Krant v. UnitedLex Corporation

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF KANSAS

JEREMY KRANT, TODD DEATON, THOMAS NASH, SHANA VACHHANI and KIMBERLY MILLER, individually and on behalf of all others similarly situated,

Plaintiffs,

v. Case No. 23-2443-DDC-TJJ

UNITEDLEX CORPORATION,

Defendant.

MEMORANDUM AND ORDER

On September 29, 2023, plaintiffs filed this lawsuit on behalf of themselves and other similarly-situated employees and former employees of defendant, UnitedLex Corp. (ULX). Doc. 1 at 1–2 (Compl. ¶¶ 2–3). ULX provides data management and professional services to law firms and corporate legal departments. Id. at 1 (Compl. ¶ 1). Plaintiff asserts that back in March 2023, hackers breached defendant’s servers and acquired plaintiffs’ personal identifying information (PII). Id. at 2 (Compl. ¶¶ 2–3). Plaintiffs allege that defendant failed to implement and maintain reasonable safeguards to protect its current and former employees’ PII, as well as its clients’ confidential information. Id. at 3 (Compl. ¶ 7). Plaintiffs also allege defendant attempted to cover up the breach, disclosing it only when the hackers went public. Id. at 2 (Compl. ¶ 4). The court stayed the case on January 12, 2024—at the parties’ joint request—so they could focus on mediation. Doc. 12. After the case settled at mediation, the court preliminarily certified a Settlement Class and preliminarily approved the proposed class action Settlement on July 23, 2024.1 Doc. 23. Now, plaintiffs Jeremy Krant, Todd Deaton, Thomas Nash, Shana Vachhani, and Kimberly Miller seek final approval of the Settlement and an award of fees, expenses, and service awards. To that end, plaintiffs have filed an Unopposed Motion for Approval for an Award of Attorneys’ Fees, Expenses, and Service Awards (Doc. 24) and an Unopposed Motion for Final Approval of Settlement and Award of Attorneys’ Fees, Expenses,

and Service Awards (Doc. 26). Plaintiffs ask the court to: (1) grant final approval of the settlement as fair, reasonable, and adequate; (2) certify the settlement class for the purpose of entering judgment on the proposed settlement; and (3) award attorney fees, expenses, and service awards. Doc. 26 at 1. ULX has not opposed the motions, and no Class Member has filed an objection to the motions. The court held a Final Approval Hearing on December 10, 2024. Doc. 28. After considering all the papers and proceedings conducted in this action, the court finds that the Settlement of this litigation is fair, reasonable, and adequate. The court thus grants plaintiffs’ motions.

I. Approval as Fair, Reasonable, and Adequate Rule 23(e) permits parties to settle the claims of a class action, but “only with the court’s approval.” And the court may approve a settlement only after conducting “a hearing” and finding that the settlement is “fair, reasonable, and adequate[.]” Fed. R. Civ. P. 23(e)(2). Rule 23 includes several factors that courts should consider when deciding whether a settlement is “fair, reasonable, and adequate[.]” These factors include whether: (A) the class representatives and class counsel have adequately represented the class;

1 This Order uses and incorporates by reference the definitions for defined terms used in the Settlement Agreement dated June 21, 2024 (Doc. 21-1). All capitalized terms used, but not defined in this Order, have the same meanings used in the Settlement Agreement. (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate, taking into account: i. the costs, risks, and delay of trial and appeal; ii. the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; iii. the terms of any proposed award of attorney’s fees, including timing of payment; and iv. any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other.

Fed. R. Civ. P. 23(e)(2).

Also, the Tenth Circuit has identified four factors that district courts must consider whenassessing whether a proposed settlement is “fair, reasonable, and adequate”: (1) whether the proposed settlement was fairly and honestly negotiated; (2) whether serious questions of law and fact exist, placing the ultimate outcome of the litigation in doubt; (3) whether the value of an immediate recovery outweighs the mere possibility of future relief after protracted and expensive litigation; and (4) the judgement of the parties that the settlement is fair and reasonable. Rutter & Wilbanks Corp. v. Shell Oil Co., 314 F.3d 1180, 1188 (10th Cir. 2002). The court previously granted preliminary approval of the Settlement, finding it “fair, reasonable, and adequate” as Fed. R. Civ. P. 23(e) requires. Doc. 23 at 5. Now, the court grants final approval of the Settlement because plaintiffs have shown that each of the Rule 23(e)(2) and Tenth Circuit factors is met here, as explained next.2

2 The Tenth Circuit’s factors “largely overlap” with the Rule 23(e)(2) factors, “with only the fourth factor not being subsumed” into Rule 23. Chavez Rodriguez v. Hermes Landscaping, Inc., No. 17-2142- JWB-KGG, 2020 WL 3288059, at *2 (D. Kan. June 18, 2020). And our court has considered “the Rule 23(e)(2) factors as the main tool in evaluating the propriety of the settlement[.]” Id. This court thus evaluates the Rule 23(e)(2) and Tenth Circuit factors in combined fashion here. But the court considers the Tenth Circuit’s fourth factor separately. A. CLASS ADEQUATELY REPRESENTED

First, the court finds that the Settlement Class Representatives and Class Counsel have represented the Class adequately. All the Class Representatives are former employees of ULX and, like the Class Members, the March 2023 data breach compromised their PII data. Each Class Representative has experienced identity theft injury in some form, including: fraudulent tax filings, fraudulent application for investing account, and a fraudulent new line of credit. Doc. 1 at 26, 28, 29, 30, 31 (Compl. ¶¶ 101, 112, 118, 120, 127, 138). These alleged injuries are consistent with the type of injuries plaintiffs allege that Class Members have experienced or could experience—“identity theft, financial fraud and other identify-related fraud[.]” Id. at 19– 20 (Compl. ¶ 76). The Class Representatives thus have represented adequately the interests of the Class.

Class Counsel also has represented the Class adequately by prosecuting their claims. Their work has involved significant time investigating claims, drafting a comprehensive class Complaint, and effectively mediating the case to resolution. Class Counsel, collectively, spoke to more than 50 former employees of ULX located across the country. Doc. 25-1 at 2 (Moore Decl. ¶ 3). They also insisted on discovery to determine the size and scope of the data breach before staying the case. Id. at 3 (Moore Decl. ¶ 6). And they spent multiple weeks negotiating the settlement’s terms. Id. at 4 (Moore Decl. ¶ 8). Counsel’s prosecution of the case has produced substantial relief for the Class in the negotiated Settlement. In sum, the court concludes that Class Counsel has represented the Class adequately. Thus, this first Rule 23(e)(2) factor favors approving the Settlement. B. NEGOTIATIONS

Second, the Settlement is the product of an arm’s length negotiation. The parties engaged an experienced and skilled mediator—Hon. Diane Welsh (Ret.)—who conducted a mediation session with the Settling Parties and their counsel. Id. at 3–4 (Moore Decl. ¶ 7). The mediation, which took place on March 26, 2024, lasted all day, resulting in a binding term sheet. Id. Through that mediation process, the parties successfully negotiated the Settlement that plaintiffs ask the court to approve. The court finds the second Rule 23(e)(2) factor favors approval.

C. ADEQUATE RELIEF Third, the court finds that the relief provided the Class through the Settlement is adequate. It bases this finding on the factors analyzed in subparts 1–3, following.

1. Costs, Risks, and Delay Take the costs, risks, and delay of trial. Fed. R. Civ. P. 23(e)(2)(C)(i). Continued litigation of the matter involves incurring additional costs and presents a risk that Class Members might secure an unfavorable outcome. Cost and risk are an especially salient concern in the data breach context because such cases are “particularly risky, expensive, and complex.”

Beasley v. TTEC Servs. Corp., No. 22-CV-00097-PAB-STV, 2024 WL 710411, at *5 (D. Colo. Feb. 21, 2024) (internal quotation marks and citation omitted). “Courts presiding over similar cases have recognized that the legal issues involved in data breach litigation are cutting-edge and unsettled, so that many resources would necessarily be spent litigating substantive law as well as other issues.” Id. (internal quotation marks and citation omitted). What’s more, trial would delay the benefit of time-sensitive protections for the Class—benefits such as credit card monitoring and identity restoration services that form part of the Settlement. See Doc. 26-1 at 15 (Notice). And immediate recovery is more valuable than a “mere possibility” that Class Members might achieve a more favorable outcome “after protracted and expensive litigation” that may well last “many years in the future.” See In re Syngenta Ag Mir 162 Corn Litig., No. 14-md-2591-JWL, 2018 WL 1726345, at *2 (D. Kan. Apr. 10, 2018) (“[I]t is reasonable to believe that the immediate recovery of such a substantial sum is more valuable than the mere possibility of a more favorable outcome after protracted and expensive litigation over many years in the future.”).

2. Proposed Methods of Distributing Relief and Processing Claims Next take the proposed methods of distributing relief and processing claims. Fed. R. Civ. P. 23(e)(2)(C)(ii). Based on the combined delivery of notice by mail and email, an estimated 84.5% of class members successfully received notice. Doc. 26-1 at 5 (Silva Decl. ¶ 9). Class members filed 523 valid claims, representing about 6.75% of the settlement class. Id. at 6 (Silva Decl. ¶ 14). See Forcellati v. Hyland’s Inc., No. CV 12-1983-GHK (MRWx), 2014 WL 1410264, at *6 (C.D. Cal. Apr. 9, 2014) (explaining that a claims rate of 3 to 5% is prevailing rule of thumb for consumer class actions); Beasley, 2024 WL 710411, at *5 (finding

that claims rate of 3.9% demonstrates that “the relief is adequate and class members support the settlement”). The proposed methods here are adequate.

3. Proposed Fees and Other Agreements Last take proposed fees and other agreements. Fed. R. Civ. P. 23(e)(2)(C)(iii)–(iv). The court concludes the requested attorney fees are fair and adequate, as discussed below. And the settling parties have no additional agreements. Doc. 21-1 at 34 (Settlement ¶ 115). Thus, the court finds that the third Rule 23(e)(2) factor—adequate relief—favors approving the Settlement.

D. EQUITABLE TREATMENT Fourth, the court finds that the Settlement treats Class Members equitably relative to one another. The Settlement allows each class member to file claims for out-of-pocket expenses, capped at $15,000 per individual, and reimbursement for lost time, capped at $500 per individual. Doc. 26-1 at 15 (Notice). Any money remaining after those reimbursements (and other settlement-related obligations) “will be split pro rata[.]” Id. Thus, each class member may claim recompense corresponding with their injuries. And anything left over, is split evenly—an inherently equitable arrangement. So, this fourth Rule 23(e)(2) factor also favors approval. In sum, all four Rule 23(e)(2) factors favor the court granting final approval of the Settlement.

E. TENTH CIRCUIT’S FOURTH FACTOR Also, the court finds the Settlement satisfies the Tenth Circuit’s fourth factor: the judgment of the parties that the settlement is fair and reasonable. Rutter, 314 F.3d at 1188. Plaintiffs’ request—that the court approve the Settlement—itself suggests that the parties view the Settlement as fair and reasonable. And, as of December 10, 2024—when the court conducted the fairness hearing—no Class Members had objected to the Settlement. See Doc. 26-1 at 7 (Silva Decl. ¶ 16). The absence of objections suggests the Class Members find the

Settlement fair and reasonable, as well. Plaintiffs and Class Counsel also attest that they “believe the Settlement is fair, adequate, and reasonable and should be approved.” Doc. 27 at 18. And defendant, at the Final Approval Hearing, agreed that the Settlement is fair and reasonable. Thus, the Tenth Circuit’s final factor—the only one not “subsumed into” the Rule 23 factors—also favors approval of the Settlement. Chavez, 2020 WL 3288059, at *2. For all the reasons discussed, the court finds that the Settlement is fair, reasonable, and adequate. It thus grants final approval of the Settlement under Fed. R. Civ. P. 23(e)

II. Settlement Class Certification for Purpose of Entering Judgment The court preliminarily certified the settlement class in its Order of July 23, 2024. Doc. 23 at 4. At the Final Approval Hearing, plaintiffs asserted that nothing has changed since that ruling. But that earlier Order didn’t outline with rigor how the class met each Rule 23 element,

so the court does so here. Class certification is appropriate if the district court finds, after conducting a “rigorous analysis,” that the proposed class satisfies the requirements of Fed. R. Civ. P. 23. Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 351 (2011) (citation and internal quotation marks omitted). The elements of class certification are (1) numerosity, (2) commonality, (3) typicality, and (4) adequate representation, plus one of the requirements of Rule 23(b)(1) through (3). Fed. R. Civ. P. 23. Plaintiffs seek certification under Rule 23(b)(3). Doc. 27 at 18. It requires the court to find “that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other

available methods for fairly and efficiently adjudicating the controversy.” Plaintiffs seek certification of the following Class for the purpose of entering judgment on the proposed Settlement: “[A]ll U.S. residents whose PII was compromised as a result of the Data Breach. Excluded from the Settlement Class is ULX, its representatives and any judicial officer presiding over this matter, members of their immediate family, and members of their judicial staff.” Doc. 21-1 at 10 (Settlement ¶ 45). The court applies each Rule 23 element of certification to plaintiffs’ identified Class, below.

A. NUMEROSITY As a general rule, classes of 40 or more are presumptively numerous. 1 Newberg and Rubenstein on Class Actions § 3:12 (6th ed. 2024 Update); see also Whitton v. Deffenbaugh Indus., Inc., No. 12-cv-02247-CM-KGG, 2016 WL 4493570, at *4 (D. Kan. Aug. 26, 2016). Here, about 7,588 individuals comprise the settlement class. Doc. 26-1 at 24 (Claim Form ¶ 5); Doc. 22 at 21. More than 7,000 class members easily qualifies as too numerous to make joinder practicable. On to the second element of certification.

B. COMMONALITY Commonality requires plaintiffs “to demonstrate that the class members have suffered the same injury.” Dukes, 564 U.S. at 350 (citation and internal quotation marks omitted). Our court has found an alleged injury of personal data theft a sufficient basis for commonality. See Hapka v. CareCentrix, Inc., No. 16-CV-02372-KGG, 2018 WL 1871449, at *2 (D. Kan. Feb. 15, 2018) (“Settlement Class Members are joined by the common questions of law and fact that arise from

the same event—the data breach.”). Here, each class member suffered or may suffer the same alleged injury—theft of their personal data—from the same event, the March 2023 data breach. And plaintiffs identify the following common questions: “(1) whether and to what extent ULX had a duty to protect and safeguard the PII of plaintiffs and Class Members . . . ; (2) whether ULX breached that duty by failing to implement and maintain data security procedures and practices . . . ; and (3) whether plaintiffs and the Settlement Class were injured as a result of the Data Breach.” Doc. 22 at 22. The proposed Class thus satisfies commonality. Up next: the third element of certification.

C. TYPICALITY A plaintiff may satisfy the typicality requirement when “her claim arises from the same factual nexus and is based on the same legal theories as the claims of members of the Settlement Class.” Hapka, 2018 WL 1871449, at *2. Here, the settlement class representatives “are former employees or spouses of ULX employees who were victims of the Data Breach and suffered identity theft or fraud as a result of the Data Breach.” Doc. 22 at 23. And the Class Representatives and Members share “the same tort and contract theories” causing their “litigation

goals [to] align precisely.” Id. The proposed Class thus satisfies typicality. Adequate representation is next.

D. ADEQUATE REPRESENTATION Determining adequacy of representation turns on two questions: “whether the named plaintiffs and their counsel have any conflicts of interest with other class members” and “whether the named plaintiffs and their counsel will prosecute the action vigorously on behalf of the class.” In re Motor Fuel Temperature Sales Pracs. Litig., 292 F.R.D. 652, 671 (D. Kan. 2013). Here, the alleged injuries all arose from the same event, suggesting no conflict of interest exists between the named plaintiffs and the other Class Members. See In re Equifax Inc. Customer Data Sec.

Breach Litig., 999 F.3d 1247, 1276 (11th Cir. 2021) (finding adequate representation satisfied in data breach context when the “class members all had their personal information compromised in the same data breach [and] they seek redress for similar injuries”). And the named plaintiffs and their Counsel demonstrated their resolve to prosecute the action vigorously by, for example, refusing to accept a stay of the case without first completing the necessary discovery. Doc. 25-1 at 3 (Moore Decl. ¶ 6). The proposed Class thus satisfies adequate representation. All that remains is the two-pronged fifth element of certification—predominance and superiority.

E. PREDOMINANCE / SUPERIORITY 1. Predominance “Rule 23(b)(3) requires a showing that questions common to the class predominate[.]” Amgen, Inc. v. Conn. Ret. Plans & Tr. Funds, 568 U.S. 455, 459 (2013) (emphasis omitted). “[P]redominance may be destroyed if individualized issues will overwhelm those questions common to the class[.]” Wallace B. Roderick Revocable Living Tr. v. XTO Energy, Inc., 725 F.3d 1213, 1220 (10th Cir. 2013). Plaintiffs here contend that the “key predominating questions are whether ULX had a duty to exercise reasonable care in safeguarding, securing, and protecting the PII of Plaintiffs and the Settlement Class and whether ULX breached that duty.” Doc. 22 at 24. All Class Members’ individual claims would rise and fall on these predominate questions, undermining any concern about overwhelming individualized issues.

2. Superiority Class resolution is superior to other means when “potential damages suffered by individual class members are relatively low-dollar amounts and may be uneconomical to pursue on an individual basis given the burden and expense of prosecuting individual claims.” Hapka, 2018 WL 1871449, at *3. As plaintiffs note, this case requires experts to explain how and why

the data breach occurred—resulting in higher costs to litigate. Doc. 22 at 26. So, the relatively low-dollar recovery for an individual plaintiff wouldn’t justify the high litigation expense. Class resolution is superior to prosecuting individual claims here. Concluding the proposed Class satisfies all requisite elements, the court certifies the Settlement Class for the purpose of entering judgment on the proposed Settlement. The court now turns to plaintiffs’ final request—awarding attorney fees, expenses, and service awards.

III. Attorney Fees, Expenses, and Service Awards Plaintiffs request an award of attorney fees equal to one-third of the Settlement Amount ($1.3 million), totaling $433,333.00. Doc. 24 at 1. They also move for costs and expenses in the amount of $28,755.17. Id. Finally, they request service awards for Mr. Behrendt in the amount of $2,500, Mr. Krant in the amount of $1,360, and for Ms. Miller in the amount of $780. Id. The Notice given the Class fairly and adequately notified Class Members of their right to object to the requests for attorney fees, expenses, and service awards. Doc. 26-1 at 15 (Notice). A. ATTORNEY FEES Under Rule 23(h) of the Federal Rules of Civil Procedure, in “a certified class action, the court may award reasonable attorneys’ fees and nontaxable costs that are authorized by law or by the parties’ agreement.” The parties’ Settlement Agreement expressly provides for an award of attorney fees and expenses paid from the Settlement Fund to Class Counsel for work performed for the benefit of the Class Members. See Doc. 21-1 at 32 (Settlement ¶ 110) (providing that Class Counsel intends to seek an attorney fee award of up to one-third of the $1,300,000 Settlement Amount). The attorney fees requested and awarded here are authorized under the common fund doctrine. See Boeing Co. v. Van Gemert, 444 U.S. 472, 478 (1980) (“[A] litigant

or a lawyer who recovers a common fund for the benefit of persons other than himself or his client is entitled to a reasonable attorneys’ fee from the fund as a whole.”). The Tenth Circuit prefers the percentage-of-the-fund method when determining the award of attorney fees in common fund cases. See Chieftain Royalty Co. v. Enervest Energy Institutional Fund XIII-A, L.P., 888 F.3d 455, 458 (10th Cir. 2017) (“This court has approved both methods in common- fund cases, although expressing a preference for the percentage-of-the-fund approach.”). This

method calculates the fee as a reasonable percentage of the value attained for the benefit of the class. See Brown v. Phillips Petrol. Co., 838 F.2d 451, 454 (10th Cir. 1988). The Tenth Circuit also has instructed that a court making a percentage-based fee award in a common fund case should analyze the reasonableness of the fee award under the Johnson factors. See id. at 454–55 (citing Johnson v. Ga. Highway Express, Inc., 488 F.2d 714, 717–19 (5th Cir. 1974)). The weight given to each Johnson factor varies from case to case, and every factor doesn’t always apply. See id. at 456 (finding that “rarely are all of the Johnson factors applicable; this is particularly so in a common fund situation”). The Tenth Circuit has identified the Johnson factors in this fashion:

(1) the time and labor involved; (2) the novelty and difficulty of the questions; (3) the skill requisite to perform the legal service properly; (4) the preclusion of other employment by the attorney due to acceptance of the case; (5) the customary fee; (6) any prearranged fee—this is helpful but not determinative; (7) time limitations imposed by the client or the circumstances; (8) the amount involved and the results [secured]; (9) the experience, reputation, and ability of the attorneys; (10) the undesirability of the case; (11) the nature and length of the professional relationship with the client; and (12) awards in similar cases.

Id. at 454–55. The court finds that the request for an award of attorney fees in the amount of one-third of the Settlement Amount is reasonable under the Johnson factors. The court addresses each applicable factor, in order of importance, below. 1. Amount Involved and Results Secured (Factor 8) The court finds that the result factor here deserves greater weight than the other Johnson factors. See id. at 456 (holding a court may give this factor greater weight when “the recovery was highly contingent” and “efforts of counsel were instrumental in realizing recovery on behalf of the class”); see also Farrar v. Hobby, 506 U.S. 103, 114 (1992) (“[T]he most critical factor in

determining the reasonableness of a fee award is the degree of success [secured].” (citation and internal quotation marks omitted)). Data breach litigation is complex, risky and involves many unsettled areas of law. See Beasley, 2024 WL 710411, at *5. Here, plaintiffs’ counsel secured a substantial result for the Class Members. Plaintiffs asserted at the Final Approval Hearing that the result here provides a significantly higher percentage based on a per-person basis than other data breach settlements. The $1,300,000 recovery here is substantial, guaranteed, and non-reversionary. Doc. 21-1 at 11 (Settlement ¶ 48). Class Members are entitled to reimbursement up to $15,000 in out-of-pocket costs and reimbursement of Class Members’ time spent remedying issues related to the data breach up to $25/hour per hour (up to $500 per individual). Id. at 17, 18 (Settlement ¶¶ 71, 73). In addition to

reimbursement, Class Members are entitled to a pro-rata distribution of all remaining cash to participating Settlement Class Members. Id. at 18 (Settlement ¶ 75). And there’s more. Participating Settlement Class Members will receive three additional years of credit monitoring, paid separately—not from the Settlement Fund—and ULX must make significant changes to its data security. See id. at 19, 23–24 (Settlement ¶¶ 77, 88–89). The court finds that the result attained Johnson factor favors awarding Class Counsel the one-third fee. 2. Customary Fee (Factor 5) and Awards in Similar Cases (Factor 12) Class actions “typically involve a contingent fee arrangement because it insulates the class from the risk of incurring legal fees and shifts that risk to counsel.” Nieberding v. Barrette Outdoor Living, Inc., 129 F. Supp. 3d 1236, 1250 (D. Kan. 2015) (citation omitted). Our court consistently has recognized that a “one-third fee is customary in contingent-fee cases (factor 5)[.]” In re Syngenta AG MIR 162 Corn Litig., 357 F. Supp. 3d 1094, 1113 (D. Kan. 2018). And it is “well within the range typically awarded in class actions.” Nieberding, 129 F. Supp. 3d at 1250. In fact, in cases with increased complexity and risk, fee awards may exceed one-third of the

common fund attained. See Nakamura v. Wells Fargo Bank, Nat’l Assn., No. 17-4029-DDC-GEB, 2019 WL 2185081, at *2–3 (D. Kan. May 21, 2019) (citing fee awards in the Tenth Circuit based on 40% of the common fund). What’s more, in our court, an attorney fee award of one-third is consistent with fees awarded in other high-risk, complex class actions resulting in the creation of a common fund. See, e.g., In re EpiPen (Epinephrine Injection, USP) Mktg., Sales Pracs. & Antitrust Litig., No. 17-md-2785-DDC-TJJ, 2022 WL 2663873, at *4–6 (D. Kan. July 11, 2022) (awarding 33.33% attorney fees on a $264 million class recovery); In re Syngenta, 357 F. Supp. 3d at 1113–14 (awarding 33.33% attorneys’ fees on a $1.51 billion class recovery); In re: Urethane Antitrust Litig., No. 04-1616-JWL, 2016 WL 4060156, at *8 (D. Kan. July 29, 2016) (awarding

33.33% attorneys’ fees on a $835 million class recovery); Hershey v. ExxonMobil Oil Corp., No. 07-1300-JTM, 2012 WL 5306260, *1, 7–8 (D. Kan. Oct. 26, 2012) (awarding 33.33% attorneys’ fees on a $54 million class recovery). Finally, a one-third fee also aligns with those awarded by other courts in data breach class action cases. See, e.g., In re Forefront Data Breach Litig., No. 21-CV-887, 2023 WL 6215366, at *8 (E.D. Wis. Mar. 22, 2023) (awarding one-third common fund fee in ransomware cyberattack case with settlement fund of $3.75 million); In re Novant Health, Inc., No. 22-CV-697, 2024 WL 3028443, at *11 (M.D.N.C. June 17, 2024) (collecting cases where one-third settlement fund awarded in data privacy class actions and approving the same); In re Citrix Data Breach Litig., No. 19-61350-CIV-ALTMAN/Hurt, 2021 WL 2410651, at *4 (S.D. Fla. June 11, 2021) (approving 32.9% award in personal information data breach case). The court concludes the requested fee of one-third is both customary and consistent with awards in similar cases, and thus supports a fee award of one-third of the Settlement Amount. On to the next pair of Johnson factors. 3. Contingent Fee Arrangement (Factor 6) and Desirability (Factor 10)

The court recognizes the significant risk Class Counsel has assumed in prosecuting this complex data breach case on a wholly contingent basis. They necessarily and reasonably expended a large amount of time with a “substantial risk of no recovery[.]” In re Syngenta, 357 F. Supp. 3d at 1114; see also Doc. 25-1 at 2 (Moore Decl. ¶ 2) (explaining that Class Counsel “prosecuted this case on a contingent-fee basis with no guarantee of recovery”). The court finds that the risk of significant expenditures on a contingent basis and a substantial risk of no recovery favors the requested one-third fee award. See In re Syngenta, 357 F. Supp. 3d at 1114 (finding that the case was “less than desirable (factor 10)” when “plaintiffs’ counsel risk[ed] huge expenditures on a contingent basis, with a substantial risk of no recovery”). Factors 6 and 10 thus suggest the requested fee here is reasonable. Next up: three more Johnson factors.

4. Novelty and Difficulty (Factor 2); Skill (Factor 3); and Experience (Factor 9) Class actions “have a well deserved reputation as being most complex.” Cotton v. Hinton, 559 F.2d 1326, 1331 (5th Cir. 1977). What’s more, as recognized by other courts, data breach cases are especially risky, expensive, and complex given the unsettled nature of the law. See, e.g., Beasley, 2024 WL 710411, at *5; In re Sonic Corp. Customer Data Sec. Breach Litig., No. 17-md-2807, 2019 WL 3773737, at *7 (N.D. Ohio Aug. 12, 2019) (“Data breach litigation is complex and risky. This unsettled area of law often presents novel questions for courts. And of course, juries are always unpredictable.”); In re Target Corp. Customer Data Sec. Breach Litig., MDL No. 14-2522 (PAM/JJK), 2015 WL 7253765, at *2 (D. Minn. Nov. 17, 2015) (identifying the legal issues in data breach cases as “cutting edge” and “unsettled”), rev'd and remanded on other grounds, 847 F.3d 608 (8th Cir. 2017). Data breach class actions thus are novel and difficult, requiring skill and experience. Class Counsel possesses those two qualities in spades. Indeed, J. Austin Moore notes that he and his firm “have significant experience litigating data

breach class actions, including serving as co-lead counsel in the three largest data breach settlements in history.” Doc. 21-2 at 9 (Moore Decl. ¶ 21). Such a record reveals both skill and experience. The court recognizes the effort, skill, and zeal of Class Counsel to reach this favorable result and secure relief for the class now, rather than face a potential dismissal. These three Johnson factors strongly support the requested fee’s reasonableness. Two more factors to go. 5. Time and Labor (Factor 1) This Johnson factor guides the lodestar analysis in a statutory fee-shifting case but has minimal importance in a percentage-of-the-common-fund case. See Nakamura, 2019 WL 2185081, at *3. In fact, a lodestar analysis—effectively a crosschecking mechanism—is neither

required nor needed to assess the reasonableness in a percentage of the fund determination. See id. (first citing Brown, 838 F.2d at 456, 456 n.3; then citing Chieftain Royalty Co. v. XTO Energy, Inc., No. CIV-11-29-KEW, 2018 WL 2296588, at *3 (E.D. Okla. Mar. 27, 2018) (neither lodestar analysis nor lodestar crosscheck is required); and then citing Childs v. Unified Life Ins. Co., No. 10-CV-23-PJC, 2011 WL 6016486, at *15 n.10 (N.D. Okla. Dec. 2, 2011) (“Because the other Johnson factors, combined, warrant approval of the common fund fee sought by class counsel, the Court need not engage in a detailed, lodestar-type analysis of the ‘time and labor required’ factor.”)). Here, Class Counsel devoted 841.7 hours of time and labor to this litigation. Doc. 25-1 at 4 (Moore Decl. ¶ 12). Our court has recognized fewer total hours as still representing significant time and labor. See McFadden v. Sprint Commc'ns, LLC, No. 22-2464-DDC-GEB, 2024 WL 3890182, at *7 (D. Kan. Aug. 21, 2024) (finding counsels’ total 688.7 hours sufficient for reasonableness under Factor 1). And Class Counsel assured the court that the firms’ time

and expenses were reviewed and deemed necessary to prosecute this action effectively. See Doc. 25-1 at 4 (Moore Decl. ¶ 11). Thus, the court finds, the time and labor factor, to the extent this factor matters in a percentage-of-the-fund case, favors awarding a one-third fee. This conclusion leads, finally, to the last factor the court must consider here. 6. Preclusion of Other Employment (Factor 4) “When ‘an attorney is spending time on one case, he is not spending the same time on another case.’” In re EpiPen, 2022 WL 2663873, at *6 (quoting Wiggins v. Roberts, 551 F. Supp. 57, 61 (N.D. Ala. 1982)). Counsel have represented they have committed 841.7 hours to this case and expended $28,755.17 in expenses. Doc. 25-1 at 4–5 (Moore Decl. ¶¶ 12–13). The time spent on this case suggests counsel rejected other employment opportunities in favor of devoting

time here. The court concludes that this final factor supports the requested one-third fee and demonstrates its reasonableness. 7. Last Two Considerations (Factors 7 and 11) and Conclusion The other two Johnson factors—time limitations imposed by the client or circumstances (Factor 7) and nature and length of the professional relationship with the client (Factor 11)—are of nominal or no importance here. Thus, the court doesn’t address them. For all these reasons, the court concludes that the Johnson factors strongly support and warrant an award of attorney fees in the amount of one- third of the $1,300,000 Settlement amount. The court thus awards attorney fees from the Settlement Fund of $433,333. B. EXPENSES Rule 23(h) authorizes courts to reimburse counsel for “nontaxable costs that are authorized by law or by the parties’ agreement.” Fed. R. Civ. P. 23(h). The Settlement

Agreement authorizes Class Counsel to seek “reimbursement of litigation costs and expenses.” Doc. 21-1 at 32 (Settlement Agreement ¶ 110). And the Claim Form specified a cap on those expenses at $30,000. Doc. 26-1 at 27 (Claim Form ¶ 15). Class Counsel have incurred $28,755.17 in total expenses and costs in prosecuting this case. Doc. 25-1 at 4 (Moore Decl. ¶ 13). Courts have considered expenses reasonable when they “are of the kind and character typically borne by clients in non-contingent fee litigation, including the retention of experts, copying charges, transcript charges, online research and mediation services.” In re Bank of Am. Wage & Hour Emp. Litig., No. 10-MD-2138-JWL, 2013 WL 6670602, at *4 (D. Kan. Dec. 18, 2013); see also Reynolds v. Fid. Invs. Institutional Operations Co., Inc., No. 18-CV-423, 2020 WL 92092, at *4 (M.D.N.C. Jan. 8, 2020) (finding reasonable

expenses to include “mailing costs, online legal research, long-distance telephone use, expert and mediator fees, travel expenses for mediation and court proceedings, and court filing fees”). The chart outlining the expenses here reveals they correspond with expenses considered reasonable in the above cited cases.3 Doc. 25-1 at 4–5 (Moore Decl. ¶ 13). And Class Counsel represented the

3 The court is mindful that it—as “the class action court”—serves “as a fiduciary for the absent class members[.]” 5 Newberg and Rubenstein on Class Actions § 16:1 (6th ed. 2024 Update). This obligation means the court must ensure any reimbursements from the Settlement Fund are appropriate. Id. In its review of the reported expenses, the court considered whether it properly could categorize Class Counsel’s travel expenses (totaling $8,099.71) separately as expenses, or whether they should fall under the attorney fees award. In another context, the Tenth Circuit recently remanded a costs award for the district court to re-categorize travel costs as attorney fees. United States v. $114,700.00 in U.S. Currency, No. 20-1387, 2023 WL 142257, at *5 (10th Cir. Jan. 10, 2023) (“The District Court did, however, err expenses incurred were necessary to litigate this case effectively, and were of the type counsel normally would charge a paying client. Id. The court thus finds that the award of these expenses

when it determined that travel expenses are costs.”). The Circuit categorically stated—without any qualifiers or contextual constraints—that “[t]ravel expenses are attorneys’ fees.” Id. Despite this language, the court here approves Class Counsel’s travel expenses as expenses—not attorney fees. That’s because $114,700.00 in U.S. Currency addresses taxable costs under Fed. R. Civ. P. 54(d)(1) and 28 U.S.C. § 1920, while this case deals with nontaxable costs under Fed. R. Civ. P. 23(h) and 54(d)(2). And, as plaintiffs’ supplemental brief on the issue argues, that difference matters. See Doc. 29 at 4–7.

Fed. R. Civ. P. 54(d)(1) provides the court discretion to approve taxable costs. But the Supreme Court has limited the costs available under Rule 54(d)(1) to those specifically listed in 28 U.S.C. § 1920. Crawford Fitting Co. v. J. T. Gibbons, Inc., 482 U.S. 437, 441–42 (1987) (“Section 1920 enumerates expenses that a federal court may tax as a cost under the discretionary authority found in Rule 54(d). . . . The discretion granted by Rule 54(d) is . . . solely a power to decline to tax, as costs, the items enumerated in § 1920.” (emphasis added)); see also $114,700.00 in U.S. Currency, 2023 WL 142257, at *5 (“Section 1920 catalogues taxable costs . . . . This list is exhaustive to cost awards unless a statute explicitly provides for more.”). The permissible § 1920 taxable costs list doesn’t include travel expenses. See 28 U.S.C. § 1920(1)–(6). And so, in $114,700.00 in U.S. Currency, our Circuit necessarily disallowed travel expenses as taxable costs under Rule 54(d)(1) and § 1920.

Here, though, Rules 23(h) and 54(d)(2) govern cost recovery, because this is a class action suit. See 5 Newberg and Rubenstein on Class Actions § 16:5 (6th ed. 2024 Update) (“Rule 23(h) governs costs recovery in class suits and, in doing so, references Rule 54(d)(2).”). And Rule 23(h) provides that “the court may award reasonable attorney’s fees and nontaxable costs that are authorized by law or by the parties’ agreement.” The taxable costs list in § 1920 thus doesn’t define the nontaxable costs allowed under Rule 23(h)—and Rule 54(d)(2). Instead—at least here—the parties’ agreement does. The parties’ agreement doesn’t address explicitly travel expenses. See generally Doc. 21-1 (Settlement). But it defines “Litigation Costs and Expenses” to include “costs and expenses incurred by counsel for Plaintiffs in connection with commencing, prosecuting, and settling the Action.” Id. at 6 (Settlement ¶ 20). The court concludes—unconstrained by the list in § 1920—that this definition here reasonably contemplates travel expenses. What’s more, other courts awarding costs under the common fund doctrine have approved travel expenses. See In re Syngenta, 2018 WL 6839380, at *15 (awarding travel expenses as part of reasonable expenses from the settlement fund, “separate from the one-third award of attorney fees”); Voulgaris v. Array Biopharma Inc., No. 17-CV-02789-KLM, 2021 WL 6331178, at *14 (D. Colo. Dec. 3, 2021), aff'd, 60 F.4th 1259 (10th Cir. 2023) (identifying reasonable travel expenses as part of the litigation costs and expenses courts regularly award).

Awarding Class Counsel’s travel expenses here also comports with the working understanding of nontaxable costs as a “broader category” of recoverables than taxable costs. 5 Newberg and Rubenstein on Class Actions § 16:11 (6th ed. 2024 Update). That is, nontaxable costs comprise a “category of costs encompassing all out-of-pocket expenses that would normally be charged to a fee paying client[.]” Id. Here, Class Counsel clarified at the Final Approval Hearing (and in their supplemental brief) that they incurred the travel expenses to attend the mediation in Pennsylvania with a mediator with data breach experience—Hon. Diane Welch (Ret.). Doc. 29 at 7. Counsel reports that Judge Welch has mediated some of the largest data breach cases in the country and is “one of the nation’s most experienced data breach mediators.” Id. The court thus concludes a fee-paying client would pay for this travel and awards Class Counsel’s travel expenses as expenses here. is fair and reasonable, and the court approves payment under the Settlement Agreement. One final approval remains: service awards. C. SERVICE AWARDS “At the conclusion of a class action, the class representatives are eligible for a special payment in recognition of their service to the class.” 5 Newberg and Rubenstein on Class

Actions § 17:1 (6th ed. 2024 Update); accord In re EpiPen, 2022 WL 2663873, *6 (D. Kan. 2022) (quoting Newberg and Rubenstein on Class Actions). “Service payments induce individuals to become class representatives and reward them for time sacrificed and personal risk incurred on behalf of the class.” Harlow v. Sprint Nextel Corp., No. 08-2222-KHV, 2018 WL 2568044, at *7 (D. Kan. June 4, 2018) (citing UFCW Loc. 880-Retail Food Emp. Joint Pension Fund v. Newmont Mining Corp., 352 F. App’x 232, 235 (10th Cir. 2009)). Our Circuit has directed district courts to make incentive awards proportional to each class representative’s contribution. Chieftain, 888 F.3d at 468. Class Counsel have requested service awards to three Class Representatives based on the time they devoted to representing the Class in the following amounts: Adam Behrendt $2,500

for 33 hours worked, Doc. 25-2 at 2–3 (Behrendt Decl. ¶¶ 4–7), Jeremy Krant $1,360 for 13.6 hours worked, Doc. 25-3 at 2–3 (Krant Decl. ¶¶ 4–7), and Kimberly Miller $780 for 7.8 hours worked, Doc. 25-4 at 2–3 (Miller Decl. ¶¶ 4–7). See Doc. 24 at 1 (requesting specified amounts for specified individuals). Class Representatives provided key insight about the data breach to aid Class Counsel’s investigation, reviewed court filings, communicated with Class Counsel throughout the litigation, and consulted with Class Counsel during the Settlement negotiations. Doc. 25-1 at 4–5 (Moore Decl. ¶ 14). They merit an award. Also, this court has found that a rate of $100 per hour is a reasonable one.4 See McFadden, 2024 WL 3890182, at *8. The court concludes such an award is appropriate, considering: the total number of hours plaintiffs contributed; the total service award requested here; and the complexity of a data breach class action. So, the court awards plaintiff Behrendt a $2,500 service award, plaintiff Krant a $1,360 service award, and plaintiff Miller a $780 service

award. IV. Conclusion The court retains jurisdiction, to the extent permitted by law, over matters that are the subject of this Order until after full disbursement of the Settlement, and as necessary to effectuate the terms of the Settlement Agreement. As identified by the Settlement Administrator, the court finds that three individuals (identified in Exhibit E to the Declaration of Omar Silva) have timely requested exclusion from the Settlement Class. Doc. 26-1 at 7 (Silva Decl. ¶ 15); id. at 31 (Ex. E). These individuals are (a) excluded from the Rule 23 Class previously certified; (b) are not bound by the terms of the

Settlement Agreement; (c) do not release Defendant and all other Released Parties from the Released Claims; and (d) are not entitled to participate in the monetary portion of the Settlement. IT IS THEREFORE ORDERED BY THE COURT THAT plaintiffs’ Unopposed Motion for Approval of an Award of Attorneys’ Fees, Expenses, and Service Awards (Doc. 24) is granted.

4 Plaintiff Behrendt receives a rate of $75.76 per hour ($2,500 / 33 hours). The Settlement Agreement capped any service award at $2,500. See Doc. 21-1 at 32 (Settlement ¶ 108). Hence, there’s a discrepancy between plaintiff Behrendt’s award rate compared to the other two Class Representatives. IT IS FURTHER ORDERED THAT plaintiffs’ Unopposed Motion for Final Approval of Settlement, and Award of Attorneys’ Fees, Expenses, and Service Awards (Doc. 26) is granted, consistent with this Order. IT IS SO ORDERED.

Dated this 19th day of December, 2024, at Kansas City, Kansas.

s/ Daniel D. Crabtree Daniel D. Crabtree United States District Judge