Kenneth Hasson, individually and on behalf of all others similarly situated v. Comcast Cable Communications LLC, Comcast Corporation, Citrix Systems, Inc., and Cloud Software Group, LLC

Opinion

UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

KENNETH HASSON, individually and on Master File No. 2:23-cv-05039-JMY behalf of all others similarly situated,

Plaintiff,

v.

COMCAST CABLE COMMUNICATIONS LLC, COMCAST CORPORATION, CITRIX SYSTEMS, INC., and CLOUD SOFTWARE GROUP, LLC,

Defendants.

This Document Relates to: All Actions

MEMORANDUM Younge, J.

Currently before the Court is Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement and Memorandum of Law in Support. (ECF No. 315). Also before the Court is Plaintiffs’ Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards. (ECF No. 286). The Court held a Final Approval Hearing on August 5, 2026. For the reasons that follow, the Motions will be granted in part, the objections will be overruled, and the Settlement will be finally approved as fair, reasonable, and adequate. I. PROCEDURAL AND FACTUAL BACKGROUND Plaintiffs are current and former Comcast customers whose personal information was compromised in a data breach of Comcast’s systems in October 2023. In their First Amended Consolidated Class Action Complaint (“Am. Compl.” or “Complaint”), ECF No. 139, Plaintiffs allege that between October 16 and October 19, 2023, cybercriminals exploited the “Citrix Bleed” vulnerability (CVE-2023-4966) in Comcast’s Citrix NetScaler appliances and acquired the personal information of over 31 million former and current Comcast customers, including names, contact information, dates of birth, the last four digits of Social Security numbers, secret questions and answers, and, for some Class Members, full Social Security numbers and driver’s license

numbers (the “Data Breach”). (Am. Compl. ¶¶ 1, 3, 314–18.) Plaintiffs claim that Comcast failed to timely install the patch Citrix had made available; that Citrix failed to adequately test and monitor its NetScaler product; and that both Defendants’ conduct exposed Class Members to actual and attempted identity theft, fraud, and a substantial risk of further injury. (Id. ¶¶ 5, 8–10, 13–172.) Plaintiffs assert 23 causes of action, including state common law claims, state statutory claims, and claims under the federal Cable Communications Policy Act (“Cable Act”), 47 U.S.C. § 551. Defendants deny all allegations of wrongdoing. On December 19, 2023, Plaintiff Kenneth Hasson filed the first-filed Class Action Complaint against Comcast in this Court. (ECF No. 1.) More than twenty related actions were filed across six districts and were consolidated in this District after voluntary transfers under 28 U.S.C.

§ 1404(b) or refiling. (Prelim. Approval Counsel Decl. ¶¶ 4, 9, ECF No. 275-4.) On March 27, 2024, then-Chief Judge Mitchell S. Goldberg consolidated the actions before this Court. (ECF No. 14.) The Judicial Panel on Multidistrict Litigation subsequently dismissed as moot Plaintiff Hasson’s motion to centralize. (JPML MDL No. 3099, ECF No. 84.) On May 15, 2024, the Court entered Case Management Order No. 2, appointing Interim Co-Lead Class Counsel Gary F. Lynch of Lynch Carpenter LLP and Norman E. Siegel of Stueve Siegel Hanson LLP, Co-Liaison Counsel James A. Francis of Francis Mailman Soumilas, P.C. and Charles E. Schaffer of Levin Sedran & Berman LLP, and a Plaintiffs’ Executive Committee. (ECF No. 51.) After thorough factual investigation, Class Counsel filed the Consolidated Class Action Complaint on July 1, 2024. (ECF No. 67.) Defendants filed motions to dismiss the Consolidated Complaint on August 15, 2024. (ECF Nos. 83, 84.) The Parties fully briefed the motions and Comcast’s motion to strike portions of Plaintiffs’ opposition through November 20, 2024. (ECF Nos. 99, 101, 103, 104, 112, 114.) On

January 24, 2025, Plaintiffs filed the First Amended Consolidated Class Action Complaint, adding a Named Plaintiff and incorporating additional factual allegations from Class Counsel’s continuing investigation. (ECF No. 139.) On February 14, 2025, Defendants filed renewed motions to dismiss (ECF Nos. 158, 160, 161), in which Comcast brought a Rule 12(b)(1) factual challenge to Article III standing, supported by declarations from Comcast’s Vice President of Product Security and Privacy and Zero Fox’s Vice President of Intelligence. That factual challenge opened targeted jurisdictional discovery, in the course of which Class Counsel deposed three Comcast employees or declarants, retained three purported experts (David Nelson, a former FBI cybercrime agent; Matthew Strebe, Chief Information Security Officer; and Matthew O’Neill, a former Deputy Special Agent of Cyber Operations, U.S. Secret Service), obtained declarations from each Named

Plaintiff, and filed a robust opposition brief. (ECF No. 193.) Class Counsel also moved to strike Comcast’s declarations under Federal Rules of Evidence 602, 701, and 702 (ECF No. 191), and later defended their three purported experts against Defendants’ Daubert challenges (ECF Nos. 222, 239, 253). Merits discovery ran parallel. In total, the Parties conducted twenty-one depositions, including three Comcast Rule 30(b)(6) and merits designees, all Named Plaintiffs, and Plaintiffs’ three purported experts. Class Counsel reviewed approximately 8,000 pages of documents produced by Defendants, responded to multiple sets of written discovery, produced hundreds of documents, and conducted third-party discovery on IDX (the initial credit monitoring provider selected by Comcast). (Counsel Fee Decl. ¶¶ 15, 22, 39, 62, 65, ECF No. 286-2) Settlement was ultimately reached through five separate mediation sessions covering six full days before the Honorable Diane M. Welsh (Ret.) of JAMS, a former Magistrate Judge of this District. (Counsel Fee Decl. ¶¶ 17, 24.) The Parties met with Judge Welsh on August 19, 2024;

March 12–13, 2025; October 10, 2025; November 6, 2025; and November 20, 2025. The Parties reached an agreement in principle with Comcast on October 10, 2025, and achieved global resolution releasing all Defendants on November 20, 2025. On December 23, 2025, Plaintiffs filed the Unopposed Motion for Preliminary Approval of Class Action Settlement. (ECF No. 275.) On January 16, 2026, the Court entered the Order Preliminarily Approving Class Action Settlement, provisionally certifying the Settlement Class, appointing Class Counsel and Settlement Class Representatives, approving Kroll Settlement Administration LLC as Settlement Administrator and CyEx as the provider of Identity Defense Services and Restoration Services, and directing that notice commence 90 days following the entry of the Preliminary Approval Order. (ECF No. 278.) The Court initially set an objection and

exclusion deadline of June 1, 2026, and a Final Approval Hearing for July 7, 2026. (Id. ¶ 22.) Upon the Parties’ motion, the Court extended the objection and exclusion deadline to July 1, 2026, and continued the Final Approval Hearing to August 5, 2026. (ECF No. 287.) Following preliminary approval, notice was disseminated to the Settlement Class in accordance with the Court-approved Notice Plan. (Settlement Administrator Decl. (“Settlement Admin. Decl.”) ¶¶ 4–21.) As of the July 1, 2026 Objection and Exclusion Deadline, approximately 745 Settlement Class Members (0.0024%) submitted valid requests for exclusion, and 15 (0.00005%) Settlement Class Members filed timely objections to the Settlement or Class Counsel’s motion for an award of attorneys’ fees, expenses, and service awards. (Settlement Admin. Decl. ¶ 26; Class Counsel Decl. in Support of Final Approval (“Class Counsel Decl.”) ¶ 7.). Five submissions filed as objections were submitted by individuals who are not members of the Settlement Class: Carol Haverty (ECF No. 310); Joseph John Varga (ECF No. 281); Thomas E. Sims (letter to Class Counsel; not docketed); Phillip B. Sollon (ECF No. 297); and Joy Thomas

(ECF No. 296). As of July 15, 2026, Kroll has received just under 1 million claims from Settlement Class Members. (Settlement Admin. Decl. ¶ 23.) II. SUMMARY OF THE PROPOSED SETTLEMENT AGREEMENT A. The Settlement Class Under the terms of the Settlement Agreement, the Settlement Class is defined as: All persons residing in the United States and its territories who were sent individual notification of the Data Breach, which occurred in October 2023, and was publicly disclosed by Comcast in December 2023. (Settlement Agreement ¶ 2.36, ECF No. 275-2.) Excluded from the Settlement Class are: (1) Comcast, any entity in which Comcast has a controlling interest, and Comcast’s officers, directors, employees, legal representatives, successors, subsidiaries, and assigns; (2) any judge, justice, or judicial officer presiding over the Action and members of their immediate families and judicial staff; (3) any individual who timely and validly opts out of the Settlement; and (4) all individuals who, on or before the filing of Plaintiffs’ Motion for Preliminary Approval, either (a) filed a written arbitration demand or petition against Comcast relating to the Data Breach but have not signed a release of their claims against the Released Parties, (b) provided written notice to Comcast that they are currently represented by counsel for an arbitration claim related to the Data Breach but have not signed a release of their claims against the Released Parties, or (c) released their claims against the Released Parties. (Id.) B. Benefits Established by the Settlement Agreement 1. The Settlement Fund The Settlement Agreement establishes a non-reversionary Settlement Fund of $117,500,000. (Settlement Agreement ¶ 3.1.) Notice and administration costs in excess of $7.3 million are separately paid by Comcast and do not reduce the Settlement Fund. (Id. ¶ 3.3.) Attorneys’ fees, expenses, and Court-approved service awards are to be paid from the Settlement

Fund; the Net Settlement Fund is used to pay Settlement Class Members’ claims according to the Court-approved Consumer Settlement Benefits Plan (“Benefits Plan”) (ECF No. 275-3). 2. Documented Out-of-Pocket Losses and Lost Time Class Members may submit claims for reimbursement of documented Out-of-Pocket Losses fairly traceable to the Data Breach, plus up to five hours of Lost Time at $30 per hour, subject to a $10,000 cap per person. (Benefits Plan §§ 3, 4, 7.) Documented Out-of-Pocket Losses include unreimbursed costs associated with identity theft or fraud; costs of placing or removing a credit freeze or fraud alert on or after October 16, 2023; miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance charges; and costs of credit reports, credit

monitoring, or other detection or remediation products incurred on or after October 16, 2023. (Id. § 3.) 3. Identity Defense and Restoration Services Every Settlement Class Member is entitled to enroll—without submitting a Claim Form— in at least three years of CyEx Financial Shield Complete. (Benefits Plan § 6; Thompson Decl. ¶¶ 4–6, ECF No. 275-5.) The service includes one-bureau credit monitoring, dark web monitoring, real-time authentication alerts, high-risk transaction monitoring, lost wallet protection, $1 million in identity theft insurance, security freeze assistance, victim assistance, financial-transaction monitoring, monthly credit score tracking, fictitious-identity monitoring, bank-and-financial account monitoring, address-change monitoring, home-title monitoring, and access to trained customer service agents. (Thompson Decl. ¶ 4.) The retail value of the service is $179.40 per person per year, or over $500 per Settlement Class Member across the three-year term. (Id. ¶ 5.) Enrollment does not require submission of a Claim Form; every Settlement Class Member received

an individual activation code in the Notice. 4. Alternative Cash Payments As an alternative to itemized claims, Class Members may claim a $50 Alternative Cash Payment. The Alternative Cash Payment is subject to pro rata adjustment depending on the amount of funds used. (Benefits Plan §§ 5, 8.) Settlement Class Members submitting documented claims receive the greater of their documented amount or the Alternative Cash Payment. (Id. § 5.) A 30-day cure period is provided for any incomplete claim. (Id. § 11.) 5. Non-Reversion and Residual Funds No funds may revert to Comcast. Any residual funds will be distributed to Class Members, used to extend the Identity Defense and Restoration Services period, or as otherwise ordered by

the Court. (Benefits Plan § 8; Settlement Agreement ¶ 3.2.) C. Releases In exchange for the Settlement benefits, Settlement Class Members agree to release the claims set forth in Section 2.30 of the Settlement Agreement. The release covers claims that were asserted or could have been asserted by Settlement Class Members related to or arising from the Data Breach. (Settlement Agreement ¶¶ 2.30, 13.) D. Attorneys’ Fees, Litigation Expenses, and Service Awards On May 11, 2026, Class Counsel filed a motion for attorneys’ fees of one-third of the Settlement Fund; reimbursement of $432,089.37 in litigation costs and expenses; and $5,000 service awards to each of the eleven Settlement Class Representatives. (ECF No. 286.) On July 15, 2026, Class Counsel filed a motion for final approval of the class action settlement wherein they updated the reimbursement of litigation costs and expenses to $439,649.44. As described fully below, the Court grants a fee award of $31,725,000, 27% of the Settlement Fund; the requested service awards are reasonable and reflect the work each Class Representative performed on behalf

of the Class. E. Expenses for Settlement Administration Notice and administration costs in excess of $7.3 million are separately paid by Comcast and are not deducted from the Settlement Fund. (Settlement Agreement ¶ 3.3.) III. DISCUSSION To approve the Settlement, the Court must first certify the Settlement Class and determine that Notice to the Class was appropriate and in accordance with the Preliminary Approval Order. The Court must then determine whether the Settlement is fair, reasonable, and adequate. The Court must also confirm the appointment of Class Counsel to administer the Settlement Fund and approve compensation for Class Counsel and the Named Plaintiffs. A. The Proposed Class Meets the Requirements of Rule 23(a) The Court finds that the Settlement Class meets all of the requirements of Fed. R. Civ. P.

23(a). Rule 23(a) provides that: One or more members of a class may sue or be sued as representative parties on behalf of all members only if: (1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.

1. Numerosity To establish numerosity, the Court must find that the proposed class is so numerous that joinder of all class members is impracticable. Fed. R. Civ. P. 23(a)(1). The Settlement Class consists of over 31 million individuals to whom Comcast sent notification of the Data Breach. This class size is sufficiently large that joinder of all members would be impracticable. See In re Modafinil Antitrust Litig., 837 F.3d 238, 249-50 (3d Cir. 2016) (recognizing that the Third Circuit employs a 40-person threshold to satisfy numerosity); Stewart v. Abraham, 275 F.3d 220, 226-227

(3d Cir. 2001) (“[G]enerally if the named plaintiff demonstrates that the potential number of plaintiffs exceeds 40, the first prong of Rule 23(a) has been met.”). The numerosity requirement is satisfied. 2. Commonality Commonality requires the existence of at least one question of law or fact common to the class. Fed. R. Civ. P. 23(a)(2). A common question is one that “is capable of classwide resolution— which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). “[A] finding of commonality does not require that all class members share identical claims.” In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 530 (3d Cir. 2004) (quoting In re

Prudential Ins. Co. Am. Sales Prac. Litig. Agent Actions, 148 F.3d 283, 310 (3d Cir. 1998)). A “single common question is sufficient.” Braun v. Philadelphia Inquirer, LLC, No. 22-CV-4185- JMY, 2025 WL 1314089, at *4 (E.D. Pa. May 6, 2025) (citation omitted). Common questions in the case include whether Defendants adequately safeguarded Settlement Class Members’ personal information; whether Comcast timely installed the Citrix patch; whether Citrix owed a duty of care to end-users of its cybersecurity products; whether the information disclosed constitutes “personally identifiable information” under the Cable Act; and whether Defendants’ conduct caused injury to the Class. These are common questions subject to common proof that can be answered on a classwide basis. The commonality requirement is met. 3. Typicality The typicality requirement of Rule 23(a)(3) “is designed to align the interests of the class and the class representative so that the latter will work to benefit the entire class through the pursuit of their own goals.” In re Warfarin Sodium Antitrust Litig., 391 F.3d at 531. Typicality is satisfied where class representatives’ claims and those of the putative class members arise from the same

conduct. Braun, 2025 WL 1314089, at *5. Here, the eleven Settlement Class Representatives’ claims are essentially identical to those of other Settlement Class Members. They are all predicated on the same alleged conduct by Defendants, and Defendants’ liability does not depend on the individualized circumstances of the Class Representatives or of any Class Member. The typicality requirement is satisfied. 4. Adequacy of Representation The adequacy requirement “encompasses two distinct inquiries designed to protect the interests of absentee class members: it considers whether the named plaintiffs’ interests are sufficiently aligned with the absentees’, and it tests the qualifications of the counsel to represent

the class.” Ripley v. Sunoco, Inc., 287 F.R.D. 300, 309 (E.D. Pa. 2012); see also Dewey v. Volkswagen Aktiengesellschaft, 681 F.3d 170, 181–82 (3d Cir. 2012). Both prongs are satisfied here. First, there is no apparent conflict between the interests of the Named Plaintiffs and the claims asserted on behalf of the Settlement Class; the Named Plaintiffs, like all Settlement Class Members, seek to establish that Defendants failed to adequately protect their personal information from the Data Breach. Each Class Representative was actively engaged in the litigation—in some combination of assisting with the pleadings, producing documents, responding to written discovery, sitting for depositions (many in person), or consulting with Class Counsel at critical junctures. (Prelim. Approval Counsel Decl. ¶ 133; Class Counsel Decl. ¶ 11.) Second, as discussed further below, Class Counsel have extensive experience in class action litigation, including data breach and privacy litigation, and have vigorously represented the Class over nearly three years. The Court accordingly finds the adequacy requirement satisfied. See Braun, 2025 WL 1314089, at *5 (finding adequacy satisfied where the attorneys representing

plaintiffs and the class were qualified and experienced in the subject litigation). B. Class Certification is Appropriate Under Fed. R. Civ. P. 23(b)(3) Class certification is appropriate under Fed. R. Civ. P. 23(b)(3) when common questions of law or fact “predominate” over individual questions, and a class action is “superior” to individual actions. The Settlement Class satisfies both requirements. 1. Predominance The predominance requirement “is similar to commonality and tests whether a proposed class is sufficiently cohesive to warrant adjudication by representation.” In re Suboxone (Buprenorphine Hydrochloride & Nalaxone) Antitrust Litig., 421 F. Supp. 3d 12, 51 (E.D. Pa. 2019), aff’d sub nom., 967 F.3d 264 (3d Cir. 2020). The questions of law and fact common to the

Settlement Class predominate over any individual questions and can be answered with the same classwide evidence: evidence of the Citrix Bleed vulnerability and Comcast’s delayed patch; evidence of the exfiltration of Class Members’ data during the October 16–19, 2023 window; and evidence bearing on Defendants’ respective duties and alleged breach. Predominance is satisfied. 2. Superiority Rule 23(b)(3)’s superiority requirement requires the Court to consider “class members’ interest in pursuing separate actions, the extent of any independent litigation already begun by class members, the desirability of concentrating the litigation in this forum, and the difficulties likely to be encountered in the management of a class action.” In re Mushroom Direct Purchaser Antitrust Litig., 319 F.R.D. 158, 208 (E.D. Pa. 2016). Any Settlement Class Member’s interest in individually controlling the prosecution of separate claims is outweighed by the efficiency of a class action. Approximately 31.5 million individuals were affected by the Data Breach. Setting these claims in the context of a class action conserves private and judicial resources and hastens Settlement Class Members’ recovery. The minuscule opt-out and objection rates (both less than

.01%) further support a finding that the superiority element has been satisfied. See Braun, 2025 WL 1314089, at *6. C. Notice to the Settlement Class Was Appropriate and in Accordance with the Order Preliminarily Approving Class Action Settlement The Parties and Kroll have submitted evidence establishing that Notice to the Settlement Class was appropriate and complied with the Preliminary Approval Order. (Preliminary Approval Order ¶¶ 8–11, 22; Settlement Admin. Decl. ¶¶ 4–21.) Within 30 days of preliminary approval, Comcast provided the Class List containing the Class Members’ full names and, where available, email and physical addresses. (Settlement Admin. Decl. ¶ 5.) Kroll then commenced Email Notice on April 9, 2026, and Postcard Notice on April 16, 2026. (Id. ¶¶ 13–14.) Kroll established a Settlement website and a toll-free telephone number, and made available all key documents— including the Complaint, the Settlement Agreement, the Preliminary Approval papers, the Preliminary Approval Order, the Benefits Plan, and Class Counsel’s Fee Motion. (Id. ¶¶ 9–10.) Direct notice reached an estimated 97.69% of the Settlement Class, at the high end of the 70–95% benchmark endorsed by the Federal Judicial Center. (Id. ¶ 21.) The Court finds that Notice to the Settlement Class was adequate and appropriate and satisfies the requirements of Rule 23(c)(2)(B),

Rule 23(e)(1), and due process. D. The Settlement is Fair, Reasonable, and Adequate After Evaluating and Weighing the Factors Set Forth in Fed. R. Civ. P. 23(e)(2) and Girsh v. Jepson Having determined that the Settlement Class meets the requirements of Federal Rule of Civil Procedure 23(a) and 23(b) and that the requirements for notice have been met, the Court must now determine whether the terms of the Settlement Agreement are “fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). The Court must also keep in mind that “the law favors settlements, particularly in class actions and other complex cases where substantial judicial resources can be conserved by avoiding litigation.” In re GMC Pick-Up Truck Fuel Tank Prods.

Liab. Litig., 55 F.3d 768, 784 (3d Cir. 1995). In conducting this analysis, the Court weighs the factors set forth in Rule 23(e)(2) to determine whether: (A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e); and (D) the proposal treats class members equitably relative to each other. Fed. R. Civ. P. 23(e)(2). Courts in the Third Circuit also evaluate whether a settlement is fair, reasonable, and adequate under the test set forth in Girsh v. Jepson, 521 F.2d 153 (3d Cir. 1975), which requires analysis and balancing of the following nine factors: (1) the complexity, expense and likely duration of the litigation; (2) the reaction of the class to the settlement; (3) the state of the proceedings and the amount of discovery completed; (4) the risks of establishing liability; (5) the risks of establishing damages; (6) the risks of maintaining the class action through trial; (7) the ability of the defendants to withstand a greater judgment; (8) the range of reasonableness of the settlement fund in light of the best possible recovery; and (9) the range of reasonableness of the settlement fund to a possible recovery in light of all the attendant risk of litigation. Girsh, 521 F.2d at 157 (cleaned up). The Court now evaluates the factors set forth in Rule 23(e)(2) and under Girsh, to determine whether the settlement is fair, reasonable, and adequate warranting final approval. E. The Court’s Evaluation of Factors Set Forth in Fed. R. Civ. P. 23(e)(2) Supports Final Approval of the Settlement Agreement 1. Class Counsel and Class Representatives Adequately Represent the Settlement Class Rule 23(e)(2)(A)’s requirement that “class representatives and class counsel have adequately represented the class” is easily met. See Braun, 2025 WL 1314089, at *7. The Preliminary Approval Order previously found that “the Settlement Class Representatives and Class Counsel have adequately represented the Settlement Class.” (ECF No. 278 ¶ 2.) Nothing has changed since that finding. Class Counsel prosecuted this action for nearly three years, filing a Consolidated Complaint and Amended Consolidated Complaint, opposing two rounds of dispositive motion briefing (including a factual Article III challenge), conducting extensive jurisdictional and merits discovery, taking or defending twenty-one depositions, reviewing more than 8,000 pages of Defendants’ productions, and negotiating over the course of five formal mediation sessions spanning six days before Judge Welsh. (Prelim. Approval Counsel Decl. ¶¶ 15–39, 62–91, 102–133; Counsel Fee Decl. ¶ 7.) Each of the eleven Class Representatives has been actively involved throughout the litigation—including some combination of assisting with

the pleadings, sitting for depositions, producing documents, responding to formal and informal written discovery, and consulting with Class Counsel at every critical juncture. (Prelim. Approval Counsel Decl. ¶ 133.) See Braun, 2025 WL 1314089, at *7; Clemens v. ExecuPharm, Inc., No. CV 20-3383, 2024 WL 4530310, at *2 (E.D. Pa. Oct. 1, 2024). 2. The Settlement Is the Result of Arm’s-Length Negotiations Another element of procedural fairness mandated by Rule 23(e)(2)(B) is that the Settlement “was negotiated at arm’s length.” The Settlement is the product of five separate mediation sessions spanning six full days before the Honorable Diane M. Welsh (Ret.). Judge Welsh’s involvement is compelling evidence of arm’s-length negotiation. See Bellum v. Law Offices of Frederic I. Weinberg & Assocs., P.C., No. 15-cv-2460, 2016 WL 4766079, at *6 (E.D. Pa. Sept. 13, 2016) (“[T]he participation of an independent mediator in settlement negotiations virtually [e]nsures that the negotiations were conducted at arm’s length and without collusion between the parties.”). The Third Circuit has recently recognized Judge Welsh’s experience as “an experienced mediator . . .

who had previously resolved over 5,000 cases.” In re Wawa, Inc. Data Sec. Litig., 141 F.4th 456, 462 n.2 (3d Cir. 2025). The Parties’ extensive and hard-fought motion practice, discovery, and mediation before Judge Welsh over the course of more than a year confirms that the Settlement is the product of arm’s-length negotiations. 3. The Settlement Provides Adequate Relief for the Settlement Class Rule 23(e)(2)(C)’s requirement that the Settlement provide adequate relief for the Class largely overlaps with the Girsh factors. See Braun, 2025 WL 1314089, at *8. Accordingly, the Girsh factors and the adequacy of recovery are discussed in greater detail below. The other subparts of Rule 23(e)(2)(C) are satisfied and weigh in favor of final approval. Effectiveness of Distribution. Rule 23(e)(2)(C)(ii) requires the Court to consider the

“effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims.” The Notice Plan preliminarily approved by the Court and administered by Kroll was effective, reaching an estimated 97.69% of the Settlement Class. (Settlement Admin. Decl. ¶ 21.) The claims process is straightforward and consumer-friendly: Class Members may pre-enroll in Identity Defense Services with a unique enrollment code without submitting a Claim Form; may file for Out-of-Pocket Losses and Lost Time online or by mail with reasonable documentation; or may elect the $50 Alternative Cash Payment without documentation. (Benefits Plan §§ 3-5.) Class Members submitting documented claims receive the greater of their documented amount or the Alternative Cash Payment, and a 30-day cure period is provided for any incomplete claim. (Id. §§ 5, 11.) The nearly 1 million claims received to date confirm the effectiveness of the process. Attorneys’ Fees. Rule 23(e)(2)(C)(iii) regarding the “terms of any proposed award of attorneys’ fees” weighs in favor of final approval. For the reasons set forth in Section IV below,

the Court grants a reasonable attorneys’ fee of $31,725,000, consistent with awards in similar settlements of comparable size. Rule 23(e)(3) Agreements. The only agreement at issue is the Settlement Agreement itself; there is no other agreement “required to be identified under Rule 23(e)(3),” so the Rule 23(e)(2)(C)(iv) subpart is satisfied. 4. The Plan of Allocation is Reasonable and Treats Settlement Class Members Equitably Relative to Each Other The Settlement also satisfies Rule 23(e)(2)(D)’s requirement that it “treat[] class members equitably relative to each other.” Braun, 2025 WL 1314089, at *8. Every Settlement Class Member has the identical opportunity to enroll in over three years of CyEx Financial Shield Complete on the same terms and at the same value; the identical choice between claiming documented Out-of-Pocket Losses (up to $10,000) and Lost Time (up to 5 hours at $30 per hour), or electing the $50 Alternative Cash Payment; and the identical entitlement to the greater of the documented amount or the Alternative Cash Payment where a documented claim is submitted. (Benefits Plan §§ 3–5.) The Net Settlement Fund adjusts pro rata upward across all Class Members equally where

approved claims fall short of the Net Settlement Fund and sufficient funds remain. (Id. § 8.) The Settlement is further structured so that residual funds cannot revert to Comcast. (Settlement Agreement ¶ 3.2.) The Rule 23(e)(2)(D) factor supports final approval. F. The Settlement Agreement Appears Fair, Reasonable, and Adequate After Balancing and Weighing the Factors Set Forth in Girsh v. Jepson 1. The Complexity, Expense and Likely Duration of Litigation “The first factor ‘captures the probable costs, in both time and money, of continued litigation.’” In re NFL Players Concussion Inj. Litig., 821 F.3d 410, 437 (3d Cir. 2016); see also In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d at 812. This factor is easily met. This is a complex class action involving damages from a data breach, an area of law that has not been fully developed. See In re Onix Grp., LLC Data Breach Litig., No. 23-cv-2288, 2024 WL 5107594, at *9 (E.D. Pa. Dec. 13, 2024). Plaintiffs pursued claims of first impression under the federal Cable Act, which to Class Counsel’s knowledge has never been applied to a data breach by a cable operator, and claims against Citrix that turned on the unresolved question of whether a

cybersecurity vendor owes a duty of care to the end-users of its customers. Plaintiffs have already incurred $132,020.92 in expert fees alone. (ECF No. 286-4.) Given the complex technical nature of data breach cases and the unsettled questions of law presented here, “any dispositive decision [would certainly] result in costly appellate litigation.” Braun, 2025 WL 1314089, at *8. Final approval of the Settlement Agreement will significantly reduce further litigation expenses for both sides, which supports finding the Settlement Agreement fair, reasonable, and adequate. 2. Reaction of the Class to the Settlement The Settlement Administrator has provided evidence establishing that direct notice reached an estimated 97.69% of the Settlement Class and that, as of the July 1, 2026 Objection and

Exclusion Deadline, approximately 745 Settlement Class Members (0.0024%) requested to be excluded and fifteen (15) Settlement Class Members (0.00005%) filed timely objections. (Settlement Admin. Decl. ¶ 21.) As of July 15, 2026, Kroll has received just under 1 million claims. (Id. ¶ 23.) “[A] minimal number of objections and requests for exclusion” favors final approval. In re Onix, 2024 WL 5107594, at *9; Braun, 2025 WL 1314089, at *8. The Third Circuit has characterized an objection rate of 2 out of 300,000 Class Members as a “rare phenomenon” that weighs in favor of final approval. In re Rite Aid Corp. Sec. Litig., 396 F.3d 294, 305 (3d Cir. 2005). The 15 timely objections filed here—out of a Class of approximately 31.5 million—reflect an

objection rate approximately one-tenth of the rate the Third Circuit deemed a “rare phenomenon” in Rite Aid. The overwhelming disparity “between the number of potential class members who received notice of the Settlement and the number of objectors” creates a “strong presumption” favoring approval. In re Cendant Corp. Litig., 264 F.3d 201, 235 (3d Cir. 2001). The verified claims rate also compares favorably to other data breach settlements. See In re Wawa, Inc. Data Sec. Litig., 2024 WL 1557366, at *17 (E.D. Pa. Apr. 9, 2024) (approving settlement with 2.56% claims rate); In re Anthem, Inc. Data Breach Litig., 327 F.R.D. 299, 321 (N.D. Cal. 2018) (finding 1.8% claims rate reflects positive class reaction).1 Notwithstanding the strong presumption favoring approval, the Court has considered each of the fifteen timely objections on its merits. The objections divide into three categories: (a)

objections to the Settlement Benefits; (b) objections to the requested attorneys’ fees, expenses, and service awards; and (c) miscellaneous filings. Three additional filings—the Callander Objection (ECF No. 309), the Page Objection (ECF No. 311), and the Lucas Objection (ECF No. 316)— were postmarked July 2, 2026, one day after the July 1, 2026 deadline set by the extended Preliminary Approval Order (ECF No. 287 ¶ 1). A fourth submission, from Thomas E. Sims, was

1 The timely objectors are Stefanos Amanuel (ECF No. 282), Monica Dixon (ECF No. 283), Wayne Dansbury (ECF No. 284), Shaun Skaggs (ECF No. 288), Rachel Corpe (ECF Nos. 290 & 292), Lloyd Kaplan (ECF No. 293), Peter Roppolo (ECF No. 294), Debi Anderson (ECF No. 300), Suzanne Swanson (ECF No. 301), Ruzhang George Chang (ECF No. 302), Pilar R. Langdon (ECF No. 307), William Ash (ECF No. 308), Tamara Lenart (ECF No. 312), Gary Daloyan (ECF No. 313), and William Steel (letter to Kroll; not docketed). mailed to Class Counsel but never filed with the Court, in violation of paragraph 15 of the Preliminary Approval Order. A fifth submission, from William Steel, was mailed to Kroll but never filed with the Court, also in violation of paragraph 15 of the Preliminary Approval Order. Two other filings—by Mr. Heinl (ECF No. 289) and Mr. Swartz (ECF No. 298)—did not object

to any term of the Settlement but reported operational difficulties with the claims and exclusion process, which the Parties have resolved. (ECF Nos. 291, 299.) The Court further finds, on the basis of the Kroll declaration, that five of the objectors— Carol Haverty (ECF No. 310), Joseph John Varga (ECF No. 281), Thomas E. Sims (letter to Class Counsel; not docketed), Phillip B. Sollon (ECF No. 297), and Joy Thomas (ECF No. 296)—do not appear on the Class List provided by Comcast and were not sent Class Notice. (Settlement Admin. Decl. ¶ 26). None of these five individuals falls within the Settlement Class as certified by this Court and are thus not Settlement Class Members. (ECF No. 278 ¶ 3.) Rule 23(e)(5)(A) permits only “class member[s]” to object to a proposed settlement, and courts have consistently held that non-class members lack standing to object. See Fed. R. Civ. P. 23(e)(5)(A); In re Sunrise Sec.

Litig., 131 F.R.D. 450, 459 (E.D. Pa. 1990) (“As a general rule, only class members have standing to object to a proposed class settlement.”); see also Rowe v. E.I. DuPont de Nemours & Co., No. CIV. 06-1810 RMB/AMD, 2011 WL 3837106, at *10 (D.N.J. Aug. 26, 2011). The objections of Ms. Haverty, Mr. Varga, Mr. Sims, Mr. Sollon, and Ms. Thomas are OVERRULED on that threshold basis alone. The Sims, Steel, Callander, Page, and Lucas filings may likewise be overruled on procedural grounds alone, see Harshbarger v. Penn Mut. Life Ins. Co., No. CV 12-6172, 2017 WL 6525783, at *3 n.3 (E.D. Pa. Dec. 20, 2017); In re Centocor, Inc. Secs. Litig., 1993 WL 189937, at *3 n.5 (E.D. Pa. June 2, 1993), and the Callander and Steel filings are separately not cognizable objections because they each identify no defect in the Settlement, state no cognizable grounds, and request no relief. Even so, the Court still considers each on the merits below.2 a) Objections to the Settlement Benefits Are Overruled. The largest category of objections—raised in some form by several Settlement Class

Members—challenges the adequacy of the Settlement Benefits. The governing standard forecloses these generic attacks. “[I]n determining whether to approve a class action settlement, the issue is not whether everyone affected by the settlement is completely satisfied. Instead, the test is whether the settlement, as a whole, is a fair, adequate, and reasonable resolution of the class claims asserted.” In re Cap. One Consumer Data Sec. Breach Litig., No. 1:19-md-2915, 2022 WL 18107626, at *8 (E.D. Va. Sept. 13, 2022); see also In re Onix, 2024 WL 5107594, at *11 (“[The] argument . . . that a settlement should have been better . . . has frequently been rejected by courts.”); Rougvie v. Ascena Retail Grp., Inc., No. 15-cv-724, 2016 WL 4111320, at *22 (E.D. Pa. July 29, 2016) (“The test is whether the settlement is adequate and reasonable and not whether a better settlement is conceivable.”).

Several objectors (Dixon, Skaggs, Kaplan, Anderson, Swanson, Chang, Sims, and Lucas) argue that the $50 Alternative Cash Payment is inadequate compared to the harm suffered. These objections mistake one component of benefits for the whole. The Alternative Cash Payment is one component of a multi-tiered benefits plan that also includes reimbursement of documented Out-of-Pocket Losses up to $10,000; compensation for Lost Time at $30 per hour up to five hours; and at least three years of CyEx Financial Shield Complete, an identity monitoring, fraud prevention, and restoration package with a retail value of over $500 per Class Member, together

2 For the avoidance of doubt, the Court has considered on the merits every objection filed with, mailed to, or otherwise submitted to the Court, the Parties, or the Settlement Administrator, regardless of any procedural deficiency. with up to $1 million in identity theft insurance. (Thompson Decl. ¶¶ 4–5.) A Class Member who elects the Alternative Cash Payment in lieu of documenting Out-of-Pocket Losses therefore receives a total benefit of approximately $550 or more—not $50. The Alternative Cash Payment is also potentially subject to pro rata upward adjustment if unused funds remain. (Benefits Plan §

5.) The Settlement compares favorably on a per-capita basis to other approved data breach settlements. See In re T-Mobile Customer Data Sec. Breach Litig., No. 4:21-MD-03019-BCW, 2023 WL 11878508, at *3–4 (W.D. Mo. June 29, 2023); In re Cap. One, 2022 WL 18107626, at *1, *8; In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1257–58 (11th Cir. 2021); In re Yahoo! Inc. Customer Data Breach Litig., No. 16-MD-02752-LHK, 2020 WL 4212811, at *10 (N.D. Cal. July 22, 2020). Any Class Member who believed his or her individual losses exceeded the $10,000 documented-loss cap had the option to exclude himself or herself and pursue those damages individually. See In re CenturyLink Sales Pracs. & Sec. Litig., No. 17-2832, 2020 WL 7133805, at *9 (D. Minn. Dec. 4, 2020); Saccoccio v. JP Morgan Chase Bank, N.A., 297 F.R.D. 683, 700 (S.D. Fla. 2014). None elected that option.

Mr. Dansbury (ECF No. 284), Ms. Lenart (ECF No. 312), and Mr. Daloyan (ECF No. 313) each contend that the documented-loss tier fails Class Members whose harm is genuine but not readily quantified. These objections confirm the value of the Settlement rather than undermine its adequacy. The Alternative Cash Payment—available without proof of loss—is the mechanism the Settlement provides for precisely those Class Members. Its $50 amount reflects a considered allocation of a limited fund across a class exceeding 31 million members, and comparable settlements have endorsed the same multi-tier design. See In re T-Mobile, 2023 WL 11878508, at *10; In re Onix, 2024 WL 5107594, at *2. Mr. Daloyan’s four attached credit-denial letters establish adverse credit consequences but not a dollar-denominated loss reimbursable through the documented-loss tier; his available recovery is compensation for Lost Time, postage and incidentals, or the $50 Alternative Cash Payment. Ms. Lenart acknowledges that her identity was never compromised; the Alternative Cash Payment is available to her without documentation, and the CyEx services protect her prospectively. Mr. Dansbury’s objection is answered on the same

terms. Several objectors (Amanuel, Skaggs, Haverty, and Daloyan) argue that the documentation requirement for Out-of-Pocket Losses above $50 is unreasonable. Documentation requirements have been consistently approved as “necessary to ensure that the settlement fund is used to pay legitimate claims” and are “routine[ly] . . . less stringent than a plaintiff would have to present during discovery or trial.” In re Equifax Inc. Customer Data Sec. Breach Litig., No. 1:17-MD- 2800-TWT, 2020 WL 256132, at *8 (N.D. Ga. Mar. 17, 2020); see also In re Remicade Antitrust Litig., No. 17-CV-04326, 2023 WL 2530418, at *19–20 (E.D. Pa. Mar. 15, 2023); Yaeger v. Subaru of Am., Inc., No. 1:14-cv-4490 (JBS-KMW), 2016 WL 4541861, at *13 (D.N.J. Aug. 31, 2016). Ms. Haverty (ECF No. 310) misapprehends the documentation requirement in two respects:

it does not apply to the Alternative Cash Payment, which is available on attestation alone, and it does not require documentation to be submitted by July 1, 2026; the claims deadline is September 14, 2026. Her collateral grievance regarding Comcast’s data-sharing practices with Peacock lies outside the scope of the released claims and provides no basis to disturb the Settlement. Mr. Amanuel (ECF No. 282) is incorrect that the documentation requirement will cause settlement funds to go unpaid: the Settlement is non-reversionary; unclaimed funds do not return to Comcast but are used to increase the Alternative Cash Payment, extend monitoring services, or as this Court otherwise orders. (Benefits Plan § 8; Settlement Agreement ¶ 3.1.) Mr. Roppolo (ECF No. 294) proposes a five-year monitoring term, and Mr. Chang (ECF No. 302) argues that three years is inadequate. The three-year term of CyEx Financial Shield Complete is consistent with, and in many instances exceeds, the monitoring terms approved in comparable settlements. See In re T-Mobile, 2023 WL 11878508, at *10 (two years); In re Cap. One, 2022 WL 18107626, at *11 (at least three years). Longer terms would necessarily reduce

funds available for other Class benefits, and CyEx is not the Settlement’s sole prospective protection—Class Members also receive up to $1 million in identity theft insurance during the CyEx term. Several objectors (Varga, Amanuel, Swanson, Haverty, Sims, Anderson, and Lucas) express the view that the Settlement is insufficient to punish or deter Comcast. Such objections, “while understandable, do not take into account the risks and realities of litigation, and are not a basis for rejecting the settlement.” In re Cap. One, 2022 WL 18107626, at *8. Ms. Anderson’s stated preference to sue Comcast independently was available to her through the opt-out mechanism. See In re CenturyLink, 2020 WL 7133805, at *9. Class Counsel has since reached out to Ms. Anderson, and Kroll has attempted to assist her in filing documented-loss claims before the

September 14, 2026 claims deadline. (Class Counsel Decl. ¶ 4.) Ms. Langdon (ECF No. 307) objects on the basis of her lengthy tenure as a Comcast customer and pre-Data Breach service failures unrelated to the Data Breach, and inquires whether she qualifies for a “service class” award, otherwise deferring to the Court’s judgment. However well-founded her pre-breach service grievances may be, they lie outside the scope of this litigation. See Davies v. Cont’l Bank, 122 F.R.D. 475, 478 (E.D. Pa. 1988) (“[T]he Court’s role is limited to approval or disapproval of the Settlement Agreement; it may not rewrite it.”); New Cmty. Corp. v. Arthur J. Gallagher Risk Mgmt. Servs., Inc., No. 10-CV-3208 DMC, 2012 WL 1805503, at *3 (D.N.J. May 7, 2012). Ms. Lucas (ECF No. 316) also contends that the Settlement should have separately valued or enhanced her particular claims: that it inequitably disadvantages former Comcast customers like herself; that it fails to separately value her claims under the Georgia Fair Business Practices Act and for breach of implied contract as a former customer; and that the Settlement Fund fails to

disgorge Comcast’s alleged unjust enrichment. That premise fails. As explained above, the Settlement satisfies Rule 23(e)(2)(D) because every Class Member—whether a current or former customer—is entitled to the identical suite of benefits, and Rule 23(e)(2)(D) requires equitable treatment, not the creation of bespoke subclasses or enhanced tiers of compensation for particular categories of Class Members. In addition, most of the various liability theories that Ms. Lucas identifies are among the very claims asserted in this litigation, and the strength of those claims— together with the substantial risks of establishing liability and damages on them—is accounted for in the fairness analysis above. The measure of a fair, reasonable, and adequate class settlement is not the disgorgement of a defendant’s profits, but the value of the relief conferred on the class weighed against the risks of continued litigation. See In re Cap. One, 2022 WL 18107626, at *8.

If Ms. Lucas believed her individual claims warranted greater or different relief, her remedy was to exclude herself from the Settlement Class and pursue those claims individually. See In re CenturyLink, 2020 WL 7133805, at *9; Saccoccio, 297 F.R.D. at 700. Mr. Ash (ECF No. 308) raises the most detailed set of objections in the record. The Court has considered each and finds them without merit. First, Mr. Ash contends the Notice does not adequately disclose the Settlement Fund’s allocation across its five components. Class Counsel’s fee application was publicly filed on May 11, 2026 (ECF No. 286), posted to the Settlement Website, and is presently before this Court on separate motion. The retail value of CyEx has likewise been disclosed at $179.40 per Class Member per year, or over $500 per Class Member across the three-year term. (Thompson Decl. ¶ 5.) The Alternative Cash Payment and documented-loss tiers are claim-driven and by their nature cannot be predicted with precision in advance—a standard feature of claim-submission settlements, not a defect in transparency. The Settlement’s non-reversionary structure ensures that unclaimed funds remain with the Class rather

than returning to Comcast. (Settlement Agreement ¶ 3.1; Benefits Plan § 8.) Second, Mr. Ash misreads the pro rata escalator in Settlement Agreement ¶ 3.4 as capping Class participation at approximately 1%. It does not; ¶ 3.4 is a Class-protective provision that requires Comcast to increase its payment to the Fund on a prorated basis if the actual Class size confirmed by the Class List exceeds Comcast’s represented figure of approximately 31,658,000 by more than 1%. The contingency was not triggered here. (Settlement Admin. Decl. ¶ 5) Third, Mr. Ash proposes that Comcast pay the Alternative Cash Payment directly through its billing system rather than through the Settlement Administrator. The proposal would exclude the significant portion of the Class no longer in a billing relationship with Comcast, impose reconciliation costs greater than those already built into the Settlement Administrator’s

infrastructure, and deprive Class Members of the option to receive payment by check or transfer to a non-Comcast account. Distribution through an independent, court-approved administrator is the standard practice under Rule 23. Fourth, Mr. Ash objects that the retail value of CyEx has not been disclosed; as noted above, it has. (Thompson Decl. ¶¶ 4-5.) Fifth, Mr. Ash requests itemization of each Class Representative’s contribution; that itemization has been provided in the Fee Motion. (ECF No. 286-2 ¶¶ 15, 67.) Sixth, Mr. Ash’s proposed $7 million cap on the fee award identifies no defect in Class Counsel’s methodology, engages neither with the Gunter/Prudential factors nor the record of contingency risk, complexity, and results achieved, and is rejected. See In re Rite Aid, 396 F.3d at 302–3 (rejecting the notion that a district court must apply a declining-percentage rule in large common-fund settlements). Accordingly, objections to the Settlement benefits are OVERRULED.

b) Objections to the Attorneys’ Fees, Expenses, and Service Awards Are Overruled. Several objectors challenge Class Counsel’s fee, expense, and service-award requests in some respect. The Court considers and overrules each of these objections in its full Gunter/Prudential analysis in Section IV below. The Court overrules the objections of Mr. Skaggs and Mr. Ash to the requested $5,000 service awards for the reasons set forth in Section IV.C below, which addresses the reasonableness of the service awards separately from the reasonableness of the fee. Mr. Page’s objection (ECF No. 311) is separately overruled. Beyond its untimeliness, Mr. Page requests that the Court award him personally 10% of the Settlement Fund (up to $11 million) and 50% of the requested fee and expense award (up to $19 million)—a total of approximately $30 million to a single Class Member. He identifies no individualized injury, no legal or factual defect in the Settlement, and no rule authorizing the requested relief. The request is not a cognizable objection under Rule 23(e)(5) and is denied.

c) Miscellaneous Filings. The submissions of Mr. Heinl (ECF No. 289) and Mr. Swartz (ECF No. 298) did not object to any term of the Settlement but instead reported operational difficulties with the claims and exclusion process, both of which the Parties have resolved. (ECF Nos. 291, 299.) The Thomas (ECF No. 296) and Sollon (ECF No. 297) Objections, to the extent they raise concerns about the adequacy of relief or of Class Counsel’s fees, are overruled for the reasons set forth above. Accordingly, all objections are OVERRULED, and the Court finds that the reaction of the Settlement Class overwhelmingly supports final approval. 3. The Stage of the Proceedings and the Amount of Discovery Completed The third Girsh factor “asks whether counsel had an adequate appreciation of the merits of

the case before negotiating.” In re Onix, 2024 WL 5107594, at *9 (quotation marks omitted). The Court is satisfied that Class Counsel had a fairly accurate view of continued litigation. Fulton-Green v. Accolade, Inc., No. 18-cv-274, 2019 WL 4677954, at *10 (E.D. Pa. Sept. 24, 2019). Before reaching settlement, Class Counsel litigated two full rounds of Rule 12 motions, conducted extensive jurisdictional and merits discovery (including twenty-one depositions, review of 8,000 documents, and service of over one hundred written discovery requests), retained and defended three purported expert witnesses, and participated in five formal mediations spanning six full days. (Prelim. Approval Counsel Decl. ¶¶ 15-39, 62-91, 102-133; Counsel Fee Decl. ¶ 7.) This factor weighs heavily in favor of final approval. See In re Wawa, Inc. Data Sec. Litig., No. CV 19- 6019, 2023 WL 6690705, at *8 (E.D. Pa. Oct. 12, 2023); Braun, 2025 WL 1314089, at *9.

4. The Risks of Establishing Liability, Establishing Damages, and Maintaining a Class Action Through Trial “By evaluating the risks of establishing liability, the district court can examine what the potential rewards (or downside) of litigation might have been had class counsel elected to litigate the claims rather than settle them.” In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d at 814. This inquiry “survey[s] the possible risks of litigation in order to balance the likelihood of success and the potential damage award if the case were taken to trial against the benefits of an immediate settlement.” In re Prudential, 148 F.3d at 319. “By its very nature, continued litigation involves inherent risk of Plaintiff receiving an adverse result—especially considering the cutting-edge areas of data privacy law.” Braun, 2025 WL 1314089, at *9; see also Toretto v. Donnelley Fin. Sols., Inc., 583 F. Supp. 3d 570, 594 (S.D.N.Y. 2022) (“Data breach jurisprudence has developed significantly in [recent] years.”). The risks facing the Class here were substantial. Defendants twice moved to dismiss on facial and factual grounds, including a factual Article III challenge that required extensive

jurisdictional discovery. Plaintiffs’ claim under the federal Cable Act, presented issues of first impression concerning the statute’s application to a data breach by a cable operator, and Citrix’s liability turned on the unresolved question of whether a cybersecurity vendor owes a duty of care to end-users of its customers. Class certification in data breach litigation is not guaranteed. See, e.g., Theus v. Brinker Int’l, Inc., No. 3:18-CV-686-TJC-MCR, 2025 WL 1786346 (M.D. Fla. June 27, 2025); Maldini v. Marriott Int’l, Inc., 140 F.4th 123 (4th Cir. 2025). And even a certified class faces the risk of decertification. See In re Prudential, 148 F.3d at 312 (recognizing there “will always be a ‘risk’ or possibility of decertification”). These three factors weigh in favor of finding that settlement of the disputed claims is fair, reasonable, and adequate.

5. The Ability of Defendants to Withstand a Greater Judgment The seventh Girsh factor “is most clearly relevant where a settlement in a given case is less than would ordinarily be awarded but the defendant’s financial circumstances do not permit a greater settlement.” In re NFL Players Concussion Inj. Litig., 307 F.R.D. 351, 394 (E.D. Pa. 2015) (quotation marks omitted). This factor is neutral because Defendants have “not cite[d] potential financial instability as justification for the settlement’s size.” In re NFL Players Concussion Inj. Litig., 821 F.3d at 440. 6. The Range of Reasonableness of the Settlement Fund in Light of the Best Possible Recovery and the Attendant Risk of Litigation The eighth and ninth Girsh factors “test two sides of the same coin: reasonableness in light of the best possible recovery and reasonableness in light of the risks the parties would face if the case went to trial.” In re Flonase Antitrust Litig., 951 F. Supp. 2d 739, 745 (E.D. Pa. 2013). The Third Circuit cautions courts to “guard against demanding too large a settlement based on its view of the merits of the litigation; after all, settlement is a compromise, a yielding of the highest hopes in exchange for certainty and resolution.” In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig.,

55 F.3d at 806; Sullivan v. DB Invs., Inc., 667 F.3d 273, 324 (3d Cir. 2011). The Settlement is reasonable in terms of the best possible recovery for the Settlement Class weighed against the risks of continued litigation. Plaintiffs faced the potential of a costly and time-consuming case with a real risk of no recovery for the Settlement Class. In contrast, the Settlement provides guaranteed financial compensation and enhanced privacy protections. The $117.5 million non-reversionary common fund is among the largest data breach class action settlements in United States history. See In re T-Mobile, 2023 WL 11878508, at *3–4 ($350 million for approximately 76.6 million class members); In re Cap. One, 2022 WL 18107626, at *1, *8 ($190 million for approximately 98 million class members); In re Equifax, 999 F.3d at 1257–58 ($380.5 million for approximately 147 million class members); In re Yahoo!, 2020 WL

4212811, at *10 ($117.5 million for approximately 194 million class members). The final Girsh factors support approval of the Settlement Agreement. G. Lynch Carpenter LLP and Stueve Siegel Hanson LLP, with Co-Liaison Counsel Francis Mailman Soumilas, P.C. and Levin Sedran & Berman LLP, Fairly and Adequately Represent the Interests of the Settlement Class Federal Rule 23(g) specifies that, unless a statute provides otherwise, a court that certifies a class must appoint Class Counsel, and that any attorney appointed to serve as Class Counsel “must ‘fairly and adequately represent the interests of the class.’” Donovan v. St. Joseph County Sheriff, No. 11-cv-0133, 2012 WL 1601314, at *8 (N.D. Ind. May 3, 2012) (quoting Fed. R. Civ. P. 23(g)(4)). Rule 23(g) directs consideration of: “(i) the work counsel has done in identifying or investigating potential claims in the action; (ii) counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action; (iii) counsel’s knowledge of the applicable law; and (iv) the resources that counsel will commit to representing the class.” In re Processed Egg Prods. Antitrust Litig., 284 F.R.D. 249, 262 (E.D. Pa. 2012) (citing Fed. R. Civ. P. 23(g)(1)(A)(i)–(iv)).

The Court previously found in Case Management Order No. 2 (ECF No. 51) that Lynch Carpenter LLP, Stueve Siegel Hanson LLP, Francis Mailman Soumilas, P.C., and Levin Sedran & Berman LLP were qualified to represent the proposed class. The Court applies the same logic and reasoning previously applied and now appoints Gary F. Lynch of Lynch Carpenter LLP and Norman E. Siegel of Stueve Siegel Hanson LLP as Co-Lead Class Counsel, and James A. Francis of Francis Mailman Soumilas, P.C. and Charles E. Schaffer of Levin Sedran & Berman LLP as Co-Liaison Counsel, to represent the Settlement Class. Each of these firms has substantial experience litigating major data breach and consumer class actions—including In re T-Mobile Customer Data Sec. Breach Litig., In re Wawa, Inc. Data Sec. Litig., In re Onix Grp., LLC Data Breach Litig., In re Philadelphia Inquirer Data Sec. Litig., Clemens v. ExecuPharm, Inc., and this

Court’s decision in Braun v. Philadelphia Inquirer, LLC—and their firms have consistently secured landmark recoveries for consumer classes. Class Counsel expended substantial time and energy investigating claims, drafting pleadings (including the Consolidated Complaint and First Amended Consolidated Complaint), opposing two rounds of dispositive motions, conducting extensive jurisdictional and merits discovery, taking and defending 21 depositions, negotiating over five mediation sessions, and drafting the motions for preliminary and final approval. The Court accordingly appoints them as Class Counsel. IV. MOTION FOR ATTORNEYS’ FEES, COSTS, EXPENSES, AND SERVICE AWARDS A. Award of Attorneys’ Fees, Costs, and Expenses Plaintiffs’ attorneys in a class action may petition the court for compensation for any award to the class resulting from the attorneys’ efforts. Boeing Co. v. Van Gemert, 444 U.S. 472 (1980). Under Fed. R. Civ. P. 23(h), “the court may award reasonable attorney’s fees and nontaxable costs that are authorized by law or by the Parties’ agreement.” Courts generally use one of two approaches to analyze a request for attorneys’ fees by Class Counsel: the percentage-of-recovery method and the lodestar method. Braun, 2025 WL 1314089, at *11. Under the percentage-of-recovery method, “the court awards counsel a percentage of the amount recovered for the class in order to reward counsel for their success or penalize them for their failure.” Id. The

Third Circuit favors the percentage-of-recovery method in common fund cases. See Sullivan, 667 F.3d at 330; Corra v. ACTS Ret. Servs., Inc., No. 22-cv-2917, 2024 WL 22075, at *10 (E.D. Pa. Jan. 2, 2024); Braun, 2025 WL 1314089, at *11. The Court applies the percentage-of-recovery method here and awards counsel $31,725,000 (27% percent of the $117,500,000 Settlement Fund), with interest earned, as well as reimbursement of litigation costs and expenses. The Third Circuit has also approved use of the Gunter/Prudential factors to assess the reasonableness of a percentage fee request. See Gunter v. Ridgewood Energy Corp., 223 F.3d 190, 195 n.1 (3d Cir. 2000); In re Prudential, 148 F.3d at 338–40. Those factors include: (1) the size of the fund created and the number of persons benefitted; (2) the presence or absence of substantial objections by members of the class to the settlement terms and/or fees requested by counsel; (3) the skill and efficiency of the attorneys involved; (4) the complexity and duration of the litigation; (5) the risk of nonpayment; (6) the amount of time devoted to the case by plaintiffs’ counsel; (7) the awards in similar cases; (8) the value of benefits accruing to class members attributable to the efforts of class counsel as opposed to other groups; (9) the percentage fee that would have been negotiated in the case of a private contingent fee; and (10) any innovative terms of the settlement. In re AT&T Corp. Sec. Litig., 455 F.3d 160, 165–66 (3d Cir. 2006). The factors “need not be applied in a formulaic way,” and “one factor may outweigh the rest.” Id. at 166. Because several of the objections raised by Settlement Class Members touch on the fee request, the Court addresses each objection in conjunction with the Gunter/Prudential factor to which it is directed.

a) Size of the Fund Created and Number of Persons Benefitted The first factor is regarded as the “most critical” in the fee analysis. Hensley v. Eckerhart, 461 U.S. 424, 436 (1983). The Settlement establishes a $117,500,000 non-reversionary common fund for the benefit of approximately 31.5 million Settlement Class Members. This is among the largest data breach class action settlements in United States history and delivers, on a per-capita basis, one of the strongest recoveries ever achieved in a major consumer data breach settlement. Compare In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247 (11th Cir. 2021) ($380.5 million for approximately 147 million class members), with In re T-Mobile Customer Data Sec. Breach Litig., 2023 WL 11878508 (W.D. Mo. June 29, 2023) ($350 million for approximately 76.6 million class members), In re Cap. One Consumer Data Sec. Breach Litig., 2022 WL

18107626 (E.D. Va. Sept. 13, 2022) ($190 million for approximately 98 million class members), and In re Yahoo! Inc. Customer Data Sec. Breach Litig., 2020 WL 4212811 (N.D. Cal. July 22, 2020) ($117.5 million for approximately 194 million class members). Every Settlement Class Member is further entitled to enroll in at least three years of CyEx Financial Shield Complete— identity monitoring and restoration services with a retail value of over $500 per Class Member and up to $1 million in identity theft insurance—regardless of whether the Class Member submits a Claim Form. (Thompson Decl. ¶¶ 4–5.) This factor weighs in favor of the requested fee. Several objectors (Varga, Amanuel, Dixon, Skaggs, Chang, Ash, and Sims) contend that the requested one-third fee is excessive relative to what an individual Class Member will receive. This category of objection misapprehends both the value of the recovery and how common-fund fees are calculated. Controlling law measures the reasonableness of a common-fund fee against the fund as a whole, not against any individual Class Member’s recovery. See Boeing, 444 U.S. at 478 (“[A] lawyer who recovers a common fund for the benefit of persons other than himself or his

client is entitled to a reasonable attorney’s fee from the fund as a whole.”); In re Prudential, 148 F.3d at 333; Braun, 2025 WL 1314089, at *11. This methodology serves an important policy goal: incentivizing counsel to bring protracted and difficult class action claims on behalf of injured consumers. See In re WorldCom, Inc. Sec. Litig., 388 F. Supp. 2d 319, 359 (S.D.N.Y. 2005). Mr. Varga’s per-capita math further assumes a 100% claims rate. Consumer claims rates in approved data breach settlements are consistently well below 5%, see In re Wawa, Inc. Data Sec. Litig., 2024 WL 1557366, at *17 (2.56% claims rate); In re Anthem, Inc. Data Breach Litig., 327 F.R.D. at 321 (1.8% claims rate), and courts have consistently held that claims rates in cases like this one reflect a positive Class reaction rather than a defect. The objectors who compare the fee to the $50 Alternative Cash Payment (Skaggs, Ash) also omit the CyEx benefit entirely: a Class Member who

elects the Alternative Cash Payment in lieu of documenting Out-of-Pocket Losses receives a total benefit of approximately $550 or more, not $50. (Thompson Decl. ¶ 5.) These fee objections are overruled. b) Presence or Absence of Substantial Objections The second factor examines the class’s response to the fee request. Only 15 Settlement Class Members (0.00005%) filed timely objections to the Settlement or fee request, and several of objectors (Varga, Amanuel, Dixon, Skaggs, Chang, Ash, and Sims) raise concerns specifically directed to the fee, expenses, or service awards. The Third Circuit has characterized an objection rate of 2 out of 300,000 Class Members as a “rare phenomenon” that weighs in favor of final approval. In re Rite Aid, 396 F.3d at 305. The 15 timely objections filed here—out of a Class of approximately 31.5 million—reflect an objection rate approximately one-tenth of the rate the Third Circuit deemed a “rare phenomenon” in Rite Aid. This “vast disparity between the number of potential class members who received notice of the Settlement and the number of objectors”

creates a “strong presumption” favoring approval of the fee. In re Cendant, 264 F.3d at 235. For the reasons set forth throughout this Section, the Court has considered each objection to the fee on its merits and finds that none warrants disapproval or modification of the requested fee. This factor weighs in favor of the requested fee. c) Skill and Efficiency of Class Counsel Class Counsel are among the most experienced firms in data breach class action litigation nationally. Co-Lead Counsel Gary F. Lynch of Lynch Carpenter LLP and Norman E. Siegel of Stueve Siegel Hanson LLP have served as lead or co-lead counsel in the largest data breach cases in United States history, including In re Equifax, In re Capital One, and In re T-Mobile. Co-Liaison Counsel James A. Francis of Francis Mailman Soumilas, P.C. and Charles E. Schaffer of Levin

Sedran & Berman LLP bring comparable experience in complex consumer class actions in this District. (Prelim. Approval Counsel Decl. ¶¶ 2–3, 32–33; Counsel Fee Decl. ¶¶ 2–3.) The quality of representation delivered here is measured by the quality of the opposition Class Counsel faced. Defendants were represented throughout by sophisticated national defense firms. (Counsel Fee Decl. ¶ 59.) Comcast vigorously defended against Plaintiffs’ claims, including a factual Article III challenge resulting in jurisdictional discovery and a Daubert motion to exclude all three of Plaintiffs’ expert witnesses. Class Counsel navigated these challenges while continuing to advance the merits litigation and settlement discussions. The extraordinary result achieved—a $117,500,000 common fund on behalf of 31.5 million Class Members—is itself strong evidence of the skill applied to secure it. The efficiency of Class Counsel’s work is likewise significant. Notwithstanding five mediation sessions spanning six full days, two full rounds of Rule 12 motion practice, twenty-one depositions, and extensive jurisdictional and merits discovery, Class Counsel achieved a global

settlement in approximately two years. Efficient resolution is particularly important in data breach litigation, where “identity defense and credit monitoring . . . can have the most impact when delivered as near as possible to the breach.” In re T-Mobile, 2023 WL 11878508, at *17; In re Equifax, 2020 WL 256132, at *33 (factoring time limitations into the fee analysis); see also In re Target Corp. Cust. Data Sec. Breach Litig., 892 F.3d 968, 977 n.7 (8th Cir. 2018). This factor weighs in favor of the requested fee. d) Complexity and Duration of the Litigation Data breach litigation “is inherently complex” given “the difficulty of proving class-wide damages” and “issues about the duty of care” a defendant owes in connection with personal information. Corra, 2024 WL 22075, at *14; see also In re Onix, 2024 WL 5107594, at *14. This

litigation was more complex than most. Plaintiffs pursued a claim under the federal Cable Act—a statute that, to Class Counsel’s knowledge, has never been applied to a data breach by a cable operator. Whether the compromised information constitutes “personally identifiable information” under the Cable Act, and whether such information is sufficiently sensitive to satisfy the statute, were unresolved threshold questions. Plaintiffs’ claim against Citrix turned on whether a cybersecurity vendor owes a duty of care to end-users of its customers—people with whom Citrix had no direct relationship and whose data Citrix never directly handled. No court in this Circuit has squarely resolved that question. The factual issues were no less demanding: whether the last four digits of Social Security numbers are sufficiently sensitive, whether Comcast’s use of a single iteration of SHA-512 hashing was innocuous or dangerously susceptible to cracking, and whether Plaintiffs’ data appeared on the dark web were each genuinely contested and required expert testimony to resolve. The case spanned approximately two years from first-filed action to global resolution. This

factor weighs in favor of the requested fee. e) Risk of Nonpayment “[T]he fact that counsel took the case on a contingency basis weigh[s] in favor of granting the attorney’s fees.” In re Wawa, 141 F.4th at 466; see also Fulton-Green, 2019 WL 4677954, at *13. Class Counsel prosecuted this case on a fully contingent basis, advancing all litigation costs with no assurance of recovery. Beyond the ordinary contingency risk in class litigation, the litigation presented case-specific risks that could have foreclosed recovery entirely: an adverse ruling on Defendants’ motions to dismiss, an adverse ruling on the Daubert motion to exclude Plaintiffs’ experts, an adverse decision on the first-impression Cable Act theory, and an adverse decision on Citrix’s duty of care. Class Counsel further advanced $439,649.44 in litigation

expenses, including $132,020.92 in expert fees. (ECF No. 286-4.) Continued litigation would have entailed years of additional work with no guarantee of recovery. This factor weighs in favor of the requested fee. f) Time and Effort Devoted to the Case As of June 30, 2026, Class Counsel, including Court-appointed Plaintiffs’ Executive Committee, attested to devoting 11,442.2 hours to this litigation, resulting in a total lodestar of $9,926,175. (Class Counsel Decl. ¶ 9.) This figure may further increase; in Equifax, class counsel spent more than 8,000 hours at a lodestar of approximately $6,000,000 following the submission of the fee application. See Prelim. Approval Counsel Decl. ¶ 52; In re Equifax, 2020 WL 256132, at *32. Courts in this District have found even hundreds of hours of expended time sufficient to support a fee under this factor. See In re Onix, 2024 WL 5107594, at *14 (585 hours); Fulton- Green, 2019 WL 4677954, at *13 (560 hours); In re Philadelphia Inquirer Data Sec. Litig., No. CV 24-2106-KSM, 2025 WL 845118, at *13 (E.D. Pa. Mar. 18, 2025) (290 hours). This factor

weighs in favor of the requested fee. Mr. Sims, Mr. Roppolo, Mr. Corpe, and Mr. Ash object that Class Counsel has not adequately documented the time and expenses devoted to the case. These objections are moot. Class Counsel’s Fee Motion is supported by a detailed lodestar submission and itemized expense records (ECF Nos. 286-2, 286-4) that are publicly available on the Settlement Website. The record itemization was prepared in accordance with the billing protocol Class Counsel implemented on May 21, 2024, for all participating firms (Counsel Fee Decl. Ex. A), and Co-Lead Counsel conducted a comprehensive in-person review of all time before submission. (Counsel Fee Decl. ¶¶ 54–57.) The documentation each objector requests has already been provided.

g) Awards in Similar Cases Counsel’s requested one-third fee “is within the reasonable range of awards approved by the Third Circuit,” which “have ranged between 19% to 45% of the settlement fund” in common fund cases like this one. Holden v. Guardian Analytics, Inc., 2024 WL 2845392, at *11 (D.N.J. June 5, 2024). But that is a broad range; in data breach cases specifically, “attorney fees awards have generally been between 20% to 30% of the settlement.” Id. (collecting cases). In fact, “[m]any courts, including several in the Third Circuit, have considered 25% to be the “benchmark” figure for attorney fee awards in class action lawsuits, with adjustments up or down for significant case- specific factors.” In re Warfarin Sodium Antitrust Litig., 212 F.R.D. 231, 262 (D. Del. 2002), aff’d, 391 F.3d 516 (3d Cir. 2004) (collecting cases). Moreover, Third Circuit “jurisprudence confirms that it may be appropriate for percentage fees awarded in large recovery cases to be smaller in percentage terms than those with smaller recoveries.” In re Rite Aid, 396 F.3d at 302. In general, “100 million seems to be the informal marker of a ‘very large’ settlement.” In re Ikon Off. Sols., Inc., Sec. Litig., 194 F.R.D. 166, 195 (E.D. Pa. 2000). This factor weighs against the requested fee.

Two objectors propose specific caps: Mr. Sims proposes a 20% cap and Mr. Ash proposes a flat $7 million cap. Neither objection identifies a defect in Class Counsel’s fee methodology under settled precedent; neither addresses the Gunter/Prudential factors that govern reasonableness in this Circuit; and neither engages with the substantial risk Class Counsel undertook on contingency, the complexity of the litigation, the results achieved for the Class, or the quality of representation. Mr. Sims’s and Mr. Ash’s proposed caps are rejected. h) Benefits Attributable to Class Counsel’s Efforts The entirety of the recovery achieved for the Class is attributable to Class Counsel’s efforts. No parallel government investigation or enforcement action produced any portion of the Settlement Fund. Although mass arbitrations were filed in connection with the Data Breach, those

proceedings were largely resolved by the time of the Settlement and did not contribute to the result. (Counsel Fee Decl. ¶ 47.) Class Counsel conducted the discovery, retained and defended the experts, deposed fact and expert witnesses, defended the show-cause proceeding, and negotiated the $117.5 million recovery. See In re Rite Aid, 396 F.3d at 304–05 (weighing this factor in favor of fee approval where class counsel—not government investigators—drove the recovery). This factor weighs in favor of the requested fee. i) Private Contingent-Fee Benchmark The requested one-third fee is consistent with the percentage that sophisticated plaintiffs routinely negotiate with experienced plaintiffs’ counsel in private contingent-fee arrangements in complex, high-risk litigation. (Counsel Fee Decl. ¶ 48.) This factor weighs in favor of the requested fee. j) Innovative Settlement Terms The Settlement includes several structural features that maximize benefits to the Class: a

non-reversionary common fund; a pre-enrollment mechanism for Identity Defense Services that requires no Claim Form; a “greater of” claim mechanism ensuring Class Members with documented losses receive the higher of their documented amount or the Alternative Cash Payment; provision that Notice and Administration costs in excess of $7.3 million are separately paid by Comcast rather than deducted from the Settlement Fund; and access to Restoration Services for every Class Member for at least three years, regardless of whether the Class Member submits a claim. (Benefits Plan §§ 3–8; Settlement Agreement ¶¶ 3.1–3.2.) This factor weighs in favor of the requested fee. See McDonough v. Toys R Us, Inc., 80 F. Supp. 3d 626, 655 (E.D. Pa. 2015). B. Reimbursement of Litigation Costs and Expenses

The Court finds that the litigation costs and expenses incurred by Class Counsel in the prosecution of this Action, in the amount of $439,649.44, were reasonably and necessarily incurred and are properly reimbursable from the Settlement Fund. See Fed. R. Civ. P. 23(h); In re Aetna Inc., No. CIV. A. MDL 1219, 2001 WL 20928, at *13 (E.D. Pa. Jan. 4, 2001) (“Attorneys who create a common fund for the benefit of a class are entitled to reimbursement of reasonable litigation expenses from the fund.”). Class Counsel’s expense request is supported by detailed itemized records reflecting expenses for expert fees, mediation, court fees, deposition and transcript costs, electronic discovery, legal research, travel, and related litigation costs. (ECF No. 286‑4.) The Court has reviewed those records and finds each category reasonable in light of the complexity, duration, and litigation posture of this Action. For these reasons, the Court will grant Class Counsel attorneys’ fees in the amount of $31,725,000 (27% of the $117,500,000 Settlement Fund), together with any interest earned, and reimbursement of litigation costs and expenses of $439,649.44, to be paid from the Settlement Fund.3

C. Lodestar Cross-Check Although the Third Circuit does not require it, “the lodestar cross-check further supports the reasonableness of Class Counsel’s fee award.” Braun, 2025 WL 1314089, at *12. The lodestar cross-check “is performed by dividing the total recovery requested under the percentage-of-recovery method by counsel’s lodestar value, yielding a ‘lodestar multiplier.’” In re Domestic Drywall Antitrust Litig., No. 13-MD-2437, 2018 WL 3439454, at *3 (E.D. Pa. July 17, 2018). As of the filing of the Fee Motion, Class Counsel, including the Court-appointed executive committee had devoted 10,867.8 hours to the prosecution of this case, resulting in a total lodestar of $9,377,467. Since then, Class Counsel updated these figures in the motion for final approval indicating that Class Counsel committed 574.4 additional hours yielding a total lodestar of

3 In response to the Court’s June 30, 2026 Order, Plaintiffs identified that 480.2 hours submitted in this litigation were attributable to Plaintiffs’ pursuit of relief in Scheirer v. Comcast Cable Communications LLC et al., No. 25CV116323 (Cal. Super. Ct., Alameda Cnty.) and Emmett v. Comcast Cable Communications LLC et al., No. GD-25-003268 (Pa. Ct. Com. Pl., Allegheny Cnty.) (the “Protective Actions”). According to Plaintiffs, “the Protective Actions were prophylactic filings made in direct response to Defendants’ factual challenge to Article III standing in this Court and were undertaken to preserve the claims of the putative Class.” ECF No. 306. The Court was informed of the filing of these state court lawsuits after-the-fact by letters from Defense Counsel wherein complaints were raised regarding their need to defend the same case in new forums not covered by this lawsuit, which after all, was a class action suit comprised of other class action lawsuits. (ECF Nos. 174, 176). The Court was concerned regarding this lack of transparency in taking these actions and held a special hearing to decide whether these actions were such an insult to the Court as to warrant outright dismissal of the action or in the alternative, removal of lead counsel. (ECF No. 186). After the hearing, the Court decided that Counsel’s actions did not rise to the level that required either outright dismissal of the action or dismissal of lead counsel. (ECF No. 187). By the same logic, the Court now determines not to exclude these expenses from its award of Attorney’s Fees. $9,926,175. Dividing Class Counsel’s attorneys’ fee award of $31,725,000 by the total lodestar yields a multiplier of approximately 3.2. That multiplier falls comfortably within the range approved in the Third Circuit for comparable common-fund cases. See In re Prudential, 148 F.3d at 341 (multipliers up to four typically reasonable in common fund cases); Bodnar v. Bank of Am.,

N.A., No. 14-3224, 2016 WL 4582084, at *5–6 (E.D. Pa. Aug. 4, 2016) (approving 33% common-fund fee representing a 4.69 lodestar multiplier as “appropriate and reasonable”). Class Counsel further estimates that they will devote a significant number of additional hours to obtaining and defending final judgment and monitoring and implementing the Settlement, which will further reduce the multiplier. (Counsel Fee Decl. ¶¶ 26, 52.) Mr. Varga and Mr. Ash object that the Court should not approve the requested fee without first receiving a lodestar cross-check or complete fee-and-expense breakdown. Those objections are moot for the reasons explained in this Section and Section IV.B above. D. Award to Named Plaintiffs as Settlement Class Representatives The eleven Named Plaintiffs are appointed as Settlement Class Representatives, and each seeks a $5,000 service award, for a total of $55,000, to be paid from the Settlement Fund. “The

approval of contribution or incentive awards is common, especially when the settlement establishes a common fund.” In re CertainTeed Fiber Cement Siding Litig., 303 F.R.D. 199, 225 (E.D. Pa. 2014). “The purpose of these payments is to compensate named plaintiffs for the services they provided and the risks they incurred during the course of class action litigation, and to reward the public service of contributing to the enforcement of mandatory laws.” Id. Factors that courts consider in determining service awards include the risks to the plaintiffs in commencing the litigation (financially and otherwise), the extent of the plaintiffs’ personal involvement in the lawsuit, the duration of the litigation, and the plaintiffs’ personal benefits (or lack thereof) purely in their capacity as members of the class. See McGee v. Ann’s Choice, Inc., No. 12-2664, 2014 WL 2514582, at *3 (E.D. Pa. June 4, 2014). 1. The Requested $5,000 Service Awards are Reasonable The eleven Settlement Class Representatives have expended substantial time and effort on this litigation. They sought counsel to initiate this lawsuit and enforce their rights against

Defendants; assisted Class Counsel’s investigation and the development of the pleadings; participated in multiple interviews; produced documents; responded to formal and informal written discovery, including interrogatories, requests for production, and requests for admission; sat for depositions (most in person, in cities across the country including Chicago, Houston, Philadelphia, Pittsburgh, Miami, Columbus, and Atlanta); consulted with Class Counsel at critical junctures throughout the litigation; and provided key guidance in connection with the settlement negotiations and review of the Settlement Agreement. (Prelim. Approval Counsel Decl. ¶ 133; Counsel Fee Decl. ¶¶ 15, 67) Their contributions materially advanced the litigation and protected the Class’s interests, and the Settlement would not have been possible without their commitment. (Counsel Fee Decl. ¶ 67.)

The requested awards are also modest by prevailing standards in this District. Courts in this Circuit have consistently approved $5,000 service awards in data breach and data privacy class actions. See Braun, 2025 WL 1314089, at *13 (granting $5,000 service awards in data privacy class action); Clemens, 2024 WL 4530310, at *5 (same in data breach class action). 2. The Objections to the Requested Service Awards are Overruled Mr. Skaggs (ECF No. 288) and Mr. Ash (ECF No. 308) each object to the requested service awards, though on different grounds. Neither objection has merit. Mr. Skaggs’s Objection. Mr. Skaggs contrasts the $5,000 service award requested for each Class Representative with the $50 Alternative Cash Payment available to individual Class Members and contends that the disparity is unreasonable. This objection misapprehends the nature and function of a service award. Service awards compensate named plaintiffs for the time, effort, and personal exposure associated with serving as Class Representatives—including participating in investigation and discovery, sitting for depositions, and taking on the burden of representing

absent Class Members’ interests. They are not a proxy for individual recovery under the Settlement’s compensation tiers, and comparing them to the Alternative Cash Payment misunderstands what each is designed to do. As courts in this District recognize, “[c]ourts routinely approve incentive awards to compensate named plaintiffs for the services they provided and the risks they incurred during the course of the class action litigation.” Cullen v. Whitman Med. Corp., 197 F.R.D. 136, 145 (E.D. Pa. 2000). The Alternative Cash Payment, by contrast, is one component of the Settlement’s compensation structure designed to compensate absent Class Members for harm flowing from the Data Breach itself, without requiring documentation. The disparity that Mr. Skaggs identifies is also a feature, not a defect, of the Settlement’s design. Class Representatives assumed personal exposure and dedicated time and effort that no

absent Class Member was required to bear. Class Representatives’ names, personal circumstances, and depositions are now part of the public record in this litigation, and they responded to written discovery and produced personal documents in connection with prosecuting the Class’s claims. Absent Class Members bore none of those burdens. That the Settlement affords Class Representatives additional recognition for the disproportionate work they performed on behalf of the Class is entirely appropriate and consistent with the settled practice in this District. See Braun, 2025 WL 1314089, at *13; Clemens, 2024 WL 4530310, at *5. Mr. Skaggs’s objection additionally omits the value of the CyEx Financial Shield Complete services available to every Class Member, valued at over $500 per Class Member across the three- year term (Thompson Decl. ¶ 5), such that the true value of the Settlement’s per-Class Member benefit is approximately $550 or more—not $50. On any comparison, the requested $5,000 service award represents appropriate additional recognition for the Class Representatives’ additional contributions.

Mr. Ash’s Objection. Mr. Ash separately requests that the Court require Class Counsel to provide a per-Representative itemization of each Class Representative’s contribution before approving the requested service awards. That itemization has already been provided. Class Counsel’s Fee Motion—publicly filed on May 11, 2026, posted to the Settlement Website, and presently before this Court—describes in detail the work performed by the eleven Settlement Class Representatives in connection with this litigation, including their participation in investigation, document collection and review, discovery responses, depositions, mediation, and settlement negotiations. (ECF No. 286-2 ¶¶ 15, 67; ECF No. 286-1 at 27–28.) Mr. Ash’s request is moot. Mr. Page’s Request for $30 Million. As addressed above, Mr. Page (ECF No. 311) does not challenge the reasonableness of the requested $5,000 service awards for the Class

Representatives. Instead, he requests that the Court award him personally 10% of the Settlement Fund (up to $11 million) and 50% of the requested fee and expense award (up to $19 million)—a total of approximately $30 million to a single absent Class Member who identifies no individualized injury, no legal or factual defect in the Settlement, and no rule authorizing the requested relief. That request is not a cognizable objection under Rule 23(e)(5) and is overruled on the grounds set forth in Section III.F.2.b. The Court accordingly awards $5,000 to each of Patricia Andros, Michelle Birnie, Jessica Durham, Ryan Emmett, Vince Estevez, Alexander Nunn, Steven Prescott, Robert Smith, Veronica Verdier, Marcia Proto Wilson, and Jodi Wolfson, to be paid from the Settlement Fund. V. CONCLUSION The court retains exclusive jurisdiction, to the extent permitted by law, over matters that are the subject of this Order until after full disbursement of the Settlement, and as necessary to effectuate and enforce the terms of the Settlement Agreement. As identified by the Settlement Administrator, the Court finds that the individuals

identified in the Settlement Administrator Declaration have timely requested exclusion from the Settlement Class. ECF No. 315-3. These individuals are (a) excluded from the Rule 23 Class previously certified; (b) are not bound by the terms of the Settlement Agreement; (c) do not release Defendants and all other Released Parties from the Released Claims; and (d) are not entitled to participate in the monetary portion of the Settlement. IT IS THEREFORE ORDERED BY THE COURT THAT Plaintiffs’ Motion for Final Approval of Class Action Settlement and Plaintiffs’ Motion for Attorneys’ Fees, Costs, Expenses, and Service Awards will be granted in part, modified with the attorneys’ fee award as described above, and all objections will be overruled. This Action is hereby dismissed with prejudice and without costs, save for any individual claims brought by putative class members who timely and

validly excluded themselves from the Settlement Class, and the Clerk is hereby directed to enter final judgment.

Date: August 19, 2026 _/s/ John Milton Younge_____ Hon. John Milton Younge United States District Judge