Rodriguez v. Professional Finance Company, Inc.

• Court: District Court, D. Colorado
• Decided: October 15, 2024
• Docket: 1:22-cv-01679
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO Judge Regina M. Rodriguez

Civil Action No. 22-cv-01679-RMR-STV

MARITZA RODRIGUEZ, et al., behalf of herself and all others similarly situated,

Plaintiffs,

v.

PROFESSIONAL FINANCE COMPANY, INC.,

Defendant.

ORDER GRANTING PRELIMINARY APPROVAL OF PROPOSED CLASS ACTION SETTLEMENT

This case is before the Court on the parties’ Joint Motion for Preliminary Approval of a Class Action Settlement, ECF No. 56. For the reasons discussed below, the motion is GRANTED. I. BACKGROUND This case arises from a data security incident experienced by Defendant Professional Finance Company, Inc. (“PFC”) on February 26, 2022 (the “Data Security Incident”) that involved the unauthorized access of files containing the personal identifying information (PII) and protected health information (PHI) of approximately 2,000,000 individuals. ECF No. 28 ¶¶ 4-5, 9-11, 44-46; ECF No. 56-1 ¶¶ 21, 22. Plaintiffs allege the Data Security Incident put them and other Class Members at risk of imminent, immediate, and continuing risk of harm from fraud and identity theft. Id. ¶¶ 140, 155, 168, 179, 192. Defendant denies any wrongdoing or liability. Plaintiffs assert various common law and statutory claims. ECF No. 28. Soon after Plaintiffs filed their Consolidated Complaint, the parties began discussing the prospect for early resolution. ECF No. 56-1 ¶ 13. The parties now jointly ask the Court to certify the settlement class and preliminarily approve the proposed settlement. ECF No. 56; ECF No. 56-2 (Settlement Agreement). II. PRELIMINARY APPROVAL OF CLASS ACTION SETTLEMENT Approval of a class action settlement under Federal Rule of Civil Procedure 23

takes place in two stages. In the first stage, the Court preliminarily certifies a settlement class, preliminarily approves the settlement agreement, and authorizes that notice be given to the class so that interested class members may object to the fairness of the settlement. In the second stage, after notice is given to the putative class, the Court holds a fairness hearing at which it will address (1) any timely objections to the treatment of this litigation as a class action, and (2) any objections to the fairness, reasonableness, or adequacy of the settlement terms. Fed. R. Civ. P. 23(e)(2); see, e.g., McReynolds v. Richards-Cantave, 588 F.3d 790, 803 (2d Cir. 2009). “Preliminary approval of a class action settlement, in contrast to final approval, is at most a determination that there is . . . ‘probable cause’ to submit the proposal to class

members and hold a full-scale hearing as to its fairness.” In re Crocs, Inc. Sec. Litig., No. 07-cv-02351-PAB-KLM, 2013 WL 4547404, at *3 (D. Colo. Aug. 28, 2013) (quoting Davis 2 v. J.P. Morgan Chase & Co., 775 F. Supp. 2d 601, 607 (W.D.N.Y. 2011)). A proposed settlement of a class action should therefore be preliminarily approved where it “appears to be the product of serious, informed, non-collusive negotiations, has no obvious deficiencies, and does not improperly grant preferential treatment to class representatives.” See In re Motor Fuel Temperature Sales Practices Litig., 286 F.R.D. 488, 492 (D. Kan. 2012) (internal quotation marks omitted). Although the standards for preliminary approval of a class action settlement are not as stringent as they are in the second stage, id., the standards used in the second stage inform the Court’s preliminary inquiry. Therefore, it is appropriate to review those standards.

District courts have broad discretion when deciding whether to certify a putative class. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011); Shook v. Bd. of Cnty. Comm’rs of the Cnty. of El Paso (“Shook I”), 386 F.3d 963, 967 (10th Cir. 2004). A district court may only certify a settlement class if it is “satisfied, after a rigorous analysis,” that the requirements of Rule 23 are met, and frequently a district court’s “ ‘rigorous analysis’ will entail some overlap with the merits of the plaintiff’s underlying claim.” Dukes, 564 U.S. at 350-51; see also In re Initial Pub. Offerings Sec. Litig., 471 F.3d 24, 41 (2d Cir. 2006) (holding that “the obligation to make [Rule 23] determinations is not lessened by overlap between a Rule 23 requirement and a merits issue, even a merits issue that is identical with a Rule 23 requirement”).

A district court may certify a class action if the proposed class satisfies the prerequisites of Fed. R. Civ. P. 23(a) as well as the requirements of one of the three types 3 of classes identified in Rule 23(b). In the typical case where the plaintiff applies for class certification, plaintiff bears the burden of proving that Rule 23’s requirements are satisfied. DG ex rel. Stricklin v. Devaughn, 594 F.3d 1188, 1194 (10th Cir. 2010) (citing Shook I, 386 F.3d at 968). Here, the Plaintiffs move for certification for the purposes of settlement and PFC does not oppose the motion. ECF No. 56 at 1-2. Rule 23(a) requires that (1) the class be so numerous that joinder is impracticable; (2) there are questions of law or fact common to the class; (3) the claims of the representative parties are typical of those of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a); In re Literary Works in Elec. Databases Copyright Litig.,

654 F.3d 242, 249 (2d. Cir. 2011). A class action may be sustained if these requirements are satisfied and the class meets the requirements of one of the categories of Rule 23(b). Fed. R. Civ. P. 23(b). The Plaintiffs ask the Court to certify a settlement class under Rule 23(b)(3). ECF No. 56 at 9-12. Under that provision, plaintiffs must show that “questions of law or fact common to class members predominate over any questions affecting only individual members” and that a class action “is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). In determining predominance and superiority under Rule 23(b)(3), the Court considers the following factors: (A) the class members’ interests in individually controlling the prosecution or

defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or 4 undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action. Fed. R. Civ. P. 23(b)(3)(A)-(D). To certify a settlement class, the Court need not inquire whether the case, if tried, would present difficult management problems under Rule 23(b)(3)(D). Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 620 (1997). However, all of the other Rule 23 requirements apply and demand heightened attention in the settlement context because the Court generally lacks an opportunity to adjust the class as the case unfolds. Id. If the proposed settlement class satisfies the requirements of Rules 23(a) and (b), then the Court must separately evaluate whether the settlement agreement is “fair, reasonable, and adequate” under Rule 23(e).

Fed. R. Civ. P. 23(e)(2); In re Am. Int’l Grp., Inc. Sec. Litig., 689 F.3d 229, 238 (2d Cir. 2012). If plaintiffs meet the requirements for preliminary approval, the Court will direct notice to all class members who would be bound by the proposal and hold a fairness hearing to determine if it is fair, reasonable, and adequate after considering whether: (A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm’s length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other. 5 Fed. R. Civ. P. 23(e)(2). Though the standards for preliminary approval are not as stringent as those for final approval, the final approval standards inform the Court’s preliminary inquiry and thus it is appropriate to review them. A court’s review for final approval is to “focus[ ] on whether ‘(1) the settlement was fairly and honestly negotiated, (2) serious legal and factual questions placed the litigation’s outcome in doubt, (3) the immediate recovery was more valuable than the mere possibility of a more favorable outcome after further litigation, and (4) [the parties] believed the settlement was fair and reasonable.’ ” Elna Sefcovic, LLC v. TEP Rocky Mountain, LLC, 807 F. App’x 752, 757 (10th Cir. 2020) (unpublished) (quoting Tennille v.

W. Union Co., 785 F.3d 422, 434 (10th Cir. 2015)). III. ANALYSIS A. Rule 23 Certification Plaintiffs here seek certification of a Nationwide Class consisting of: “All persons whose personally identifiable information was identified as included in the Data Breach and to whom notice of the Data Breach was sent.” ECF No. 56 at 9. Plaintiffs also seek certification of two subclasses: the SSN Subclass and the Non-SSN Subclass. Id. The SSN Subclass consists of, “All individuals who fall within the definition of the ‘Class’ whose

Social Security Numbers were potentially accessed or implicated in the Data Breach.” Id. The Non-SSN Subclass is made up of, “All individuals who fall within the definition of the ‘Class’ whose Social Security Numbers were not potentially accessed or implicated in the Data Breach.” Id. 6 “[A] district court faced with a settlement only class need not inquire whether the class would present intractable problems with trial management,” but the court must determine whether the other requirements for Rule 23 class certification are satisfied. Pliego, 313 F.R.D. at 125. Those requirements are: (1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a). In addition, to certify a class it must be shown that “questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). 1. Rule 23(a) a. Numerosity “A certifiable class must be so numerous that joinder is impracticable.” Helmer v. Goodyear Tire & Rubber Co., No.12-cv-00685-RBJ-MEH, 2014 WL 1133299, at *3 (D. Colo. Mar. 21, 2014). “Numerosity also requires that the members of the class be ascertainable with the use of objective criteria.” Id. The proposed Class (and Subclasses) includes approximately 2,000,000 individuals who had PII or PHI potentially compromised by the Data Security Incident. ECF No. 56-2 ¶ 50. Therefore, the Court finds that the proposed class satisfies the numerosity requirement of Rule 23. 7 b. Commonality “A finding of commonality requires only a single question of law or fact common to the entire class.” DG ex rel. Stricklin v. Devaughn, 594 F.3d 1188, 1194–95 (10th Cir. 2010). Commonality exists when the class members have “‘suffered the same injury’ such that the claims of the class are based on a common contention,” and the determination of that contention will resolve the central issue. Martinez v. Reams, No. 20-cv-00977- PAB-SKC, 2020 WL 7319081, at *4 (D. Colo. Dec. 11, 2020) (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011)). Here, common issues exist between Plaintiffs and Class Members, including (but

not limited to): (1) whether PFC failed to implement and maintain reasonable security procedures and practices appropriate to the nature and scope of information compromised in the Data Security Incident; (2) whether PFC’s data security systems prior to and during the Data Security Incident complied with applicable data security laws and regulations; and (3) whether PFC’s conduct rose to the level of negligence. These common questions are central to the litigation, will generate common answers, and can be addressed on a class-wide basis. c. Typicality “A plaintiff’s claim is typical of class claims if it challenges the same conduct that would be challenged by the class.” Hunter, 2020 WL 13444205, at *3. “The typicality

requirement ensures that the absent class members are adequately represented by the lead plaintiff such that the interests of the class will be fairly and adequately protected in 8 their absence.” Martinez, 2020 WL 7319081, at *5. Here, Plaintiffs’ and Class Members’ claims all stem from the same attack on PFC’s computers and servers and the cybersecurity protocols that PFC had (or did not have) in place to protect Plaintiffs’ and Class Members’ data. Thus, the typicality requirement is satisfied. d. Adequacy of Representation Finally, Rule 23 requires that “the representative parties will fairly and adequately protect the interests of the class.” Fed. R. Civ. P. 23(a)(4). The adequate representation requirement “concerns both the competence of the class representative’s counsel and the representative’s willingness and ability to control the litigation and to protect the

interests of the class as a whole.” Maez v. Spring Auto. Grp., LLC, 268 F.R.D. 391, 396– 97 (D. Colo. 2010) (internal citation omitted). Resolution of two questions determines legal adequacy: “(1) does the named plaintiff and her counsel have any conflicts of interest with other class members, and (2) will the named plaintiff and her counsel prosecute the action vigorously on behalf of the class.” Rutter & Wilbanks Corp. v. Shell Oil Co., 314 F.3d 1180, 1187–88 (10th Cir. 2002). “Absent evidence to the contrary, a presumption of adequate representation is invoked. Any doubt regarding adequacy of representation should be resolved in favor of upholding the class, subject to later possible reconsideration.” Hunter, 2020 WL 13444205, at *4. With regard to the first adequacy factor, the Court finds that the interests of the

class are fairly and adequately protected by the Plaintiffs and their counsel. Plaintiffs’ interests are aligned with those of the Class because they seek relief for injuries arising 9 out of the same Data Security Incident and in the same manner. The Settlement Agreement provides for identical relief for all SSN Subclass Members and all Non-SSN Subclass Members. ECF No. 56-2 ¶ 55(b)(1); 55(b)(3); ¶ 55(c)(1). Further, there is nothing in the record to show any conflict of interest between the representative plaintiffs or counsel and the rest of the class. Moreover, the settlement agreement does not raise any obvious concerns regarding interclass conflicts. Class members will be able to challenge this issue at the fairness hearing if they believe otherwise. With regard to the second adequacy factor, the parties represent that the Settlement was reached following vigorous pursuit by experienced counsel after arm’s

length negotiations. Proposed Class Counsel have decades of experience in handling complex class action cases, including those involving data breaches, and have vigorously prosecuted this case on behalf of the Settlement Class. See ECF No. 56-1 ¶¶ 4, 5, 31, 34. At this preliminary stage, the Court finds that the representative plaintiffs have satisfied Rule 23(a)(4)’s requirements. Accordingly, the Court finds that all four elements of Fed. R. Civ. P. 23(a) have been met. 2. Rule 23(b)(3) To qualify for certification under Rule 23(b)(3), class questions must “predominate over any questions affecting only individual members,” and class resolution must be

“superior to other available methods for the fair and efficient adjudication of the controversy.” Amchem, 521 U.S. at 615. Rule 23(b)(3) states that courts should consider 10 the following factors when certifying a class: (A) the interest of members of the class in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already commenced by or against members of the class; (C) the desirability of concentrating the litigation of the claims in the particular forum; and (D) the difficulties likely to be encountered in the management of a class action. See Fed. R. Civ. P. 23(b)(3)(A)-(D). Parallel with Rule 23(a)(2)’s commonality element, Rule 23(b)(3)’s predominance requirement imposes an obligation upon district courts to ensure that issues common to the class predominate over those affecting only individual class members. Sullivan v. DB

Investments, Inc., 667 F.3d 273, 297 (3d Cir. 2011). However, the predominance criterion is “far more demanding” than Rule 23(a)(2)’s commonality requirement. Amchem, 521 U.S. at 624. Rule 23(b)(3)’s purpose is to “ensure[ ] that the class will be certified only when it would ‘achieve economies of time, effort, and expense, and promote ... uniformity of decision as to persons similarly situated, without sacrificing procedural fairness or bringing about other undesirable results.’ ” Cordes & Co. Fin. Servs., Inc. v. A.G. Edwards & Sons, Inc., 502 F.3d 91, 104 (2d Cir. 2007). Thus, Rule 23(b)(3)’s predominance inquiry tests whether the proposed classes are sufficiently cohesive to warrant adjudication by representation based on “questions that preexist any settlement.” Amchem, 521 U.S. at 623.

Here, the parties agree that common questions of fact or law predominate. The key predominating questions are whether PFC had a duty to exercise reasonable care in 11 safeguarding, securing, and protecting the personal information of Plaintiffs and the Class, and whether PFC breached that duty. Because the common questions of law and fact depend upon the conduct of PFC, these questions predominate as they are unaffected by the particularized conduct of individual class members. See e.g., Beasley v. TTEC Servs. Corp., No. 22-CV-00097-PAB-STV, 2023 WL 3323311, at *7 (D. Colo. May 9, 2023); In re Heartland Payment Sys., Inc. Customer Data Sec. Breach Litig., 851 F. Supp. 2d 1040, 1059 (S.D. Tex. 2012); In re the Home Depot, Inc., Customer Data Sec. Breach Litig., 2016 WL 6902351, at *2 (N.D. Ga. Aug. 23, 2016); Hapka v. CareCentrix, Inc., 2018 WL 1871449, at *2 (D. Kan. Feb. 15, 2018).

Further, the resolution of tens of thousands of claims in one action is far superior to litigation via individual lawsuits. Class certification—and class resolution—guarantee an increase in judicial efficiency and conservation of resources over the alternative of individually litigating tens of thousands of individual data breach cases arising out of the same data breach. Thus, given that the class members’ claims arise out of the same series of events, the Court finds that conducting the class action settlement in this forum would achieve economies of time, effort, and expense, and promote uniformity of decision to similarly situated persons. Fed. R. Civ. P. 23(b)(3). For these reasons, the Court finds that the class meets all the requirements of Rule 23 and therefore certifies the class for settlement purposes.

12 B. Preliminary Approval of Settlement Agreement Rule 23(e) provides that a proposed settlement may only be approved after a “finding that it is fair, reasonable, and adequate.” Fed. R. Civ. P. 23(e)(2). In making this determination, “trial judges bear the important responsibility of protecting absent class members” and must be “assur[ed] that the settlement represents adequate compensation for the release of the class claims.” In re Pet Food Prods. Liab. Litig., 629 F.3d 333, 349 (3d Cir. 2010); see also Amchem, 521 U.S. at 623 (noting that the Rule 23(e) inquiry “protects unnamed class members from unjust or unfair settlements affecting their rights when the representatives become fainthearted before the action is adjudicated or are able

to secure satisfaction of their individual claims by a compromise”) (citations omitted). To determine whether a proposed settlement is fair, reasonable, and adequate, courts consider the following factors: (1) whether the proposed settlement was fairly and honestly negotiated; (2) whether serious questions of law and fact exist, placing the ultimate outcome of the litigation in doubt; (3) whether the value of an immediate recovery outweighs the mere possibility of future relief after protracted and expensive litigation; and (4) the judgment of the parties that the settlement is fair and reasonable. Rutter, 314 F.3d at 1188. If the settling parties can establish these factors, courts usually presume that the proposed settlement is fair and reasonable. In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 535 (3d Cir. 2004) (applying an “initial presumption of fairness” to a

proposed settlement where: (1) it is the result of arm’s length negotiations; (2) it is based

13 on sufficient discovery; (3) the proponents of the settlement are experienced in similar litigation; and (4) only a small fraction of the class objected). First, the Court finds that the settlement was fairly and honestly negotiated. The negotiations in this matter occurred at arm’s length and the settlement was based on sufficient discovery. ECF No. 56-2 ¶ 110. Soon after the Consolidated Complaint was filed, the parties began discussing the prospect for early resolution. ECF No. 56-1 ¶ 13. PFC provided materials regarding its financial position and its wasting insurance policy. Id. The Parties exchanged information necessary to evaluate the strengths and weaknesses of Plaintiffs’ claims and PFC’s defenses. Id. Plaintiffs received and analyzed

many financials documents from PFC in contemplating a settlement including PFC’s profit and loss statements, cash balance sheets, several years of tax returns, operating account snapshots for different months, officer pay, shareholder distributions, and available insurance. Id. Obtaining this information was critical for Plaintiffs to evaluate the potential upside of continued litigation compared against the potential for resolution. Id. After exchanging settlement demands and counters over the course of many months, the parties ultimately negotiated a settlement in principle, thereafter diligently drafting, negotiating, and finalizing the Settlement Agreement. Id. ¶ 15. Second, the Court finds the ultimate outcome of the litigation is uncertain. Data breach litigation is evolving; there is no guarantee of the ultimate result. See Gordon v.

Chipotle Mexican Grill, Inc., No. 17-cv-01415-CMA-SKC, 2019 WL 6972701, at *1 (D. Colo. Dec. 16, 2019) (“Data breach cases ... are particularly risky, expensive, and 14 complex.”). While Plaintiffs strongly believe in the merits of their case, they also concede that PFC asserts potentially case-dispositive defenses. Third, the value of immediate recovery outweighs the mere possibility of future relief. The Settlement guarantees Class Members real relief and value for harms as well as protections from potential future fall-out from the Data Security Incident. The $2,500,000 Settlement Fund compares favorably to terms approved by courts in other, similar data breach cases. See, e.g., Dickey’s Barbeque Restaurants, Inc., No. 20-cv- 3424, Dkt. 62 (N.D. Tex.) (data breach class action involving more than 3 million people that settled for $2.3 million).

Finally, it is evident that the parties believe that the settlement agreement is fair and reasonable. In negotiating the Settlement, Plaintiffs’ Counsel relied upon published reports documenting data breach and identity theft costs, actual costs incurred by Class Members (as relayed in conversations with Plaintiffs’ Counsel), their own experience, and reported settlements in other data breach class actions. The monetary benefits offered to Class Members are more than fair and reasonable in light of reported average out-of- pocket expenses due to a data breach, and compare favorably to what Class Members could recover if successful at trial. The proposed Settlement does not provide any preferential treatment to the named Plaintiffs or any segments of the Class. See Fed. R. Civ. P. 23(e)(2)(D). The reimbursement for out-of-pocket expenses allows Class

Members to obtain relief based upon the specific types of damages they incurred and treats every claimant in those categories equally relative to each other. Plaintiffs intend 15 to apply for service awards for the Class Representatives. These awards “are fairly typical in class action cases” and are intended to compensate class representatives for participation in the litigation. See Rodriguez v. W. Publ’g Corp., 563 F.3d 948, 958-59 (9th Cir. 2009). Class Representatives were not promised a service award, nor did they condition their representation on the expectation of a service award. ECF No. 56-1 ¶ 32. Thus, the Court finds that the presumption of fairness is sufficient to preliminarily approve the terms of the proposed settlement agreement. C. Notice to the Settlement Class Under Rule 23(e)(1), a district court approving a class action settlement “must

direct notice in a reasonable manner to all class members who would be bound by the proposal.” Fed. R. Civ. P. 23(e)(1). Rule 23(c)(2)(B) provides, in relevant part, that for “any class certified under Rule 23(b)(3), the court must direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B). In addition to the requirements of Rule 23, the Due Process Clause also guarantees unnamed class members the right to notice of a settlement. DeJulius v. New England Health Care Emps. Pension Fund, 429 F.3d 935, 943–44 (10th Cir. 2005). However, due process does not require that each class member receive actual notice to be bound by the adjudication of a representative action. Id. Instead, the procedural rights of absent

class members are satisfied so long as “the best notice practicable [is given] under the circumstances including individual notice to all members who can be identified through 16 reasonable effort.” In re Integra Realty Resources, Inc., 262 F.3d 1089, 1110 (10th Cir. 2001) (citation omitted). Thus, the legal standards for satisfying Rule 23(c)(2)(B) and the constitutional guarantee of procedural due process are “coextensive and substantially similar.” DeJulius, 429 F.3d at 944. Here, the notice provided for by the Settlement Agreement meets the criteria set forth by Rule 23. See ECF No. 56-2, Exs. B and D (Long and Short Form Notices). The Settlement provides for direct and individual notice to each Class Member. Id. ¶ 70(a). Not only will Class Members receive individualized notice via text message, email and/or direct mail, but all versions of the settlement notice will be available to Class Members on

the Settlement Website, along with all relevant filings. Id. ¶ 44. The proposed notice plan satisfies due process. See ECF No. 56-3, ¶ 20. Accordingly, the notice process is approved. D. Class Counsel When certifying a class, a court “must appoint class counsel.” Fed. R. Civ. P. 23(g). In appointing class counsel, the Court must consider: (A)(i) the work counsel has done in identifying or investigating potential claims in the action; (ii) counsel's experience in handling class actions, other complex litigation, and the types of claims asserted in the action; (iii) counsel's knowledge of the applicable law; and (iv) the resources that counsel will commit to representing the class; [and] (B) may consider any other matter pertinent to counsel's ability to fairly and adequately represent the interests of the class[.] Fed. R. Civ. P. 23(g)(1). The settlement agreement lists Jean S. Martin of Morgan & Morgan, Terence R. Coates of Markovits, Stock & DeMarco, LLC, and Joseph M. Lyon 17 of the Lyon Firm as class counsel. ECF No. 56-2 at 4, ¶ 19. Plaintiffs’ counsel states that, as appointed Interim Class Counsel, they have been centrally involved in all aspects of this litigation from the initial investigation to the present. ECF No. 56-1 ¶ 2. Coates has been practicing since 2009 and has extensive experience handling complex class action cases, is participating members in many data breach and data privacy cases pending around the country, and has been recognized by federal courts around the country as experienced in handling complex cases including class actions. See ECF No. 56-2 ¶¶ 3- 5. All counsel possess “extensive experience leading or helping lead complex data- breach and privacy class actions, including most major data breach cases in the United

States.” See ECF Nos. 19, 19-1, 19-2, 19-3. The Court finds that counsel have sufficient experience in class actions and their knowledge of the applicable law, as exhibited in the case up to this point, weighs in favor of their appointment. Therefore, the Court finds that it is appropriate to appoint Jean S. Martin, Terence R. Coates, and Joseph M. Lyon as class counsel. IV. CONCLUSION For the reasons set forth herein, Plaintiffs’ Unopposed Motion for Preliminary Approval of a Class Action Settlement, ECF No. 56, is GRANTED. The parties’ Settlement

Agreement (ECF No. 56-2), including the proposed notice plan and forms of notice to the Class, is preliminarily approved as fair and reasonable Accordingly, it is ORDERED that:

18 1. The Court preliminarily certifies a settlement class pursuant to Fed. R. Civ. P. 23(e) consisting of: All persons whose personally identifiable information was identified as included in the Data Breach and to whom notice of the Data Breach was sent.1

2. The Court preliminary certifies, solely for settlement purposes, the following Subclasses: All individuals who fall within the definition of the “Class” whose Social Security Numbers were potentially accessed or implicated in the Data Breach (the “SSN Subclass”).

All individuals who fall within the definition of the “Class” whose Social Security Numbers were not potentially accessed or implicated in the Data Breach (the “Non-SSN Subclass”).

3. Plaintiffs Maritza Rodriguez, Jerry Blake, Natalie Willingham, Christopher Schroeder, Ryan McGarrigle, and Marko Skrabo are preliminarily approved as the Class Representatives. 4. Jean S. Martin of Morgan & Morgan, Terence R. Coates of Markovits, Stock & DeMarco, LLC, and Joseph M. Lyon of the Lyon Firm are preliminarily approved as Class Counsel. 5. Kroll Settlement Administration LLC is preliminarily approved as the Settlement Administrator.

1 “Data Breach” or “Data Incident” shall mean the cybersecurity incident involving Defendant and occurring on or around February of 2022 giving rise to the Litigation. 19 6. The form, contents, and method of notice to be given to the Class as set forth in the Settlement Agreement and attached to the Motion at ECF No. 56-2, Exs. B, D, are approved. 7. The Court preliminarily approves the following settlement timeline for the purposes of conducting the notice plan, settlement administration, claims processing, and other facets of the proposed Settlement: From Order Granting Preliminary Approval PFC provides list of Class Members to the Within 7 days after entry of this Preliminary Settlement Administrator; Settlement Approval Order Administrator provides W-9 to counsel for the Parties Long Form and Short Form Notices Posted on Within 14 days after receiving the list of Class the Settlement Website Members Notice Deadline Within 30 days after receiving the list of Class Members Counsel’s Motion for Attorneys’ Fees, At least 14 days before the Objection Deadline Reimbursement of Litigation Expenses, and Class Representative Service Awards Objection Deadline Within 90 days after entry of this Preliminary Approval Order Exclusion Deadline Within 90 days after entry of this Preliminary Approval Order Settlement Administrator Provide List of Within 104 days after entry of this Preliminary Objections/Exclusions to the Parties’ counsel Approval Order Claims Deadline Within 120 days after entry of this Preliminary Approval Order Initially Approved Claims List Within 148 days after entry of this Preliminary Approval Order

Final Approval Hearing No earlier than 180 days after entry of this Preliminary Approval Order Motion for Final Approval At least 14 days before the Fairness Hearing

From Order Granting Final Approval

Effective Date 35 days after Order Granting Final Approval 20 _*YRnapeA

Settlement Website Deactivation 120 days after Order Granting Final Approval

8. The parties shall contact the Court's chambers to set a date for the fairness hearing within 7 days of the entry of this Order.

DATED: October 15, 2024 BY THE COURT:

REGINA M. RODRIGUEZ United States District Judge