishing liability; (5) risk of establishing damages; (6) risk of maintaining the class action through the trial; (7) ability of the defendants to withstand a greater judgment; (8) the range of reasonableness of the settlement fund in light of the best possible recovery; and (9) the range of reasonableness of the settlement fund to a possible recovery in light of all the attendant risks of litigation. 521 F.3d 153, 157 (3d Cir. 1975) (quoting City of Detroit v. Grinnell Corp., 495 F.2d 448, 463 (2d Cir. 1974)) (cleaned up). The first factor—complexity, expense, and likely duration of the litigation—is easily met because this “is a complex class action lawsuit regarding damages from a data breach, an area of

law that has not yet been fully developed.” In re Wawa, 2023 WL 6690705, at *7. And, if the litigation were to continue, Plaintiffs and the settlement class would face many challenges and expenses associated with class action litigation, including obtaining class certification, briefing motions for summary judgment, obtaining and defending expert opinions, and maintaining class certification through trial. Id.; (Doc. No. 29-1 at 20.) Thus, the first Girsh factor weighs in favor of approving the final settlement agreement. The second factor—the reaction of the class to the settlement—also favors final approval. In a class over 308,000 people, there were only nine opt outs and two objections. Given this “minimal number of objections and requests for exclusion,” this Girsh factor favors final approval. Sullivan, 667 F.3d at 321.

The third factor—stage of the proceedings and the amount of discovery completed—asks whether “counsel had an adequate appreciation of the merits of the case before negotiating.” In re Warfarin Sodium Antitrust Litig., 391 F.3d at 537. Here, Plaintiffs’ counsel conducted lengthy interviews of Plaintiffs and other class members, reviewed Plaintiffs’ documentation and all documents produced by Defendant related to the data breach, analyzed applicable state laws regarding breaches of consumer information, exchanged informal discovery with Defendant prior to mediation, and exchanged detailed mediation statements. (Doc. No. 29-1 at 19.) Thus, although we are “somewhat early in the litigation process,” class counsel “have adequately developed their case and engaged in a significant degree of case development.” In re Wawa, 2023 WL 6690705, at *8 (holding that the third Girsh factor weighed in favor of approving settlement where case was “somewhat early in the litigation process,” because although the parties conducted only limited discovery, they exerted significant effort in the settlement negotiations). The third factor thus weighs in favor of final approval of the settlement.

The fourth and fifth factors—risks of establishing liability and damages—also favor approval of the settlement. Class counsel demonstrated that there is a risk of establishing liability, and in turn, damages, because this case involves a number of open questions, including whether Defendant owed a duty to the class to safeguard sensitive information, whether Defendant breached that duty, whether the compromised information was actually viewed by bad actors, whether Defendant violated state consumer protection laws, whether Defendant’s conduct was the proximate cause of the breach, and the extent to which the class is entitled to recovery. (Doc. No. 29-1 at 27; May 15, 2024 Hr’g Tr. at 4:14–17, 20:9–21:18.) Thus, the Court finds that the fourth and fifth Girsh factors weigh in favor of approving the settlement. The sixth Girsh factor—the likelihood of maintaining class certification if the action were

to proceed to trial—weighs in favor of approval because there “will always be a ‘risk’ or possibility of decertification.” In re Prudential Ins. Co. Am. Sales Pracs. Litig., 148 F.3d 283, 321 (3d Cir. 1998). The seventh Girsh factor—the likelihood of Defendant to withstand a greater settlement—is “most clearly relevant where a settlement in a given case is less than would ordinarily be awarded but the defendant’s financial circumstances do not permit a greater settlement.” In re Nat’l Football League Players, 307 F.R.D. at 394 (quoting Reibstein v. Rite Aid Corp., 761 F. Supp. 2d 241, 254 (E.D. Pa. 2011)). “However, when there is no ‘reason to believe that [d]efendants face any financial instability[,] . . . this factor is largely irrelevant.’” Id. Here, there is no reason to believe Defendant is financially unstable, so this factor is neutral. Finally, the eighth and ninth factors—the range of reasonableness of the settlement fund in light of the best possible recovery and in light of all the attendant risks of litigation—ask the Court to consider “whether the settlement represents a good value for a weak case or a poor

value for a strong case.” In re Warfarin Sodium Antitrust Litig., 391 F.3d at 538. Here, the settlement is reasonable in light of the best possible recovery and attendant risks of litigation. As discussed above, Plaintiffs face a significant risk in this case because they must prove not only that Defendant owed a duty to Plaintiffs to safeguard their information, but also that their conduct was the proximate cause of that breach. Considering that “class certification is rare in data breach cases” and that Plaintiffs would face significant challenges in maintaining class certification and overcoming the summary judgment hurdle, this settlement for $1.25 million, in addition to injunctive relief in the form of improving and maintaining adequate safeguards for private information for at least two years, is reasonable. Corra, 2024 WL 22075, at *9 (noting that the $350,000 settlement for a data breach class action case was reasonable particularly

where “there is such a high probability that proceeding to trial would yield nothing for the more than 20,000 people whose personal information was potentially accessed through this breach”); Barletti v. Connexin Software, Inc., Case No. 2:22-cv-04676-JDW, 2024 WL 1096531, at *7 (E.D. Pa. Mar. 13, 2024) (holding that a $4 million class action settlement was reasonable in a data breach case of about 3 million consumers’ personal data “given the risks that the Class Reps faced in securing and collecting on a larger judgment, or any judgment at all”). Given the undeniable risks if this litigation were to continue, the final two factors both weigh in favor of approval. In addition to considering the GMC and Girsh factors, the Third Circuit has advised that “when appropriate,” “it may be helpful to expand the Girsh factors” to include non-exclusive factors, such as “whether any provision for attorneys’ fees are reasonable,” and “whether the procedure for processing individual claims under the settlement is fair and reasonable.” In re Pet

Food Prods. Liab. Litig., 629 F.3d 333, 350 (3d Cir. 2010) (quoting In re Prudential, 148 F.3d at 323). Here, these additional factors also weigh in favor of approving the settlement. First, the provision for proposed attorneys’ fees of no more than 33.3% of the settlement is reasonable. (Doc. No. 29-1 at 21); see Barletti, 2024 WL 1096531, at *6 (“Courts in the Third Circuit have identified contingent fee requests of this magnitude as squarely within the range of awards found to be reasonable.” (internal quotations omitted)). Second, class members were given the right to opt out of the settlement (Doc. No. 43-1 at ¶ 6.8), and the procedure for processing individual claims under the settlement was fair and reasonable because the settlement provided for notice to the class member if their claim form is deficient and afforded a 30-day period to cure any such

defect (id. at ¶¶ 3.3, 3.6). And, any claims for documented losses that are rejected by the settlement administrator will be converted into a claim for a pro rata cash payment. (Id. at ¶ 3.3(a).) * * * Accordingly, the Court finds the GMC, Girsh, and Prudential factors all weigh in favor of finding the class action settlement “fair, reasonable, and adequate.” B. Consideration of the Two Objections Under Federal Rule of Civil Procedure 23(e)(5), “[a]ny class member may object to the proposal if it requires court approval under [Rule 23(e)].” Fed. R. Civ. P. 23(e)(5). So, before a court can approve a class settlement, it must first consider objections to that settlement. See Yaeger v. Subaru of Am., Inc., No. 114CV4490JBSKMW, 2016 WL 4541861, at *13 (D.N.J. Aug. 31, 2016). Here, there were two objections filed. (See Doc. No. 48; Doc. No. 53.) As explained below, however, neither objection changes the Court’s conclusion that the settlement

is fair, reasonable, and adequate. Objection 1: Christa Branin’s Objection. On August 30, 2024, Christa Branin “objected to the settlement agreement because [she] was not involved in this incident in any way, shape or form.” (Doc. No. 48 at 1.) She explained that someone had used her “identity to seek treatment at one of Onix’s umbrella companies” and asked that the “appropriate legal remedies be taken to rectify [her] situation.” (Id.) Although she styles her letter to the Court as an objection to the settlement agreement, her complaint centers around an identity theft that predates the data beach at issue in this case. (See id.) So, the Court overrules her objection because is not a true objection to this settlement.8 Objection 2: Kevin Watson’s Objection. On November 29, 2024, Kevin Watson filed an

untimely objection to the settlement agreement. (Doc. No. 54.) Under the terms of the settlement agreement, objections were due September 17, 2024. (Doc. No. 43-1 at ¶ 6.9.) Thus, the Court could strike his objection on timeliness grounds. See e.g., In re Auto. Parts Antitrust Litig., No. 2:12-CV-00203, 2017 WL 3499291, at *7 (E.D. Mich. July 10, 2017) (“Courts routinely strike objections to class action settlements that are filed after the objection deadline.” (collecting cases)). But even after considering the merits of his objection, the Court still finds that the

8 At the fairness hearing, the Court instructed class counsel to reach out to Ms. Branin to explain the situation to her. Class counsel emailed Ms. Branin and offered her a chance to submit a late claim, but she declined to do so. (Doc. No. 56 at 3–4.) settlement is fair, reasonable, and adequate. In his objection, Mr. Watson argues that the settlement does not do enough for class members and should be “rejected as unfair and unreasonable.” (Doc. No. 54 at 1–2.) His argument—that the settlement should have been better—has been frequently rejected by courts. See, e.g., Hughes v. Microsoft Corp., No. C93-

0178C, 2001 WL 34089697, at *10 (W.D. Wash. Mar. 26, 2001) (“An objection that the settlement could have been better . . .does not mean the settlement presented [is] not fair, reasonable or adequate.” (internal quotations omitted)); Yaeger, 2016 WL 4541861 at *17 (rejecting objections that asked the court to impose a better settlement because “[t]here is no middle ground of inserting or deleting terms at the request of an objector based on the judge's conception of what would be more fair, reasonable, or adequate”). Plus, the Court conducted a thorough analysis of the settlement agreement at the preliminary approval hearing, in a detailed memorandum, and again at the final approval hearing. At each stage, the Court found that this settlement was fair, reasonable, and adequate, especially considering the substantial challenges that Plaintiffs would face if this litigation were to continue. Last, the Court finds that Mr.

Watson’s fear that each class member will get only “3 or 4 dollars” is unfounded because class members will receive “significantly more than that” based on the number of claims submitted. (See Doc. No. 54 at 2; Doc. No. 56 at 2.) So, the Court overrules his objection. The Court has considered the two objections and finds that they do not “undermine the overall fairness, reasonableness, and adequacy of the proposed settlement.” Yaeger, 2016 WL 4541861, at *17. Accordingly, they are overruled.

* * * The settlement agreement is fair, reasonable, and adequate, and does not otherwise reveal any deficiencies. It is entitled to a presumption of fairness, and that presumption is supported by the Girsh and Prudential factors. The Court further considered the two objections in this case and found that neither “undermine[s] the overall fairness, reasonableness, and adequacy of the proposed settlement.” Yaeger, 2016 WL 4541861, at *17. V. Approval of Service Award to the Class Representatives

Plaintiffs request approval of a $1,000 service award to each of the seven class representatives. (Doc. No. 47-1 at 20–21.) They argue that a total service award of $7,000 is reasonable because “[e]ach of these Plaintiffs actively participated in the litigation and settlement of this matter – they participated in Plaintiffs’ counsel’s lengthy interviews and provided relevant documents to counsel.” (Id. at 20.) As explained below, the Court will reduce their service award to $500 each for a total service award of $3,500. “There is substantial precedent from [the Third] Circuit supporting approval of incentive payments.” See Somogyi v. Freedom Mortg. Corp., 495 F. Supp. 3d 337, 353–54 (D.N.J. Oct. 20, 2020) (collecting cases). “Factors that courts consider in deciding to grant incentive awards include: the risk to the plaintiff in commencing litigation, both financially and otherwise; the

notoriety and/or personal difficulties encountered by the representative plaintiff; the extent of the plaintiff’s personal involvement in the lawsuit in terms of discovery responsibilities and/or testimony at depositions or trial; the duration of the litigation; and the plaintiff’s personal benefit (or lack thereof) purely in his capacity as a member of the class.” Young v. Tri Cnty. Sec. Agency, Inc., No. 13-5971, 2014 WL 1806881, at *8 (E.D. Pa. May 7, 2014) (citing In re Plastic Tableware Antitrust Litig., Civ. A. No. 94–3564, 1995 WL 723175, at *2 (E.D. Pa. Dec. 4, 1995)). Although the Court appreciates the time and effort put into this case by the named Plaintiffs, the Court finds that the proposed service award is slightly high given their actual involvement in this class action lawsuit. This case settled at a relatively early stage in the litigation, Plaintiffs were not deposed, and they did not attend the Court’s hearings on the preliminary and final settlement approval. See Erby v. Allstate Fire & Cas. Ins. Co., No. CV 18- 4944-KSM, 2022 WL 14103669, at *17 (E.D. Pa. Oct. 24, 2022) (lowering a proposed service

award because Plaintiff “did not sit for a deposition” and there was “no indication that he was particularly involved in this litigation”); Lunemann, 2024 WL 3744359, at *11 (reducing proposed service award because Plaintiff was not deposed and did not attend the Court’s hearing on preliminary settlement approval, and the case settled at a relatively early stage in the litigation); Altnor v. Preferred Freezer Servs., Inc., 197 F. Supp. 3d 746, 771 (E.D. Pa. 2016) (decreasing service award in part because “there is no indication that the Named Plaintiffs were deposed, attended any settlement negotiations or court proceedings, . . . or expended any other resources to advance the case”); Romero v. La Revise Assocs., 58 F.Supp.3d 411, 422 (S.D.N.Y. 2014) (lowering service award in part because the named plaintiff was not deposed and did not attend the mediation or any court proceedings). So, the Court will reduce their service award to

$500 each for a total service award of $3,500. VI. Approval of Attorneys’ Fees Plaintiffs also request approval of attorneys’ fees in the amount of $416,666.66. (Doc. No. 47-1 at 6.) “In a certified class action, the court may award reasonable attorneys’ fees and nontaxable costs that are authorized by law or by the parties’ agreement.” Fed. R. Civ. P. 23(h). Attorneys’ fees may be calculated using either the percentage-of-recovery method or the lodestar method. See Halley v. Honeywell Int’l, Inc., 861 F.3d 481, 496 (3d Cir. 2017). Where, as here, the settlement funds come from a common fund, courts generally evaluate the attorneys’ fees’ reasonableness using the percentage-of-recovery method, with a lodestar crosscheck. Id. A. Percentage-of-Recovery Method “The percentage-of-recovery approach compares the amount of attorneys’ fees sought to the total size of the fund.” Id. In determining whether the requested fees are reasonable under

the percentage-of-recovery method, the Court considers seven factors: (1) the size of the fund created and the number of persons benefitted; (2) the presence or absence of substantial objections by members of the class to the settlement terms and/or the fees requested by counsel; (3) the skill and efficiency of the attorneys involved; (4) the complexity and duration of the litigation; (5) the risk of nonpayment; (6) the amount of time devoted to the case by counsel; and (7) awards in similar cases.

Gunter v. Ridgewood Energy Corp., 223 F.3d 190, 195 n.1 (3d Cir. 2000). Courts also generally consider three additional factors: (8) [T]he value of benefits attributable to the efforts of class counsel relative to the efforts of other groups, such as government agencies conducting investigations, (9) the percentage fee that would have been negotiated had the case been subject to a private contingent fee arrangement at the time counsel was retained, and (10) any innovative terms of settlement.

In re Diet Drug, 582 F.3d 524, 541 (3d Cir. 2009) (citing In re Prudential Ins. Co. Am. Sales Practice Litig. Agent Actions, 148 F.3d 283, 338 (3d Cir. 1998)). Class counsel request approval of attorneys’ fees in the amount of $416,666.66, which represents approximately 33.33% of the monetary value of the settlement. (Doc. No. 47-1 at 6.) As noted above, the settlement also provides for injunctive relief that cannot be quantified, but it represents additional recovery for the settlement class and future consumers whose data will be entrusted to Defendant. The Court reviews each of the Gunter/Prudential factors below. Factor 1: Size of the Fund Created and Number of Beneficiaries. The first factor weighs in favor of approval because the $1,250,000 non-revisionary settlement fund gives class members a significant benefit. Under the terms of the settlement, class members could elect to receive one year of CMIS, a claim for documented losses up to $5,000, or a pro rata cash payment. (Doc. No. 43-1 at ¶ 3.3.) In addition, Defendant agreed to “adopt, continue, and/or implement certain data security and privacy improvements designed to protect against similar

data security incident in the future.” (Id. at ¶ 2.1.) The sizable fund, coupled with the injunctive relief, leads the Court to conclude that this factor supports the award of the requested fees. See Mirakay v. Dakota Growers Pasta Co., Inc., Civil Action No. 13–cv–4429 (JAP), 2014 WL 5358987, at *13 (D.N.J. Oct. 20, 2014) (finding this factor weighed in favor of reasonableness because “an even broader spectrum of persons, whether class members or not, will benefit from the injunctive provisions of the settlement”). Factor 2: Presence or Absence of Substantial Objections. The second factor also weighs in favor of approval. In a class over 308,000 people, there were only nine opt outs and two objections. Given this small number of objections and opt outs, the Court finds that this factor weighs in favor of approval too. See Nguyen v. Educ. Computer Sys., Inc., No. 2:22-CV-1743,

2024 WL 3691614, at *2 (W.D. Pa. Aug. 7, 2024) (finding this factor favored approval because in a class of over 537,000 people, “only two objections were asserted, and both were withdrawn prior to the . . . final approval hearing”). Factor 3: Skill and Efficiency of Attorneys Involved. Class counsel is skilled, experienced, and efficiently litigated this matter. Indeed, class counsel have substantial experience handling class litigation, including many actions arising from data breaches. (See Doc. No. 29-3.) In preliminarily approving the settlement, the Court found that Benjamin F. Johns, Esquire, and Gary M. Klinger, Esquire, were competent to serve as class counsel. (Doc. No. 44 at 10.) Nothing has changed to undermine the Court’s confidence in their ability. So, this factor is satisfied. Factor 4: Complexity and Duration of Litigation. The fourth factor favors the attorneys’ fee request because a “data breach class action,” like this one, “presents [complex] issues on the

duty of care . . . in storing their personal information, Article III standing in the context of improper disclosure, types of damages available at trial; and, whether the plaintiffs can obtain and maintain class certification.” Fulton-Green, 2019 WL 4677954, at *13. Plus, class counsel have litigated this case for well over a year. (Doc. No. 47-1 at 13.) They have conducted lengthy interviews of Plaintiffs and other class members, exchanged key informal discovery with Defendant before mediation, and reviewed documents produced by Defendant about the data breach. (Doc. No. 47-1 at 13.) Thus, this factor is met here. Factor 5: Risk of Nonpayment. The fifth factor also favors approval because class counsel pursued this litigation on a contingency fee basis and advanced significant out-of-pocket expenses to advance this case. (See Doc. No. 47-2 at 3; Doc. No. 47-3 at 3; Doc. No. 47-4 at 3;

Doc. No. 47-5 at 3; Doc. No. 47-6 at 3; Doc. No. 47-7 at 3; Doc. No. 47-8 at 3; Doc. No. 47-9 at 3.). “Taking such a risk on behalf of the class lends credence to the fee request . . . and thus this factor supports approval.” Corra, 2024 WL 22075, at *14. Plus, data breach cases are inherently risky and present unique challenges to establish standing and obtain class certification. See Fulton-Green, 2019 WL 4677954, at *13. So, there was a real risk of nonpayment, and thus this factor favors approval. Factor 6: Time Devoted by Class Counsel. The sixth factor likewise favors approval because class counsel spent over 585 hours in pursuit of this litigation. (Doc. No. 47-1 at 15;) see Fulton-Green, 2019 WL 4677954, at *13 (finding this factor met because “class counsel have spent more than 560 hours on this [data breach] litigation”). Factor 7: Awards in Similar Cases. The seventh factor also favors approval. Courts using the percentage-of-recovery method to calculate attorneys’ fees generally approve fees

ranging “from roughly 20–45%.” Marby v. Hildebrandt, No. 14-cv-5525, 2015 WL 5025810, at *4 (E.D. Pa. Aug. 24, 2015) (collecting cases). Class counsel have requested roughly 33% of the distribution to the settlement class. (Doc. No. 47 at 2.) Because courts regularly approve fee awards around this size, this factor is met here. See Fein, 2017 WL 4284116, at *12 (finding a fee award that represented 33% of the settlement reasonable). Factor 8: Value of Benefits Attributable to the Efforts of Class Counsel. The eighth factor supports the fee request because “[t]here is no indication that any other groups, such as government agencies conducting investigations, have contributed to this case and Settlement.” Corra, 2024 WL 22075, at *15; see also Pinnell v. Teva Pharms. USA, Inc., No. 19-cv-5738, 2021 WL 5609864, at *1 n.2 (E.D. Pa. June 11, 2021) (finding that this factor weighed in favor

of awarding the requested fees where there was no evidence that anyone other than class counsel initiated the action). Factor 9: Percentage that Would Have Been Awarded in Private Contingency Arrangement. The ninth factor supports the fee request because class counsel requests 33.33% of the distribution to the class, which tracks the median attorneys’ fees in class actions. See Boone v. City of Philadelphia, 668 F. Supp. 2d 693, 714 (E.D. Pa. 2009) (explaining that the median attorneys’ fee award in class actions is one-third, or 33%); (Doc. No. 47 at 2). Factor 10: Innovative Terms of Settlement. The Court finds that the final factor is neutral. Although the injunctive relief, credit monitoring, document loss repayment, and pro rata cash payment will help the class, the Court does not find these terms particularly innovative. So, “this factor neither weighs in favor nor detracts from a decision to award attorneys’ fees.” In re Processed Egg Prods. Antitrust Litig., No. 08–md–2002, 2012 WL 5467530, at *6 (E.D. Pa. Nov. 9, 2012).

In sum, the Court finds that the Gunter/Prudential factors weigh in favor of the requested attorneys’ fees. B. Lodestar Crosscheck The Third Circuit has recommended that courts crosscheck the reasonableness of the requested attorneys’ fees using the lodestar method. Gunter, 223 F.3d at 195 n.1. “The purpose of the cross-check is to ensure that the percentage approach does not result in an ‘extraordinary’ lodestar multiple or windfall.” Whiteley v. Zynerba Pharms., Inc., No. CV 19-4959, 2021 WL 4206696, at *13 (E.D. Pa. Sept. 16, 2021) (quoting In re Cendant Corp. Litig., 264 F.3d 201, 285 (3d Cir. 2001)). “The lodestar method ‘multiplies the number of hours counsel worked on the case by a reasonable hourly billing rate for such services,’ and compares that amount to the

attorneys’ fees sought.” Halley, 861 F.3d at 496 (quoting Sullivan, 667 F.3d at 330). Class counsel report that they spent a total of 587.32 hours in pursuit of this litigation up until August 7, 2024. (Doc. No. 47-1 at 18.) That billable hour’s amount yields a collective lodestar of $431,518.55. The chart below summarizes the time invested by the various firms that have worked on this case. Firm Hours Lodestar Document Number Shub & Johns LLC 212.42 $164,548.85 (Doc. No. 47-2) Milberg Coleman Bryson 182 $149,469.40 (Doc. No. 47-3) Phillips Grossman, PLLC Almeida Law Group LLC 31.8 $21,280.50 (Doc. No. 47-4) Fine, Kaplan & Black 22.3 $11,840 (Doc. No. 47-5) RPC Siri & Glimstad LLP 55.3 $21,239 (Doc. No. 47-6)

Evangelista Worley, LLC 18 $14,014 (Doc. No. 47-7) Sterlington PLLC 39.50 $36,509.30 (Doc. No. 47-8) Mason LLP 26 $12,617.50 (Doc. No. 47-9) Totals 587.32 $431,518.55

This chart does not account for any billable time that class counsel have spent on this case since August 7, 2024. (Doc. No. 47-1 at 18.) Since then, class counsel have worked on their brief in support of final approval, prepared for the final approval hearing, and responded to an untimely objection. (See Doc. No. 46; Doc. No. 47; Doc. No. 56.) Plus, they will have to oversee the claims administration process. So, their total amount of billable hours and lodestar will be higher than the reported amount. See In re Suboxone (Buprenorphine Hydrochloride & Naloxone) Antitrust Litig., No. 13-MD-2445, 2024 WL 815503, at *17 (E.D. Pa. Feb. 27, 2024) (“In addition [to the billable time already expended], Class Counsel will undoubtedly need to spend additional hours in order to monitor and administer the Settlement and final closing of this

case.”). The Court finds that class counsel’s total billable hours are reasonable. Class counsel spent under 600 hours working on this case. (Doc. No. 47-1 at 18.) Their time was spent on research and drafting the initial complaint and consolidated amended complaint, exchanging pre- mediation discovery, preparing for and participating in mediation, negotiating and drafting the settlement agreement, engaging in a competitive bidding process to select a settlement administrator, and communicating and coordinate with the settlement administrator to facilitate the notice and claims processes. (Doc. No. 47-2 at 1–2.) Plus, as noted above, class counsel will spend additional time to monitor and administer the settlement. Thus, the Court finds that the total number of billable hours are reasonable.

The Court further finds that class counsel’s hourly rates are reasonable. The hourly rates charged by class counsel appear to track the “position, experience, level, and location” of the lawyers and paralegals with the highest rate at $1057 per hour for David Lietz, Esquire and other hourly rates “progressively working downward.” In re Suboxone, 2024 WL 815503, at *17; (Doc. No. 47-3 at 3). Courts in this circuit have found similar rates reasonable. See, e.g., Fulton-Green, 2019 WL 4677954, at *12 (concluding that class counsel’s rates were reasonable when they ranged from $202 to $975 per hour); In re Suboxone, 2024 WL 815503, at *17 (concluding that class counsel’s rates were within the reasonable range for their experience and for the region when “the highest rate was at $1550 per hour”); Se. Pa. Transp. Auth. v. Orrstown Fin. Servs., Inc., et al., No. 12-cv-00993 (M.D. Pa. May 19, 2023) (Doc. No. 304; Doc. No. 309)

(granting final approval and award of attorneys’ fees, approving hourly rates of up to $1,100, where several attorneys’ rates were at or above $875). The lodestar crosscheck yields a negative multiplier of roughly 0.96 because the lodestar ($431,518.55) is higher than the requested fee ($416,666.66). “A lodestar multiplier of less than one, like the lodestar multiplier here, reveals that the fee request constitutes only a fraction of the work that the attorneys billed and thus favors approval.” Altnor, 197 F. Supp. 3d at 767 (citing Carroll v. Stettler, No. 10–2262, 2011 WL 5008361, at *8 (E.D. Pa. Oct. 19, 2011)). So, the Court finds that the lodestar cross check also counsels in favor of approving the requested attorneys’ fees. * * * Having considered the Gunter/Prudential factors and the lodestar crosscheck, the Court finds that the fee request of $416,666.66 is reasonable. Thus, the Court will approve a payment of $416,666.66 to class counsel as attorneys’ fees. VII. Approval of Class Counsel’s Expenses Class counsel last request that the Court approve their reimbursement request of $12,032

in litigation fees. (Doc. No. 47-1 at 19–20.). These expenses include filing fees, mediation, travel, postage, and electronic research costs. (Doc. No. 47-2 at 4; Doc. No. 47-3 at 3–4; Doc. No. 47-4 at 3; Doc. No. 47-5 at 3–4; Doc. No. 47-6 at 4; Doc. No. 47-9 at 4.) These expenses are reasonable, and no class member objected to the reimbursement of these expenses, so the Court will grant class counsel’s request for reimbursement. See Erby, 2022 WL 14103669, at *17 (approving “reimbursement for $22,004.82 in out-of-pocket litigation expenses”); see also Stechert, 2022 WL 2304306, at *15 (approving fee request for $22,004.82 in litigation expenses, which “include[d] filing fees, service of process fees, expert and professional services fees, deposition expenses, PACER research, travel fees, and administrative expenses such as printing, photocopies, and similar items”).

VIII. Conclusion For the reasons above, the Court grants Plaintiffs’ motion for final approval of the class settlement agreement and approves Plaintiffs’ request for an award of attorneys’ fees, reimbursement of expenses to class counsel, and a service award in the revised amount of $500 to each class representative. An appropriate order follows.