Smallman v. MGM Resorts International

• Court: District Court, D. Nevada
• Decided: January 22, 2025
• Docket: 2:20-cv-00376
• Status: Unknown

Opinion

EXHIBIT D 1 UNITED STATES DISTRICT COURT DISTRICT OF NEVADA 2 3 IN RE MGM INTERNATIONAL RESORTS Case No.: 2:20-cv-00376-GMN DATA BREACH LITIGAITON 4 This Document Relates To: All actions. 7 UNITED STATES DISTRICT COURT DISTRICT OF NEVADA 8 9 || TANYA OWENS, et al. Master File No. 2:23-cv-01480-GMN (Consolidated for pretrial proceedings with 10 Plaintiffs, Case Nos. 2:23-cv-1481, 2:23-cv1537, 2:23-cv- 1549, 2:23-cv-1550, 2:23-cv1577, Vv. 2:23-cv-1698, 2:23- cv-1719, 2:23-cv1777, 1] 2:23-cv-1826, 2:23-cv- 1981, 2:23-cv2042, MGM RESORTS INTERNATIONAL 2:23-cv-2064, 2:24-cv-81, 2:24-cv-00995, 12 2:24-cv-00999) Defendant. 13 14 ORDER GRANTING PLAINTIFFS’ UNOPPOSED MOTION 15 FOR PRELIMIMNARY APPROVAL OF CLASS ACTION SETTLEMENT 16 Pending before the Court is Plaintiffs’! Unopposed Motion for Preliminary Approval of Class 17 ||Action Settlement and Memorandum of Law, requesting the Court preliminarily certify the 18 Settlement Class and preliminarily approve the Settlement. (ECF No. _.) For the reasons set forth

herein, the Motion for Preliminary Approval is GRANTED.

50 L INTRODUCTION Defendant is a global gaming, hospitality, and entertamment company headquartered in Las 21 Vegas, Nevada. In the course of operating its business, Defendant collects, maintains, and stores 22 Private Information pertaining to its customers, including, but not limited to, names, contact = information (such as telephone numbers, email addresses, and postal addresses), gender, dates of 24 birth, driver’s license numbers, passport numbers, and Social Security numbers. 25 26 All capitalized terms used herein shall have the same meanings as those defined in Section II of the 27 || Settlement Agreement, attached to the Motion for Preliminary Approval as Exhibit A. myo

1 In July of 2019, and then again in September of 2023, Defendant’s computer systems were 2 || hacked in separate incidents by cybercriminals resulting in the unauthorized access of tens of millions 3 ||of Defendant’s customers’ Private Information. Following the Data Incidents, Plaintiffs and 4 || Settlement Class members began receiving notices that their Private Information was potentially 5 || involved. Thereafter, lawsuits were filed against Defendant related to each incident. 6 To avoid the risk and expense of litigation, the Parties agreed to a global settlement to resolve 7 || Plaintiffs’ claims for both Data Incidents on a classwide basis. As demonstrated below, the 8 || Settlement provides significant relief for the Settlement Class, including a non-reversionary all cash 9 | $45,000,000.00 Settlement Fund and valuable non-monetary relief. 10 || II. BACKGROUND 11 The Motion for Preliminary Approval details the history of the 2019 Action and the 2023 12 || Action. This Preliminary Approval Order highlights those facts, which support Preliminary Approval. 13 The 2019 Action 14 In or about July 2019, unauthorized individuals accessed Defendant’s network and 15 || downloaded certain customer data of approximately 37 million MGM guests. See Joint Declaration 16 || of Class Counsel attached to the Motion for Preliminary Approval as Exhibit B. Defendant discovered 17 || the 2019 Data Incident on or about July 10, 2019. Jd. According to Defendant, the unauthorized 18 || individuals acquired personally identifiable information including customers’ names, postal 19 || addresses, telephone numbers, email addresses, dates of birth, and passport numbers. Jd. However, 20 || for the vast majority of the victims, the exposure was limited to their names, postal addresses, email 21 || addresses, telephone numbers, and/or their dates of birth. Zd. 22 Following the 2019 Data Incident and commencing on February 21, 2019, Defendant was 23 || named in the first of eight class action lawsuits (ECF No. 1), which were eventually consolidated into 244 | Spee altiamenris iiuaike weit HieQn19 Dain heidentsnd the gimiisity wrth. claati □□□□ 26 || cases. including the overlapping classes, Plaintiffs’ counsel for the 2019 Action and the 2023 Action collectively determined it would be in the best interest of all concerned — the Plaintiffs, the Defendant, 7 the putative classes, and the Court — to have this Court preside over both cases, which are now being joined for settlement purposes. The Court agrees that a single settlement process for the Actions 28 makes sense as it will be more efficient and less expensive.

1 || the 2019 Action. (ECF No. 22, 86). The Court also appointed the 2019 Plaintiffs’ interim class 2 || counsel. (ECF No. 93.) 3 On April 2, 2021, the 2019 Plaintiffs filed a consolidated class action complaint, asserting 4 || claims for negligence, negligent misrepresentation, breach of implied contract, unjust enrichment, 5 || and various state consumer protection law violations. (ECF No. 101.). 6 On June 1, 2021, Defendant filed a motion to dismiss the consolidated class action complaint, 7 || which was fully briefed. (ECF No. 103, 109, 117.) On November 2, 2022, the Court granted in part 8 || and denied in part Defendant’s motion to dismiss. (ECF No. 128.) The Court allowed the 2019 9 || Plaintiffs’ claims for negligence, breach of implied contract, and violations of some state consumer 10 || protection laws, but dismissed claims for violations of other state consumer protection laws, negligent 11 || misrepresentation, and unjust enrichment. Jd. On December 19, 2022, Defendant answered the 2019 12 || consolidated complaint, denying all material allegations and alleging affirmative defenses. (ECF No. 13 || 136.) 14 After the Court’s ruling on Defendant’s motion to dismiss, the Parties in the 2019 Action 15 || engaged in substantial fact discovery, including written discovery, document production, depositions, 16 || and motion practice. See Joint Declaration. 17 The 2019 Plaintiffs filed notices of related cases on December 6, 2023 (ECF No. 183) and 18 || December 20, 2023 (ECF No. 185), seeking to relate several cases filed relating to the 2023 Data 19 || Incident, which Defendant and 2023 Plaintiffs opposed. (ECF Nos. 184, 186, 187, 188.) 20 On July 9, 2024, the 2019 Parties filed a stipulation to stay the case pending mediation, which 21 || the Court granted that same day. (ECF Nos. 233, 234.) 22 On August 14, 2024, Defendant filed a notice of withdrawal of its response to the 2019 23 || Plaintiffs’ notices of related cases. (ECF No. 235.) 24 On September 18, 2024, the Court issued a Minute Order accepting transfer of the 25 || consolidated cases in the 2023 Action. (ECF No. 237.) 26 The 2023 Action 27 Beginning on September 7, 2023, in a separate cybersecurity incident, unauthorized 28 || individuals accessed Defendant’s network by impersonating an information technology administrator

1 || and gaining access to employees’ network access credentials. See Joint Declaration. Once inside the 2 || network, the unauthorized individuals locked down Defendant’s network and further gained access 3 || to approximately 37 million customers’ personally identifiable information, including, but not limited 4 || to MGM’s customers and guests’ names, addresses, telephone numbers, email addresses, dates of 5 || birth, driver’s license numbers, passport numbers, military identification numbers, and in some cases, 6 || Social Security numbers. Jd. 7 Following the 2023 Data Incident, and commencing on September 21, 2023, the Defendant 8 || was named in the first of 14 class action lawsuits. (2023 ECF No. 1.) 2 On March 19, 2024, the 2023 Plaintiffs moved to consolidate the cases. (2020 ECF No. 29.) 10 | On March 22, 2024, the Court consolidated the cases into the 2023 Action before the Honorable 11 || Richard F. Boulware, II. (2023 ECF No. 32.) 12 On April 19, 2024, the 2023 Plaintiffs moved the Court for appointment of interim lead 13 || counsel, which the Court granted on October 21, 2024. (2023 ECF No. 42, 55.) 14 On March 19, 2024, the 2023 Plaintiffs filed their consolidated class action complaint against 15 || Defendant. (2023 ECF No. 29.) 16 The 2019 Plaintiffs and 2023 Plaintiffs Agreement to Work Cooperatively for Mediation 17 In July 2024, the 2019 Plaintiffs and the 2023 Plaintiffs agreed to participate in a joint 18 || mediation with Defendant before an experienced data breach mediator, Bruce Friedman, Esq., with 19 || JAMS in Las Vegas on August 5, 2024. See Joint Declartion. In advance of the mediation, the 2019 20 || Plaintiffs and the 2023 Plaintiffs propounded informal discovery requests to learn as much as possible 21 || about the 2019 Data Incident and the 2023 Data Incident. Jd. Through the provision of informal 22 || discovery, Plaintiffs in both cases were able to evaluate the merits of Defendant’s position. Jd. The 23 || Parties also exchanged detailed mediation briefs outlining their positions with respect to liability, 24 || damages, and settlement-related issues. Jd. The mediation was canceled for various reasons. Jd. 25 || Thereafter, the 2019 Plaintiffs and the 2023 Plaintiffs decided to work together and collectively 26 || pursue a global settlement of the Actions. Jd. 27 The Parties rescheduled and participated in mediation for October 10, 2024, with Mr. 28 | Friedman, in Las Vegas. (ECF No. 236.) In advance of the mediation, Plaintiffs propounded

1 || additional informal discovery requests regarding the size and scope of the Data Incidents, including, 2 || but not limited to, the number of persons potentially impacted, the data elements impacted, and the 3 || geographical makeup of the putative classes. After a full day of negotiations, the Parties were unable 4 || to reach a settlement. Over the next several weeks, however, the Parties continued to negotiate the 5 || contours of a potential global resolution. See Joint Declaration. 6 On October 31, 2024, the 2019 Plaintiffs filed a notice of settlement, notifying the Court that 7 || all Parties (including the 2023 Plaintiffs) were able to resolve the cases. (ECF No. 238.) 8 On November 4, 2024, the Court entered a Minute Order requiring the Parties to file a joint 9 || status report every 60 days, beginning on December 2, 2024, informing the Court of the status of 10 || settlement. (ECF No. 239.) 11 On November 7, 2024, consistent with the September 18, 2024 Minute Order (ECF No. 237), 12 || the Clerk of Court was directed to transfer the 2023 Action for all further proceedings (2023 ECF No. 13 || 57). 14 The Parties signed the Agreement wich requires Plaintiffs to move for Preliminary Approval 15 || of the collective Settlement of the Actions. 16 || 111. MATERIAL TERMS OF THE SETTLEMENT 17 A. Settlement Class - Plaintiffs seek Preliminary Approval of the following Settlement 18 || Class: 19 [A]ll persons in the United States whose Private Information was accessed during the 20 Data Incidents. 21 || Excluded from the Settlement Class are the judges presiding over the Actions and members of their 22 || direct families. Agreement § 76. 23 B. Settlement Fund - The Settlement provides for a non-reversionary $45,000,000 all cash 24 || Settlement Fund, which will be fully funded by the Defendant within 10 business days of Preliminary 25 || Approval and used to pay: (1) all Settlement Class Member Benefits; (2) any attorneys’ fees and costs 26 || awarded by the Court to Class Counsel and any Service Awards to the Class Representatives: and 27 || (3) all Settlement Administration Costs. Jd. § 89. Once Defendant funds the Settlement Fund, 28 | Defendant will not be required to make any other payments under this Settlement. Jd. □ 88.

1 C. Settlement Class Member Benefits - All eligible Settlement Class members who may 2 elect to receive Cash payments consisting of: (1) a Documented Loss Cash Payment in a maximum 3 amount of $15,000.000 per individual; and (2) a Tier 1, 2, or 3 Cash payment depending on whether 4 they are a Tier 1, 2, or 3 Settlement Class Member; and (3) Financial Account Monitoring. Id. ¶ 92. 5 All Settlement Class Member Cash Payments may be subject to a pro rata increase or decrease, 6 depending on the number of Valid Claims and the value of all Cash Payments claimed. Id. If a 7 Settlement Class Member does not submit a Valid Claim, the Settlement Class Member will release 8 his or her claims against without receiving a Settlement Class Member Benefit. Id. 9 Documented Loss Cash Payment 10 All Settlement Class Members may submit a Claim Form for a Documented Loss Cash 11 Payment for up to $15,000.00 per Settlement Class Member upon presentment of documented losses 12 fairly traceable to either Data Incident and attest under penalty of perjury to incurring documented 13 losses, supported by reasonable documentation. These losses may include, without limitation, 14 unreimbursed losses relating to fraud or identity theft; professional fees including attorneys’ fees, 15 accountants’ fees, and fees for credit repair services; costs associated with freezing or unfreezing 16 credit with any credit reporting agency; credit monitoring costs incurred on or after the applicable 17 Data Incident through the date of claim submission; and miscellaneous expenses such as notary, 18 facsimile, postage, copying, mileage, and long-distance telephone charges. The supporting 19 documentation may include receipts or other documentation not “self-prepared” by the Claimant. 20 “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive 21 reimbursement, but can be considered to add clarity or support other submitted documentation. The 22 lack of reasonable documentation supporting a loss, or if the Claim is rejected by the Settlement 23 Administrator for any reason, and the Settlement Class Member fails to cure his or her Claim, the 24 Claim will be rejected. Id. ¶ 92.a. 25 Tier Cash Payments 26 In addition to a Documented Loss Cash Payment, all Settlement Class members may elect a 27 Tier Cash Payment, which is a flat cash payment based on whether the Settlement Class member is 28 a Tier 1 Settlement Class Member, Tier 2 Settlement Class Member, or Tier 3 Settlement Class 1 Member. The tiers are determined by the type of data a Settlement Class member had exposed in the 2 Data Incidents. The Notice will provide a unique identifier that Settlement Class members can use 3 on the Settlement Website to determine the applicable tier. Id. ¶ 92.b.-d. 4 1. Tier 1 Cash Payment - $75.00 for Tier 1 Settlement Class members 5 In addition to a Documented Loss Cash Payment, Tier 1 Settlement Class Members may also 6 elect to receive a Tier 1 Cash Payment, which is an estimated flat cash $75.00 payment. Id. ¶ 92.b. 7 2. Tier 2 Cash Payment - $50.00 for Tier 2 Settlement Class members 8 In addition to a Documented Loss Cash Payment, Tier 2 Settlement Class members may also 9 elect to receive a Tier 2 Cash Payment, which is an estimated flat cash $50.00 payment. Id. ¶ 92.c. 10 3. Tier 3 Cash Payment - $20.00 for Tier 3 Settlement Class members 11 In addition to a Documented Loss Cash Payment, Tier 3 Settlement Class members may also 12 elect to receive a Tier 3 Cash Payment which is an estimated flat cash $20.00 payment. Id. ¶ 92.d. 13 Financial Account Monitoring 14 In addition to electing a Cash Payment, all Settlement Class Members may elect to submit a 15 Claim for Financial Account Monitoring consisting of identity theft protection and credit monitoring 16 as follows: one year of CyEx Identity Defense Total with three-bureau monitoring and at least 17 $1,000,000 of fraud/identity theft insurance. The one-year period will commence when Settlement 18 Class Members use their codes to activate the Financial Account Monitoring product. Id. ¶ 92. 19 D. Settlement Class Notice - The Parties have agreed on a comprehensive Notice 20 Program, which includes Email Notice, Postcard Notice, Publication Notice, Long Form Notice, a 21 Settlement Website, and Settlement telephone line for frequently asked questions. Id. § VIII. 22 Within 10 days of Preliminary Approval, Defendant will provide the Settlement Administrator 23 with a Class List containing, if available, the Settlement Class members’ names, email addresses, 24 postal addresses, and telephone numbers. Id. ¶¶ 38, 99. Within 30 days of Preliminary Approval, the 25 Settlement Administrator will initiate Publication Notice (digitally publish on the internet and on 26 select social media platforms) and send Email Notice to all Settlement Class members for which an 27 email address has been provided by Defendant. Id. ¶¶ 67, 100. Those Settlement Class Members 28 whose Email Notice is undelivered or bounces back, as well as those Settlement Class members for 1 which email addresses are unknown, shall be sent a Postcard by U.S. Mail no later than 60 days before 2 the original scheduled Final Approval Hearing date. Id. ¶ 107. Notice shall also be published on the 3 Settlement Website and available by mail in a Long Form Notice upon request of the Settlement 4 Administrator. Id. ¶¶ 53, 100. The Notice Program shall be completed 45 days before the original 5 scheduled Final Approval Hearing. Id. ¶ 108. 6 Settlement Class members may review the Long Form Notice, key documents and dates, and 7 answers to frequently asked questions on the Settlement Website, and they can also obtain answers 8 to those frequently asked questions and request the Long Form Notice and Claim Form by calling a 9 toll-free telephone number. Id. ¶¶ 97(d)-(e),101-102. 10 The Notice, in forms similar to those attached to the Agreement as Exhibits 1-4, will inform 11 the Settlement Class of the general terms of the Settlement, including a description of the Actions, 12 the identity of the Settlement Class, and what claims will be released. All Notices shall include, among 13 other information: a description of the material terms; how to submit a Claim Form; the Claim Form 14 Deadline; the Opt-Out deadline to be excluded from the Settlement Class; the Objection Deadline to 15 object to the Settlement and/or the Application for Attorneys’ Fees, Costs, and Service Awards; the 16 Final Approval Hearing date; and the Settlement Website address at which Settlement Class members 17 may access the Agreement and other related documents and information. Additionally, the opt-out 18 procedures will be explained in the Long Form Notice, as well as how Settlement Class Members 19 may exercise their right to object to the proposed Settlement and/or Application for Attorneys’ Fees, 20 Costs, and Services Awards at the Final Approval Hearing. Id. ¶¶ 101, 104-105. 21 E. Claim Submission Process - To receive Settlement Class Member Benefits, Settlement 22 Class Members must accurately and timely submit a Claim by the Claim Form Deadline. Id. § IX. A 23 copy of the proposed Claim Form is attached to the Agreement as Exhibit 5. Claim Forms may be 24 submitted online through the Settlement Website or through U.S. Mail sent to the Settlement 25 Administrator at the address designated on the Claim Form. Id. ¶ 111. The Settlement Administrator 26 will review all Claim Forms to determine their validity, eligibility, and the type and amount of the 27 Cash Payment to which the Settlement Class Member may be entitled. Id. ¶ 112. The Claims process 28 includes procedures for the Settlement Administrator to identify and reject duplicate Claims; to take 1 any reasonable steps to prevent fraud and abuse; to send a Notice of Deficiency to a Settlement Class 2 Member whose Claim Form was rejected for containing incomplete or inaccurate information, and/or 3 omitting required information in the Claim Form, allowing for the submission of information to 4 validate the Claim; and to reduce or reject a Claim. Id. ¶¶ 113-116. The Settlement Administrator will 5 provide Settlement Class Members who submitted Valid Claims with their Settlement Class Member 6 Benefits no later than 75 days after the Effective Date. Id. ¶ 120. Cash Payments will be made 7 electronically or by paper check, and an email will be sent to Settlement Class Members electing 8 Financial Account Monitoring with activation instructions. Id. ¶¶ 121-122. Greater detail on the 9 Claims process is in Section IX of the Agreement. 10 F. Disposition of Residual Funds - The Settlement is designed to exhaust the Settlement 11 Fund. However, in the event there are funds remaining in the Settlement Fund, including from 12 uncashed checks, within 45 days following the 180-day check negotiation period, the Parties will ask 13 the Court to approve the distribution of all remaining funds to an appropriate cy pres recipient. Id. ¶ 14 128. 15 G. Settlement Administrator - The proposed Settlement Administrator, Epiq, is a well- 16 respected and reputable third-party administrator that has significant experience with data breach 17 settlements. Id. ¶ 74; see also generally Declaration of Cameron R. Azari (“Admin. Decl.”). The 18 Settlement Administrator shall effectuate the Notice Program, handle the Claims process, administer 19 the Settlement Fund, and distribute the Settlement Class Member Benefits to Settlement Class 20 Members. Agreement § VII. 21 The Settlement Administrator’s duties include, inter alia: (i) initiating and completing the 22 Court-approved Notice Program; (ii) establishing and maintaining the Settlement Fund Escrow 23 Account; (iii) establishing and maintaining a post office box to receive opt-out requests, objections, 24 and Claim Forms; (iv) establishing and maintaining the Settlement Website; (v) establishing and 25 maintaining an automated toll-free telephone line for Settlement Class members to call; (vi) 26 responding to any mailed Settlement Class member inquiries; (vii) processing all opt-out requests 27 from the Settlement Class; (viii) providing weekly reports to Class Counsel and Defendant’s Counsel 28 that summarize the number of Claims submitted, Claims approved and rejected, Notices of Deficiency 1 sent, opt-out requests and objections received that week, the total number of opt-out requests and 2 objections received to date, and other pertinent information; (ix) in advance of the Final Approval 3 Hearing, preparing a declaration confirming the Notice Program was completed in accordance with 4 the terms of the Agreement and the Preliminary Approval Order, describing how the Notice Program 5 was completed, indicating the number of Claim Forms received and the amount of Valid Claims, 6 providing the names of each Settlement Class member who timely and properly requested to opt-out 7 from the Settlement Class, indicating the number of objections received, and other information as 8 may be necessary to allow the Parties to seek and obtain Final Approval; (x) distributing, out of the 9 Settlement Fund, Cash Payments electronically or by paper check and sending out Financial Account 10 Monitoring activation emails; (xi) paying Court-approved attorneys’ fees, costs, and Service Awards 11 out of the Settlement Fund; (xii) paying Settlement Administration Costs, including any required 12 taxes, out of the Settlement Fund following approval by Class Counsel; and (xiii) any other Settlement 13 Administration function at the instruction of Class Counsel and Defendant including, but not limited 14 to, verifying the Settlement Fund has been properly administered and the Cash Payments have been 15 properly distributed. Id. ¶ 97. The Parties shall jointly oversee the Settlement Administrator. Id. ¶ 95. 16 H. Opt-Out and Objection Procedures - Consistent with the Settlement’s opt-out 17 procedures, the Long Form Notice details that Settlement Class members who do not wish to 18 participate in the Settlement may opt-out up to 30 days prior to the original Final Approval Hearing 19 date. Id. ¶ 61. During the Opt-Out Period, they may mail an opt-out request to the Settlement 20 Administrator including the Settlement Class member’s name, address, telephone number, and email 21 address (if any), and a statement requesting to be excluded from the Settlement Class. Id. ¶ 104. Any 22 Settlement Class member who does not timely opt-out shall be bound by the Agreement’s terms even 23 if that Settlement Class Member does not submit a Claim Form. Id. 24 The Agreement and Long Form Notice also specify how Settlement Class Members may 25 object to the Settlement and/or the Application for Attorneys’ Fees, Costs, and Service Awards. Id. ¶ 26 105. Objections must be mailed to the Settlement Administrator. Id. For an objection to be considered 27 by the Court, it must be submitted no later than the last day of the Objection Period, as specified in 28 the Notice (30 days before the original Final Approval Hearing date). Id. If submitted by mail, an 1 objection shall be deemed to have been submitted when posted if received with a postmark date 2 indicated on the envelope if mailed first-class postage prepaid and addressed in accordance with the 3 instructions. If submitted by private courier (e.g., Federal Express), an objection shall be deemed to 4 have been submitted on the shipping date reflected on the shipping label. Id. It must set forth: (a) the 5 objector’s full name, mailing address, telephone number, and email address (if any); (b) all grounds 6 for the objection, accompanied by any legal support for the objection known to the objector or 7 objector’s counsel; (c) the number of times the objector has objected to a class action settlement 8 within the five years preceding the date that the objector files the objection, the caption of each case 9 in which the objector has made such objection, and a copy of any orders related to or ruling upon the 10 objector’s prior objections that were issued by the trial and appellate courts in each listed case; (d) the 11 identity of all counsel who represent the objector, including any former or current counsel who may 12 be entitled to compensation for any reason related to the objection to the Settlement and/or 13 Application for Attorneys’ Fees, Costs, and Service Awards; (e) the number of times in which the 14 objector’s counsel and/or counsel’s law firm have objected to a class action settlement within the five 15 years preceding the date of the filed objection, the caption of each case in which counsel or the firm 16 has made such objection and a copy of any orders related to or ruling upon counsel’s or the counsel’s 17 law firm’s prior objections that were issued by the trial and appellate courts in each listed case in 18 which the objector’s counsel and/or counsel’s law firm have objected to a class action settlement 19 within the preceding five years; (f) the identity of all counsel (if any) representing the objector who 20 will appear at the Final Approval Hearing; (g) a list of all persons who will be called to testify at the 21 Final Approval Hearing in support of the objection (if any); (h) a statement confirming whether the 22 objector intends to personally appear and/or testify at the Final Approval Hearing; and (i) the 23 objector’s signature (an attorney’s signature is not sufficient). Class Counsel and/or Defendant’s 24 Counsel may conduct limited discovery on any objector or objector’s counsel. Id. 25 I. Release of Claims - Plaintiffs and Settlement Class Members who do not timely and 26 validly opt-out of the Settlement Class will be bound by the Settlement terms, including the Releases 27 discharging the Released Claims against the Released Parties. Id. § XIII. The Released Claims are 28 narrowly tailored to only claims arising out of or relating to the Data Incidents. See Joint Declaration. 1 J. Service Awards - The amount of any Service Awards for the Class Representatives 2 shall be determined by the Court and payable from the Settlement Fund. Agreement ¶ 125. Class 3 Counsel will apply to the Court for a Service Award in the amount of $10,000.00 each for those 4 Plaintiffs that were deposed in the 2019 Action and $3,500.00 each for all other Plaintiffs. Id. The 5 Settlement is not contingent on approval of the requests for Service Awards, and if the Court grants 6 amounts other than what was requested, the remaining provisions of the Agreement shall remain in 7 force. Id. ¶ 127. The Notice will advise the Settlement Class of the amounts of the Service Awards 8 that will be sought. Id., Ex. 1-4. Because Plaintiffs will separately apply for the Service Award at the 9 time of seeking Final Approval of the proposed class action Settlement, the Court does not reach a 10 determination as to the fairness of the proposed Service Awards. 11 K. Attorneys’ Fees and Costs - The amount of any attorneys’ fees and costs shall be 12 determined by the Court and payable from the Settlement Fund. Agreement ¶ 126. Class Counsel will 13 apply to the Court for an award of attorneys’ fees of up to 30% of the Settlement Fund, plus 14 reimbursement of costs. Id. The attorneys’ fees and costs will be formally sought in the Application 15 for Attorneys’ Fees, Costs, and Service Awards filed as part of the Motion for Final Approval. The 16 Settlement is not contingent on approval of the requests for attorneys’ fees and costs, and if the Court 17 grants amounts other than what was requested, the remaining provisions of the Agreement shall 18 remain in force. Id. ¶ 127. The Notice will advise the Settlement Class of the amount of attorneys’ 19 fees that Class Counsel intends to seek. Id., Ex. 1-4. Because Plaintiffs will separately apply for the 20 attorneys’ fees at the time of seeking Final Approval of the proposed class action Settlement, the 21 Court does not reach a determination as to the fairness of the proposed attorneys’ fees. 22 IV. LEGAL STANDARD 23 A class action may not be settled without the approval of the court. Fed. R. Civ. Proc. 23(e). 24 The decision to approve or reject a proposed settlement “is committed to the sound discretion of the 25 trial judge[.]” See Hanlon v. Chrysler Corp., 150 F.3d 1011, 1026 (9th Cir. 1998). The Supreme Court 26 has recognized the benefits of a proposed settlement of a class action can be realized only through the 27 certification of a settlement class. See Amchem Prods. Inc. v. Windsor, 521 U.S. 591, 620 (1997). 28 The Ninth Circuit has declared that a strong judicial policy favors settlement of class actions. 1 Class Plaintiffs v. City of Seattle, 955 F.2d 1268, 1276 (9th Cir. 1992). However, a class action may 2 not be settled without court approval. Fed. R. Civ. P. 23(e). When the parties to a putative class action 3 reach a settlement agreement prior to class certification, “courts must peruse the proposed 4 compromise to ratify both the propriety of the certification and the fairness of the settlement.” Staton 5 v. Boeing Co., 327 F.3d 938, 952 (9th Cir. 2003). At the preliminary stage, the court must first assess 6 whether a class exists. Id. (citing Amchem, 521 U.S. 591 at 620). Second, the court must determine 7 whether the proposed settlement “is fundamentally fair, adequate, and reasonable.” Hanlon, 150 F.3d 8 at 1026. If the court preliminarily certifies the class and finds the proposed settlement fair to its 9 members, the court schedules a fairness hearing where it will make a final determination as to the 10 fairness of the class settlement. Third, the court must “direct notice in a reasonable manner to all class 11 members who would be bound by the proposal.” Fed. R. Civ. P. 23(e)(1). 12 V. DISCUSSION 13 The Motion for Preliminary Approval contends the Court should find the Settlement is within 14 the range of reasonableness necessary to grant Preliminary Approval under Fed. R. Civ. P. 23(e) and 15 enter an order: (i) granting Preliminary Approval of the Settlement; (ii) provisionally certifying the 16 Settlement Class for settlement purposes; (iii) appointing the Plaintiffs as Class Representatives; (iv) 17 appointing John Yanchunis, Doug McNamara, E. Michelle Drake, David Berger, J. Gerard Stranch 18 IV, Lynn Toops, James Pizzirusso, Gary Klinger, and Jeff Ostrow as Class Counsel for the Settlement 19 Class; (v) approving the form of the Notices and the Notice Program; (vi) approving the Claim Form 20 and the Claim process; (vii) appointing Epiq Class Action & Claims Solutions, Inc. as the Settlement 21 Administrator; (viii) establishing procedures and deadlines for members of the Settlement Class to 22 opt-out of or object to the Settlement; and (ix) scheduling a Final Approval Hearing at which time the 23 Court will consider whether to grant Final Approval of the Settlement and the Application for 24 Attorneys’ Fees, Costs and Service Awards. Accordingly, the Court grants class certification for the 25 purposes of settlement and approves the proposed Settlement on a preliminary basis as fair, 26 reasonable, and adequate. 27 A. Provisional Class Certification. 28 Plaintiffs must satisfy all Fed. R. Civ. P. 23(a) requirements (numerosity, commonality, 1 typicality, and adequacy), and one of the requirements of Fed. R. Civ. P. 23(b). Plaintiffs seek 2 certification under Rule 23(b)(3), requiring common questions of law or fact to predominate over any 3 individual issues and class treatment to be the superior method for efficiently handling the case. Fed. 4 R. Civ. P. 23(b)(3). The Court finds that the Settlement Class meets these class certification 5 requirements. 6 1. Ascertainability - Ascertainability is an implied prerequisite of Rule 23. Before a 7 district court can consider whether a potential class satisfies Rule 23(a), it must find the proposed 8 class is “precise, objective, and presently ascertainable.” Andersen v. Briad Restaurant Group LLC, 9 No. 2:14-cv-00786-GMN-BNW, 2020 WL 633599, at *1 (D. Nev. Jan. 13, 2020). Class certification 10 and ascertainability typically involve one inquiry because, without an adequate definition for a 11 proposed class, a district court cannot ascertain who belongs in the class. For purposes of class 12 certification, a proposed class is ascertainable if it is adequately defined such that its membership is 13 capable of determination. Ascertainability may be satisfied if it is “administratively feasible” for the 14 court to determine whether a particular individual is a member, though this is not a prerequisite to 15 certification. Briseno v. ConAgra Foods, Inc., 944 F.3d 1121 (9th Cir. 2017). Here, the Settlement 16 Class is adequately defined and clearly ascertainable because the Settlement Class definition contains 17 sufficient objective criteria to allow an individual to determine whether he or she is a member of the 18 Settlement Class—i.e., whether they were sent notice that their Private Information may have been 19 accessed during the Data Incidents. Agreement ¶ 76. 20 2. Rule 23(a) - Under Rule 23(a), the Court must determine whether: (1) the class is so 21 numerous that joinder of all members is impracticable; (2) there are questions of law or fact common 22 to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses 23 of the class; and (4) the representative parties will fairly and adequately protect the interests of the 24 class. Each requirement is satisfied here. 25 Numerosity - Rule 23(a)(1) requires that a class include so many members that joinder of all 26 would be impracticable. “Impracticability does not mean ‘impossibility,’ but only the difficulty or 27 inconvenience of joining all members of the class.’” Harris v. Palm Springs Alpine Estates, Inc., 329 28 F.2d 909, 913–14 (9th Cir. 1964) (citation omitted). Generally, numerosity is satisfied when the class 1 exceeds 40 members. Andersen v. Briad Restaurant Group, LLC, 333 F.R.D. 194, 202 (D. Nev. 2019). 2 Here, there are millions of Settlement Class members. Therefore, the Court can safely conclude the 3 Settlement Class is sufficiently numerous such that the joinder of each member would be 4 impracticable. 5 Commonality - Rule 23(a)(2) requires a showing that there are questions of law or fact 6 common to the class. This requirement is satisfied where the plaintiffs assert claims that “depend 7 upon a common contention” that is “of such a nature that it is capable of class-wide resolution— 8 which means that determination of its truth or falsity will resolve an issue that is central to the validity 9 of each one of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). 10 Commonality is a permissive requirement, and “not all questions of fact and law need be common to 11 satisfy the rule.” Hanlon, 150 F.3d at 1019. The “existence of shared legal issues with divergent 12 factual predicates is sufficient, as is a common core of salient facts coupled with disparate legal 13 remedies within the class.” Id. at 1019–20. A single common question will do. Andersen, 333 F.R.D. 14 at 203. 15 Courts in this Circuit have previously addressed this requirement in the context of data breach 16 class actions and found it satisfied. See, e.g., In re PostMeds, Inc. Data Breach Litig., No. 23-cv- 17 05710-HSG, 2024 WL 4894293, at *2 (N.D. Cal. Nov. 26, 2024) (commonality satisfied because 18 claims turn on whether defendant had legal duty to use reasonable security measures to protect class 19 members’ personal information, whether that duty was breached, and whether defendant’s data 20 security was adequate to protect personal information). Here, as in other data breach cases, the claims 21 turn on whether Defendant’s security environment was adequate to protect the Settlement Class’ 22 Private Information. That inquiry can be fairly resolved because it revolves around evidence that does 23 not vary between members, at least for purposes of the Settlement, for all Settlement Class members 24 at once. Indeed, the Data Incidents impacted each Settlement Class member’s Private Information. 25 The Court is therefore satisfied that, if Plaintiffs were to continue to pursue the Actions, the 26 answers to these questions would result in classwide resolution of the claims asserted. Therefore, the 27 Court finds Plaintiffs have satisfied the commonality requirement. 28 Typicality - The commonality and typicality analyses often overlap—both focus on whether 1 a sufficient nexus exists between the legal claims of the named class representatives and those of 2 individual class members to warrant class certification. Hashemi v. Bosley, Inc., No. CV 21-946 PSG 3 (RAOx), 2022 WL 2155117, at *3 (C.D. Cal. Feb. 22, 2022) (citing Gen. Tel. Co. Sw. v. Falcon, 457 4 U.S. 147, 157 n.13 (1982)). “The test of typicality ‘is whether other members have the same or similar 5 injury, whether the action is based on conduct which is not unique to the named plaintiffs, and whether 6 other class members have been injured by the same course of conduct.’” Ellis v. Costco Wholesale 7 Corp., 657 F.3d 970, 984 (9th Cir. 2011) (citation omitted). See also Andersen, 333 F.R.D. at 203 8 (same). “Typicality refers to the nature of the claim or defense of the class representative, and not to 9 the specific facts from which it arose or the relief sought.” Id. “Under the ‘permissive standards’ of 10 Rule 23(a)(3), ‘representative claims are ‘typical’ if they are reasonably co-extensive with those of 11 absent class members; they need not be substantially identical.’” Hanlon, 150 F.3d at 1020. 12 The Court is satisfied that typicality is met because Plaintiffs’ interests are aligned with the 13 Settlement Class in that they all received a notice letter informing them their Private Information may 14 have been compromised as a result of the Data Incidents and were therefore impacted by the same 15 purportedly inadequate data security that allegedly harmed the rest of the Settlement Class. Their 16 claims are based on the same legal theories and underlying event. 17 Adequacy of Representation – “‘To satisfy constitutional due process concerns, absent class 18 members must be afforded adequate representation before entry of a judgment which binds them.’” 19 Andersen, 333 F.R.D. at 204 (citation omitted). Fed. R. Civ. P. 23(a)(4) requires the representative 20 parties “fairly and adequately protect the interests of the class.” This determination turns on two 21 questions: “(1) [d]o the representative plaintiffs and their counsel have any conflicts of interest with 22 other class members, and (2) will the representative plaintiffs and their counsel prosecute the action 23 vigorously on behalf of the class?” Staton, 327 F.3d 938, 957 (9th Cir. 2003); Andersen, 333 F.R.D. 24 at 204. Both components are met. 25 In the instant case, the Court is satisfied at this stage that Plaintiffs will adequately represent 26 the Settlement Class. Like all Settlement Class members, Plaintiffs have claims against Defendant 27 arising from the Data Incidents that allegedly impacted their Private Information. Plaintiffs were 28 similarly injured by Defendant’s allegedly wrongful acts. Proof of Plaintiffs’ claims would 1 necessarily involve adjudicating the same issues of law and fact as the claims of the Settlement Class 2 as a whole. Thus, Plaintiffs and the Settlement Class they seek to represent have the same interests in 3 recovering damages. Further, Plaintiffs have also diligently and adequately prosecuted the Actions 4 through Class Counsel by, among other things, reviewing filings, promptly providing documents and 5 information to Class counsel, the 2019 Plaintiffs responding to written discovery requests and being 6 deposed, acting in the best interest of the Settlement Class, and accepting the classwide Settlement. 7 See Joint Declaration. Plaintiffs’ willingness to serve as Class Representatives demonstrates their 8 serious commitment to bringing about the best results possible for the Settlement Class. 9 The Court further finds that Class Counsel have significant experience in data breach class 10 action lawsuits and have adequately demonstrated their vigorous advocacy on behalf of the Settlement 11 Class’ interests in the Actions. See Joint Declaration., Ex. 1-9. In retaining these firms, Plaintiffs 12 employed counsel who are “qualified, experienced and able to conduct the proposed litigation.” 13 Hester v. Vision Airlines, Inc., No. 2:09-cv-00117, 2009 WL 4893185, at *5 (D. Nev. Dec. 16, 2009) 14 (internal quotation omitted). Class Counsel have litigated the Actions, including, inter alia, evaluating 15 the claims, preparing comprehensive pleadings, pursuing formal and informal discovery, consulting 16 with data security experts, responding to motions to dismiss and preparing and responding to other 17 motions, complying with Court orders and requirements, and participating in a mediation that 18 ultimately resulted in this Settlement. Accordingly, Plaintiffs and Class Counsel will adequately 19 protect the Settlement Class. See Joint Declaration. 20 3. Rule 23(b)(3) - Rule 23(b)(3) requires the court to find “questions of law or fact 21 common to class members predominate over questions affecting only individual members, and that a 22 class action is superior to other available methods for fairly and efficiently adjudicating the 23 controversy.” Fed. R. Civ. P. 23(b)(3). When assessing predominance and superiority, the court may 24 consider the class will be certified for settlement purposes only, and that a showing of manageability 25 at trial is not required. See Amchem, 521 U.S. at 620 (“Confronted with a request for settlement-only 26 class certification, a district court need not inquire whether the case, if tried, would present intractable 27 management problems, . . . for the proposal is that there be no trial.”). 28 1 Predominance – The predominance inquiry looks at “the legal or factual questions that 2 qualify each class member’s case as a genuine controversy, questions that preexist any settlement.” 3 Amchem, 521 U.S. at 623. If common questions “present a significant aspect of the case and they can 4 be resolved for all members of the class in a single adjudication,” then “there is clear justification for 5 handling the dispute on a representative rather than on an individual basis,” and the predominance 6 test is satisfied. Hanlon, 150 F.3d at 1022 (citing Amchem, 521 U.S. at 622). There is no definitive 7 test, however, in general, predominance is met when there exists generalized evidence which proves 8 or disproves an [issue or] element on a simultaneous, classwide basis, since such proof obviates the 9 need to examine each class members’ individual position. The main concern is “the balance between 10 individual and common issues.” In re Wells Fargo Home Mortg., 571 F.3d 953, 959 (9th Cir. 2009). 11 Here, all Settlement Class members had their Private Information compromised in the Data 12 Incidents and the security practices at issue did not vary from person to person. Thus, because these 13 common questions represent a significant aspect of the case and they can be resolved for all members 14 of the class in a single adjudication, there is a clear justification for handling the dispute on a 15 representative rather than on an individual basis. Id. Predominance is satisfied. 16 Superiority – “[T]he purpose of the superiority requirement is to assure that the class action 17 is the most efficient and effective means of resolving the controversy.” Wolin v. Jaguar Land Rover 18 N. Am. LLC, 617 F.3d 1168, 1175 (9th Cir. 2010). Rule 23(b)(3)’s non-exclusive factors are: “(A) the 19 interest of members of the class in individually controlling the prosecution or defense of separate 20 actions; (B) the extent and nature of any litigation concerning the controversy already commenced by 21 or against members of the class; (C) the desirability or undesirability of concentrating the litigation 22 of the claims in the particular forum; and (D) the difficulties likely to be encountered in the 23 management of a class action.” All of these factors are present here. Adjudicating individual actions 24 would be impractical. The amount in dispute for each Settlement Class member is too small, the 25 technical issues too complex, and the expert testimony and document review too costly. See Joint 26 Declaration. Further, individual claim prosecution would be prohibitively expensive, needlessly delay 27 resolution, and may lead to inconsistent rulings. Id. Accordingly, a class action is the superior method 28 of adjudicating this case. Id. 1 Accordingly, because the Settlement Class satisfies the requirements of Rule 23(a) and 23(b), 2 the Court hereby provisionally certifies the Settlement Class for settlement purposes. 3 B. Preliminarily Approval of the Settlement. 4 After determining settlement class certification is likely, the Court must determine whether 5 the Settlement is worthy of preliminary approval and providing notice to the Settlement Class. The 6 decision to approve or reject a proposed settlement “is committed to the sound discretion of the trial 7 judge[.]” Hanlon, 150 F.3d at 1026. This discretion is to be exercised “in light of the strong judicial 8 policy that favors settlements, particularly where complex class action litigation is concerned,” which 9 minimizes substantial litigation expenses for both sides and conserves judicial resources. See Linney 10 v. Cellular Alaska P’ship, 151 F.3d 1234, 1238 (9th Cir. 1998) (quotations omitted).3 11 Courts have long recognized that “settlement class actions present unique due process 12 concerns for absent class members.” Hanlon, 150 F.3d at 1026. One inherent risk is that class counsel 13 may collude with the defendants, “tacitly reducing the overall settlement in return for a higher 14 attorney’s fee.” Knisley v. Network Assocs., Inc., 312 F.3d 1123, 1125 (9th Cir. 2002); see Evans v. 15 Jeff D., 475 U.S. 717, 733 (1986). 16 The question at the preliminary approval stage is whether the Court is likely to find the 17 Settlement is fair, adequate, and reasonable under Fed. R. Civ. P. 23(e)(2) and considering the Ninth 18 Circuit traditional “Churchill” factors.4 19 The Rule 23(e)(2) factors are:

21 3 Courts must give “proper deference to the private consensual decision of the parties,” since “the court’s intrusion upon what is otherwise a private consensual agreement negotiated between the 22 parties to a lawsuit must be limited to the extent necessary to reach a reasoned judgment that the agreement is not the product of fraud or overreaching by, or collusion between, the negotiating parties, 23 and that the settlement, taken as a whole, is fair, reasonable and adequate to all concerned.” Hanlon, 150 F.3d at 1027. Thus, in considering a potential settlement, the Court need not reach any ultimate 24 conclusions on the issues of fact and law which underlie the merits of the dispute and need not engage in a trial on the merits. Officers for Justice v. Civil Service Comm’n, 688 F.2d 615, 625 (9th Cir. 25 1982), cert. denied sub nom. Byrd v. Civil Serv. Comm’n, 459 U.S. 1217 (1983). 4 Rule 23(e)(2) was amended in 2018 to include explicit class settlement approval factors. However, 26 consistent with the Advisory Committee note to that rule amendment, courts in this Circuit have made clear the amendment does not entirely displace the traditional Ninth Circuit factors, which overlap 27 with the express Rule 23(e)(2) factors. See, e.g., McKinney-Drobnis v. Oreshack, 16 F.4th 594, 609 n.4 (9th Cir. 2024) (citing Fed. R. Civ. P. 23 Advisory Committee’s note to the 2018 amendment). 28 1 ((AB)) tthhee pclraospso rseapl rwesaesn ntaetgivoetisa taendd a ct laarsms cs’o ulennsgetlh h;a ve adequately represented the class; (C) the relief provided for the class is adequate, taking into account: 2 (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, 3 including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of 4 payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and 5 (D) the proposal treats class members equitably relative to each other. 6 The Churchill factors are: “(1) the strength of the plaintiff’s case; (2) the risk, expense, 7 complexity, and likely duration of further litigation; (3) the risk of maintaining class action status 8 through trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage 9 of the proceedings; (6) the experience and views of counsel; (7) the presence of a governmental 10 participant; and (8) the reaction of the class members of the proposed settlement.” In re Bluetooth 11 Headset Prods. Liab. Litig., 654 F.3d 935, 946 (9th Cir. 2011) (quoting Churchill Vill., L.L.C. v. Gen. 12 Elec., 361 F.3d 566, 575 (9th Cir. 2004)). 13 Where, as here, “a settlement agreement is negotiated prior to formal class certification, 14 consideration of these eight Churchill factors alone is not enough.” Id. Prior to formal class 15 certification, there is an even greater potential for a breach of fiduciary duty owed the class during 16 settlement. Accordingly, “such agreements must withstand an even higher level of scrutiny for 17 evidence of collusion or other conflicts of interest than is ordinarily required under Rule 23(e) before 18 securing the court’s approval as fair.” Id. (citing Hanlon, 150 F.3d at 1026); accord In re Gen. Motors 19 Corp. Pick–Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 805 (3d Cir. 1995) (cautioning that 20 courts must be “even more scrupulous than usual in approving settlements where no class has yet 21 been formally certified”); Mars Steel Corp. v. Cont'l Ill. Nat’l Bank & Trust Co. of Chicago, 834 F.2d 22 677, 681 (7th Cir. 1987) (“[W]hen class certification is deferred, a more careful scrutiny of the 23 fairness of the settlement is required.”); Weinberger v. Kendrick, 698 F.2d 61, 73 (2d Cir. 1982) 24 (noting that reviewing courts must employ “even more than the usual care”); see also Manual for 25 Complex Litig. § 21.612 (4th ed. 2004). Therefore, before approving a precertification settlement, the 26 Court must not only show that it “has explored [the Rule 23(e)(2) and Churchill] factors 27 comprehensively, but also that the settlement is not the product of collusion among the negotiating 28 parties.” In re Bluetooth, 654 F.3d at 947. Because collusion is unlikely to be evident from the face 1 of the settlement itself, “courts must be particularly vigilant not only for explicit collusion, but also 2 for more subtle signs that class counsel have allowed pursuit of their own self-interests and that of 3 certain class members to infect the negotiations.” Id. 4 Because collusion is unlikely to be evident from the face of the settlement itself, “courts must 5 be particularly vigilant not only for explicit collusion, but also for more subtle signs that 6 class counsel have allowed pursuit of their own self-interests and that of certain class members to 7 infect the negotiations.” Id. A few such signs include: (1) “when counsel receive a 8 disproportionate distribution of the settlement”; (2) “when the parties negotiate a ‘clear sailing’ 9 arrangement providing for the payment of attorneys’ fees separate and apart from class funds”; and 10 (3) “when the parties arrange for fees not awarded to revert to defendants rather than be added to the 11 class fund.” Id. 12 For the following reasons, the Settlement is granted Preliminary Approval, applying the Rule 13 23(e)(2) and Churchill factors.5 The Court is likely to find the Settlement is fair, reasonable, and 14 adequate at the final approval stage. 15 1. Adequacy of Representation (Rule 23(e)(2)(A) and Churchill Factor 5) – Both Class 16 Counsel and the Class Representative have adequately represented the Settlement Class. Class 17 Counsel have adequately represented the Settlement Class by fully investigating and litigating the 18 facts and legal claims. Their substantial efforts are exhibited by the formal and informal discovery 19 regarding the 2019 Data Incident, and, while settlement of the 2023 Data Incident claims is coming 20 at an earlier stage, Class Counsel’s efforts to use informal discovery to learn what occurred to cause 21 the 2023 Data Incident and the Private Information impacted, before attending a full-day mediation 22 session with an experienced mediator, which allowed for arm’s length and good faith negotiations, 23 without collusion. See Joint Declaration. Class Counsel used their experience in complex class action 24 litigation, including similar data breach actions, and devoted substantial time and resources to 25 vigorous litigation. Id. 26

27 5 The seventh factor is inapplicable, and the eighth factor is in applicable at this time and is best considered after Notice of the Settlement is sent to see if there is any opposition to the Settlement. 28 1 The Class Representatives also have demonstrated their adequacy by (i) having a genuine 2 personal interest in the outcome of the case; (ii) selecting well-qualified Class Counsel; (iii) producing 3 information and documents to Class Counsel to permit investigation and development of the 4 complaints; (iv) being available as needed, including to respond to discovery and in the case of the 5 2019 Plaintiffs sitting for deposition; (v) monitoring the Actions; and (vi) reviewing the Settlement 6 terms. See Joint Declaration. Plaintiffs’ respective interests are coextensive and do not conflict with 7 the interests of the Settlement Class. Id. Plaintiffs have the same interest in the Settlement relief, and 8 the absent Settlement Class members have no diverging interests. Id. Therefore, the Court finds Rule 9 23(e)(2)(A) and Churchill factor 5 weigh in favor of approval. 10 2. The Settlement Was Negotiated at Arm’s Length (Rule 23(e)(2)(B) and Churchill 11 Factor 6) – This Circuit puts “a good deal of stock in the product of arms-length, negotiated 12 resolution.” Rodriguez v. W. Publ’g Corp., 563 F.3d 948, 965 (9th Cir. 2009) (citing Hanlon, 150 13 F.3d at 1027; Officers for Justice, 688 F.2d at 625). Critically, there is “[a]n initial presumption of 14 fairness is usually involved if the settlement is recommended by class counsel after arm’s-length 15 bargaining.” Wren v. RGIS Inventory Specialists, No. C-06-05778 JCS, 2011 WL 1230826, at *6 16 (N.D. Cal. Apr. 1, 2011), supplemented, No. C-06-05778 JCS, 2011 WL 1838562 (N.D. Cal. May 17 13, 2011). 18 The Settlement is the result of good faith, informed, and arm’s-length negotiations between 19 experienced attorneys familiar with class action litigation and with the legal and factual issues at 20 stake. See Joint Declaration. Class Counsel recommend approval of the Settlement after they 21 thoroughly investigated and analyzed Plaintiffs’ claims; fully briefed the motion to dismiss the 2019 22 Data Incident claims, which the court denied in part and granted in part; engaged in formal and 23 informal discovery for the 2019 Data Incident and informal discovery for the 2023 Data Incident; and 24 consulted with data security experts, enabling them to gain an understanding of the evidence related 25 to central questions in the Actions and preparing them for well-informed settlement negotiations. Id. 26 The Settlement was reached with the assistance of a well-respected and experienced mediator. Id. For 27 these reasons and those discussed related to attorneys’ fees below, there was no fraud or collusion in 28 1 arriving at the Settlement.6 Therefore, the Court finds Rule 23(e)(2)(B) and Churchill factor 6 weigh 2 in favor of approval. 3 3. The Adequacy of the Settlement Relief (Rule 23(e)(2)(C) and Churchill Factors 1- 4 4) – Although Plaintiffs believe the claims asserted in the Actions are strong and meritorious and the 5 Settlement Class would ultimately prevail at trial, continued litigation against Defendant poses 6 significant risks that make any recovery for the Settlement Class uncertain. In assessing the degree of 7 risk of continued litigation, “the court evaluates the time and cost required.” Adoma v. Univ. of 8 Phoenix, Inc., 913 F.Supp.2d 964, 976 (E.D. Cal. 2012). “[U]nless the settlement is clearly 9 inadequate, its acceptance and approval are preferable to lengthy and expensive litigation with 10 uncertain results.” Id. (quoting Nat’l Rural Telecommunications Coop. v. DIRECTV, Inc., 221 F.R.D. 11 523, 526 (C.D. Cal. 2004)). “The parties . . . save themselves the time, expense, and inevitable risk 12 of litigation. Naturally, the agreement reached normally embodies a compromise; in exchange for the 13 saving of cost and elimination of risk, the parties each give up something that they might have won 14 had they proceeded with litigation.” Officers for Justice, 688 F.2d at 624 (quoting United States v. 15 Armour & Co., 402 U.S. 673, 681–82 (1971)). 16 Data breach class actions are risky. See, e.g., In re Mednax Serv., Customer Data Sec. Breach 17 Litig., No. 21-MD-02994-RAR, 2024 WL 1554329, at *7 (S.D. Fla. Apr. 10, 2024); In re Equifax 18 Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1273 (11th Cir. 2021) (“Settlements also save 19 the bench and bar time, money, and headaches”); FultonGreen v. Accolade, Inc., No. 18-274, 2019 20 WL 4677954, at *8 (E.D. Pa. Sept. 24, 2019) (noting that data breach class actions are “a risky field 21 of litigation because [they] are uncertain and class certification is rare”). See also, e.g., In re 22 Blackbaud, Inc., Customer Data Breach Litig., No. 3:20-mn-02972-JFA, 2024 WL 2155221 (D.S.C. 23 May 14, 2024) (denying class certification in a data breach case). The Settlement’s fairness is 24 underscored by consideration of the obstacles the Settlement Class would face in ultimately 25

26 6 None of the so-called “Bluetooth” factors are of concern. See In re Bluetooth, 654 F.3d at 947. First, Class Counsel will not receive a disproportionate distribution from the Settlement Fund. Second, there 27 is no clear-sailing arrangement regarding the attorneys’ fees Class Counsel will seek. Agreement ¶ 127. Third, there is no provision that unawarded attorneys’ fees would revert to Defendant. 28 1 succeeding on the merits, as well as the expense and likely duration of the litigation. 2 Despite the risks involved with further litigation, the Settlement provides outstanding benefits, 3 including Cash Payments and Financial Account Monitoring for all Settlement Class Members. Also, 4 the Claim Form submission process and distribution of Settlement Class Member Benefits is fair, 5 convenient, and effective. Settlement Class Members will promptly receive Cash Payments by 6 electronic means or paper check issued by the Settlement Administrator and Financial Account 7 Monitoring, if elected. The Settlement Administrator is highly qualified to manage the entire process. 8 See Joint Declaration. Thus, through the Settlement, Plaintiffs and Settlement Class Members gain 9 significant benefits without having to face further risk of not receiving any relief at all. Andersen, 10 2022 WL 181262 at *7. 11 Furthermore, the attorneys’ fees do not impact the other terms of the Settlement, as Class 12 Counsel and Defendant negotiated and reached agreement regarding attorneys’ fees and costs only 13 after reaching agreement on all other material Settlement terms. See Joint Declaration. The 14 Settlement, including disbursement of the Settlement Class Member Benefits, is also not contingent 15 on approval of the attorneys’ fee or costs award to Class Counsel or the Service Awards. Agreement 16 ¶ 127. As the Application for Attorneys’ Fees, Costs, and Service Awards will detail, the 30% of the 17 common Settlement Fund that will be sought is within the typical range of acceptable attorneys’ fees 18 in the Ninth Circuit. See Vizcaino v. Microsoft Corp., 290 F.3d 1043, 1048 (9th Cir. 2002); Smith v. 19 One Nevada Credit Union, No. 2:16-cv-02156, 2018 WL 4407251, at *8 (D. Nev. Sept. 16, 2018). 20 Finally, the Parties’ agreements are all in the Agreement. See Joint Declaration. 21 Therefore, the Court finds Rule 23(e)(2)(C) and Churchill factors 1-4 weigh in favor of 22 approval. 23 4. The Equitable Treatment of Settlement Class Members (Rule 23(e)(2)(D)) – All 24 Settlement Class Members are given an equal opportunity to claim Settlement Class Member 25 Benefits. Specifically, each has the option to be reimbursed for documented losses up to $15,000.00, 26 may elect to receive a flat cash payment based upon their respective Settlement Class tier, and all may 27 select Financial Account Monitoring. The tiering of additional flat cash payments reasonably assigns 28 higher value to the more valuable categories of Private Information exfiltrated in the Data Incidents. 1 All Settlement Class Member Cash Payments may be subject to a pro rata increase or decrease, 2 depending on the number of Valid Claims and the value of all Cash Payments claimed. Thus, the 3 Settlement Class Member Benefits distribution method will be equitable and effective. Therefore, the 4 Court finds Rule 23(e)(2)(D) weighs in favor of approval. 5 Accordingly, the Court is likely to find the Settlement is fair, reasonable, and adequately 6 protects the interests of the Settlement Class members.

7 C. The Court Appoints the Proposed Class Representatives, Class Counsel, and Settlement Administrator. 8 Plaintiffs have been integral to Class Counsel throughout litigation and settlement. See Joint 9 Declaration. The 2019 Plaintiffs were very involved in this litigation. Id. They assisted with the 10 preparation of the 2019 Complaint, provided necessary factual information and helped respond to 11 written discovery requests, had their depositions taken, communicated with Class Counsel when 12 needed, and reviewed settlement documents. Id. The 2023 Plaintiffs assisted with the preparation of 13 the 2023 Complaint, provided necessary factual information, communicated with Class Counsel when 14 needed, and reviewed settlement documents. Id. Moreover, Plaintiffs are committed to continuing to 15 assist Class Counsel through Final Approval. Id. Because Plaintiffs are adequate, the Court appoints 16 them as Class Representatives. 17 For the same reasons discussed above for adequacy of representation, and when appointing 18 them on an interim basis in the Actions, the Court designates John Yanchunis, Doug McNamara, E. 19 Michelle Drake, David Berger, J. Gerard Stranch IV, Lynn Toops, James Pizzirusso, Gary Klinger, 20 and Jeff Ostrow as Class Counsel. Fed. R. Civ. P. 23(g)(1)(A)’s four factors for appointing class 21 counsel for a certified class are (1) “the work counsel has done in identifying or investigating potential 22 claims in the action;” (2) “counsel’s experience in handling class actions, other complex litigation, 23 and the types of claims asserted in the action;” (3) “counsel’s knowledge of the applicable law;” and 24 (4) “the resources that counsel will commit to representing the class.” The Court may also “consider 25 any other matter pertinent to counsel’s ability to fairly and adequately represent the interests of the 26 class[.]” Fed. R. Civ. P. 23(g)(1)(B). Here, Plaintiffs and the Settlement Class are represented by 27 qualified and competent Class Counsel who are leaders in the class action field with extensive 28 1 experience prosecuting and resolving complex class actions. See Joint Declaration, Ex. 1-9. Before 2 commencing litigation, they investigated the potential claims against Defendant, interviewed 3 potential plaintiffs, and gathered information regarding the Data Incident. Id. Class Counsel has 4 devoted substantial time and resources to the Actions and will continue to do so. Id. 5 Finally, subject to Court approval, the Parties have agreed Epiq should be the Settlement 6 Administrator. Epiq has a long history of successful class action administrations. See generally 7 Admin. Decl. The Court approves Epiq as the Settlement Administrator. 8 D. The Proposed Notice Program and Claim Process Are Reasonable. 9 Under Fed. R. Civ. P. 23(e)(1), the Court should “direct notice in a reasonable manner to all 10 class members who would be bound” by the proposed settlement. Notice of a proposed settlement 11 must be the “best notice practicable.” Fed. R. Civ. P. 23(c)(2)(B). “[B]est notice practicable” means 12 “individual notice to all members who can be identified through reasonable effort.” Eisen v. Carlisle 13 & Jacquelin, 417 U.S. 156, 173 (1974); see also Andersen, 2022 WL 181262 at *6 (notice satisfactory 14 if it describes the settlement terms in sufficient detail to alert those with adverse viewpoints to 15 investigate and to come forward to be heard). The best notice practicable is that which “is reasonably 16 calculated, under all of the circumstances, to apprise interested parties of the pendency of the action 17 and afford them an opportunity to present their objections.” Mullane v. Cent. Hanover Bank & Tr. 18 Co., 339 U.S. 306, 314 (1950). Moreover, Fed. R. Civ. P. 23(h)(1) requires that “[n]otice of the motion 19 [for attorneys’ fees] must be served on all parties and, for motions by class counsel, directed to class 20 members in a reasonable manner.” 21 The Notice Program satisfies the foregoing criteria. The Parties negotiated the form of the 22 Notices with the Settlement Administrator’s input and assistance. The Notice will be directly 23 disseminated to all persons who fall within the Settlement Class definition and whose names, email 24 addresses, and postal addresses can be identified with reasonable effort from Defendant’s records, 25 and through databases tracking nationwide addresses and address changes, as well as through 26 publication on digital media. See In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 946 (9th 27 Cir. 2015) (notice provided by mail and email was sufficient). In addition, Epiq will administer the 28 Settlement Website containing relevant information about the Settlement and maintain the toll-free 1 telephone line that Settlement Class members can call. Further, the Notices include, among other 2 information: a description of the material terms of the Settlement; how to submit a Claim Form; the 3 Claim Form Deadline; the last day of the Opt-Out Period for Settlement Class members to opt-out of 4 the Settlement Class; the last day of the Objection Period for Settlement Class Members to object to 5 the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Awards; the Final Approval 6 Hearing date; and the Settlement Website address at which Settlement Class members may access 7 this Agreement and other related documents and information. Agreement § VIII. The Long Form 8 Notice and Settlement Website will also detail the opt-out and objection procedures approved by the 9 Court. Finally, the Notice Program satisfies the requirements of Rule 23(h)(1), as the Notices will 10 notify the Settlement Class that Class Counsel may apply to the Court for an award of attorneys’ fees 11 of up to 30% of the Settlement Fund, plus reimbursement of costs, and for Service Awards for the 12 Class Representatives. Id. 13 Thus, the Court approves the Notice Program, including the form and content of the Notices. 14 Agreement, Exs. 1-4. The Court also approves the opt-out and objection procedures set forth in the 15 Agreement and summarized in this Order. 16 The Court also approves the Claim Form and Claim process. The Claim Form is easy to 17 understand and may be submitted online through the Settlement Website or through U.S. Mail sent 18 to the Settlement Administrator. Id. ¶ 111. As noted above, the Settlement Administrator will review 19 all Claim Forms to determine their validity, eligibility, and the type and amount of the Cash Payment 20 to which the Settlement Class Member may be entitled, and the Claim review process is robust. Id. 21 ¶¶ 112-116. 22 The Court directs the Settlement Administrator to disseminate the Notices and Claim Form as 23 approved herein. Class Counsel and Defendant’s Counsel are hereby authorized to use all reasonable 24 procedures in connection with approval and administration of the Settlement that are not materially 25 inconsistent with this order or the Settlement, including making, without the Court’s further approval, 26 minor form or content changes to the Notices and Claim Form they jointly agree are reasonable or 27 necessary. 28 1 VI. CONCLUSION 2 IT IS HEREBY ORDERED that the Motion for Preliminary Approval (ECF No. __) is 3 GRANTED as follows: 4 1. The Settlement Class is granted provisional class certification. 5 2. Plaintiff’s Counsel, John Yanchunis, Doug McNamara, E. Michelle Drake, David 6 Berger, J. Gerard Stranch IV, Lynn Toops, James Pizzirusso, Gary Klinger, and Jeff Ostrow are 7 appointed as Class Counsel. 8 3. Plaintiffs are appointed as Class Representatives. 9 4. Epiq Class Action & Claims Solutions, Inc. is appointed as Settlement Administrator. 10 5. The proposed Settlement agreement is preliminarily approved as fair, reasonable, and 11 adequate. 12 6. If the Settlement is terminated, not approved, canceled, fails to become effective for any 13 reason, or the Effective Date does not occur, this Preliminary Approval Order shall become null and 14 void and shall be without prejudice to the rights of Plaintiffs, the Settlement Class members, and 15 Defendant, all of whom shall be restored to their respective positions in the Actions as provided in 16 the Agreement. 17 7. All pretrial proceedings in the Actions are stayed and suspended until further order of 18 this Court, except such actions as may be necessary to implement the Settlement and this Preliminary 19 Approval Order. 20 8. Upon the entry of this Preliminary Approval Order, with the exception of Class 21 Counsel’s, Defendant’s Counsel’s, Defendant’s, and the Class Representatives’ implementation of 22 the Settlement and the approval process in the Actions, all members of the Settlement Class shall be 23 provisionally enjoined and barred from asserting any claims or continuing any litigation against 24 Defendant and the Released Parties arising out of, relating to, or in connection with the Released 25 Claims prior to the Court’s decision as to whether to grant Final Approval of the Settlement. 26 9. For the benefit of the Settlement Class and to protect this Court’s jurisdiction, this Court 27 retains continuing jurisdiction over the Settlement proceedings to ensure the effectuation thereof in 28 accordance with the Settlement preliminarily approved herein and the related orders of this Court. 1 10. The Final Approval Hearing will be conducted for the following purposes: (a) to 2 || determine whether the proposed Settlement, on the terms and conditions provided for in the 3 || Settlement, is fair, reasonable, and adequate, and should be approved by the Court; (b) to determine 4 || whether an order of Final Judgment should be entered dismissing the Actions on the merits and with 5 || prejudice; (c) to determine whether the proposed plan of allocation and distribution of the Settlement 6 || Fund is fair and reasonable and should be approved; (d) to determine whether any requested award 7 || of attorneys’ fees and costs to Class Counsel and Service Awards to the Class Representatives should 8 || be approved; and (e) to consider any other matters that may properly be brought before the Court in 9 || connection with the Settlement. The Court may elect to hold the Final Approval Hearing virtually by 10 || Zoom or some other application, and if it does, the instructions on how to attend shall be posted by 11 || the Settlement Administrator on the Settlement Website. 12 11. Consistent with the Agreement, the following scheduled is imposed leading up to the 13 || Final Approval Hearing that shall take place on June 18 , 2025, at 9:00 a.m. in Courtroom 14 || 7D, located at Lloyd D. George Federal Courthouse, 333 Las Vegas Boulevard South, Las 15 || Vegas, Nevada 89101, before District Court Judge Gloria M. Navarro: 16 || Deadline to commence Notice Program Within 30 days of the Preliminary Approval 7 Order Deadline to complete Notice Program 45 days before the original Final Approval 18 Hearing date 19 Deadline for filing Motion for Final Approval, | 45 days before the original Final Approval including Class Counsel’s Application for | Hearing date 20 Attorneys’ Fees, Costs, and Service Awards Opt-Out Period Ends 30 days before the original Final Approval 21 Hearing date 29 Objection Period Ends 30 days before the original Final Approval Hearing date 23 ||) Claim Form Deadline 15 days before the original Final Approval Hearing date 24 Final Approval Hearing June 18 , 2025 at 9:00 a.m. 25 DATED this 21 day of _ January __, 2025. 26 Ae 27 WT FAN Gloria avarro, District Judge 28 UNITED Sf#ATES DISTRICT COURT 29