Smallman v. MGM Resorts International

Opinion

EXHIBIT D DISTRICT OF NEVADA IN RE MGM INTERNATIONAL RESORTS Case No.: 2:20-cv-00376-GMN DATA BREACH LITIGAITON This Document Relates To: All actions. DISTRICT OF NEVADA TANYA OWENS, et al. Master File No. 2:23-cv-01480-GMN (Consolidated for pretrial proceedings with Plaintiffs, Case Nos. 2:23-cv-1481, 2:23-cv1537, 2:23-cv- 1549, 2:23-cv-1550, 2:23-cv1577, Vv. 2:23-cv-1698, 2:23- cv-1719, 2:23-cv1777, 1] 2:23-cv-1826, 2:23-cv- 1981, 2:23-cv2042, MGM RESORTS INTERNATIONAL 2:23-cv-2064, 2:24-cv-81, 2:24-cv-00995, 2:24-cv-00999) Defendant. ORDER GRANTING PLAINTIFFS’ UNOPPOSED MOTION FOR PRELIMIMNARY APPROVAL OF CLASS ACTION SETTLEMENT Pending before the Court is Plaintiffs’! Unopposed Motion for Preliminary Approval of Class Action Settlement and Memorandum of Law, requesting the Court preliminarily certify the Settlement Class and preliminarily approve the Settlement. (ECF No. _.) For the reasons set forth

herein, the Motion for Preliminary Approval is GRANTED.

Defendant is a global gaming, hospitality, and entertamment company headquartered in Las Vegas, Nevada. In the course of operating its business, Defendant collects, maintains, and stores Private Information pertaining to its customers, including, but not limited to, names, contact = information (such as telephone numbers, email addresses, and postal addresses), gender, dates of birth, driver’s license numbers, passport numbers, and Social Security numbers. All capitalized terms used herein shall have the same meanings as those defined in Section II of the Settlement Agreement, attached to the Motion for Preliminary Approval as Exhibit A. myo

In July of 2019, and then again in September of 2023, Defendant’s computer systems were hacked in separate incidents by cybercriminals resulting in the unauthorized access of tens of millions of Defendant’s customers’ Private Information. Following the Data Incidents, Plaintiffs and Settlement Class members began receiving notices that their Private Information was potentially involved. Thereafter, lawsuits were filed against Defendant related to each incident. To avoid the risk and expense of litigation, the Parties agreed to a global settlement to resolve Plaintiffs’ claims for both Data Incidents on a classwide basis. As demonstrated below, the Settlement provides significant relief for the Settlement Class, including a non-reversionary all cash $45,000,000.00 Settlement Fund and valuable non-monetary relief. II. BACKGROUND The Motion for Preliminary Approval details the history of the 2019 Action and the 2023 Action. This Preliminary Approval Order highlights those facts, which support Preliminary Approval. The 2019 Action In or about July 2019, unauthorized individuals accessed Defendant’s network and downloaded certain customer data of approximately 37 million MGM guests. See Joint Declaration of Class Counsel attached to the Motion for Preliminary Approval as Exhibit B. Defendant discovered the 2019 Data Incident on or about July 10, 2019. Jd. According to Defendant, the unauthorized individuals acquired personally identifiable information including customers’ names, postal addresses, telephone numbers, email addresses, dates of birth, and passport numbers. Jd. However, for the vast majority of the victims, the exposure was limited to their names, postal addresses, email addresses, telephone numbers, and/or their dates of birth. Zd. Following the 2019 Data Incident and commencing on February 21, 2019, Defendant was named in the first of eight class action lawsuits (ECF No. 1), which were eventually consolidated into 244 Spee altiamenris iiuaike weit HieQn19 Dain heidentsnd the gimiisity wrth. claati □□□□ cases. including the overlapping classes, Plaintiffs’ counsel for the 2019 Action and the 2023 Action collectively determined it would be in the best interest of all concerned — the Plaintiffs, the Defendant, the putative classes, and the Court — to have this Court preside over both cases, which are now being joined for settlement purposes. The Court agrees that a single settlement process for the Actions makes sense as it will be more efficient and less expensive.

the 2019 Action. (ECF No. 22, 86). The Court also appointed the 2019 Plaintiffs’ interim class counsel. (ECF No. 93.) On April 2, 2021, the 2019 Plaintiffs filed a consolidated class action complaint, asserting claims for negligence, negligent misrepresentation, breach of implied contract, unjust enrichment, and various state consumer protection law violations. (ECF No. 101.). On June 1, 2021, Defendant filed a motion to dismiss the consolidated class action complaint, which was fully briefed. (ECF No. 103, 109, 117.) On November 2, 2022, the Court granted in part and denied in part Defendant’s motion to dismiss. (ECF No. 128.) The Court allowed the 2019 Plaintiffs’ claims for negligence, breach of implied contract, and violations of some state consumer protection laws, but dismissed claims for violations of other state consumer protection laws, negligent misrepresentation, and unjust enrichment. Jd. On December 19, 2022, Defendant answered the 2019 consolidated complaint, denying all material allegations and alleging affirmative defenses. (ECF No. 136.) After the Court’s ruling on Defendant’s motion to dismiss, the Parties in the 2019 Action engaged in substantial fact discovery, including written discovery, document production, depositions, and motion practice. See Joint Declaration. The 2019 Plaintiffs filed notices of related cases on December 6, 2023 (ECF No. 183) and December 20, 2023 (ECF No. 185), seeking to relate several cases filed relating to the 2023 Data Incident, which Defendant and 2023 Plaintiffs opposed. (ECF Nos. 184, 186, 187, 188.) On July 9, 2024, the 2019 Parties filed a stipulation to stay the case pending mediation, which the Court granted that same day. (ECF Nos. 233, 234.) On August 14, 2024, Defendant filed a notice of withdrawal of its response to the 2019 Plaintiffs’ notices of related cases. (ECF No. 235.) On September 18, 2024, the Court issued a Minute Order accepting transfer of the consolidated cases in the 2023 Action. (ECF No. 237.) The 2023 Action Beginning on September 7, 2023, in a separate cybersecurity incident, unauthorized individuals accessed Defendant’s network by impersonating an information technology administrator

and gaining access to employees’ network access credentials. See Joint Declaration. Once inside the network, the unauthorized individuals locked down Defendant’s network and further gained access to approximately 37 million customers’ personally identifiable information, including, but not limited to MGM’s customers and guests’ names, addresses, telephone numbers, email addresses, dates of birth, driver’s license numbers, passport numbers, military identification numbers, and in some cases, Social Security numbers. Jd. Following the 2023 Data Incident, and commencing on September 21, 2023, the Defendant was named in the first of 14 class action lawsuits. (2023 ECF No. 1.) On March 19, 2024, the 2023 Plaintiffs moved to consolidate the cases. (2020 ECF No. 29.) On March 22, 2024, the Court consolidated the cases into the 2023 Action before the Honorable Richard F. Boulware, II. (2023 ECF No. 32.) On April 19, 2024, the 2023 Plaintiffs moved the Court for appointment of interim lead counsel, which the Court granted on October 21, 2024. (2023 ECF No. 42, 55.) On March 19, 2024, the 2023 Plaintiffs filed their consolidated class action complaint against Defendant. (2023 ECF No. 29.) The 2019 Plaintiffs and 2023 Plaintiffs Agreement to Work Cooperatively for Mediation In July 2024, the 2019 Plaintiffs and the 2023 Plaintiffs agreed to participate in a joint mediation with Defendant before an experienced data breach mediator, Bruce Friedman, Esq., with JAMS in Las Vegas on August 5, 2024. See Joint Declartion. In advance of the mediation, the 2019 Plaintiffs and the 2023 Plaintiffs propounded informal discovery requests to learn as much as possible about the 2019 Data Incident and the 2023 Data Incident. Jd. Through the provision of informal discovery, Plaintiffs in both cases were able to evaluate the merits of Defendant’s position. Jd. The Parties also exchanged detailed mediation briefs outlining their positions with respect to liability, damages, and settlement-related issues. Jd. The mediation was canceled for various reasons. Jd. Thereafter, the 2019 Plaintiffs and the 2023 Plaintiffs decided to work together and collectively pursue a global settlement of the Actions. Jd. The Parties rescheduled and participated in mediation for October 10, 2024, with Mr. Friedman, in Las Vegas. (ECF No. 236.) In advance of the mediation, Plaintiffs propounded

additional informal discovery requests regarding the size and scope of the Data Incidents, including, but not limited to, the number of persons potentially impacted, the data elements impacted, and the geographical makeup of the putative classes. After a full day of negotiations, the Parties were unable to reach a settlement. Over the next several weeks, however, the Parties continued to negotiate the contours of a potential global resolution. See Joint Declaration. On October 31, 2024, the 2019 Plaintiffs filed a notice of settlement, notifying the Court that all Parties (including the 2023 Plaintiffs) were able to resolve the cases. (ECF No. 238.) On November 4, 2024, the Court entered a Minute Order requiring the Parties to file a joint status report every 60 days, beginning on December 2, 2024, informing the Court of the status of settlement. (ECF No. 239.) On November 7, 2024, consistent with the September 18, 2024 Minute Order (ECF No. 237), the Clerk of Court was directed to transfer the 2023 Action for all further proceedings (2023 ECF No. 57). The Parties signed the Agreement wich requires Plaintiffs to move for Preliminary Approval of the collective Settlement of the Actions. 111. MATERIAL TERMS OF THE SETTLEMENT A. Settlement Class - Plaintiffs seek Preliminary Approval of the following Settlement Class: [A]ll persons in the United States whose Private Information was accessed during the Data Incidents. Excluded from the Settlement Class are the judges presiding over the Actions and members of their direct families. Agreement § 76. B. Settlement Fund - The Settlement provides for a non-reversionary $45,000,000 all cash Settlement Fund, which will be fully funded by the Defendant within 10 business days of Preliminary Approval and used to pay: (1) all Settlement Class Member Benefits; (2) any attorneys’ fees and costs awarded by the Court to Class Counsel and any Service Awards to the Class Representatives: and (3) all Settlement Administration Costs. Jd. § 89. Once Defendant funds the Settlement Fund, Defendant will not be required to make any other payments under this Settlement. Jd. □ 88.

C. Settlement Class Member Benefits - All eligible Settlement Class members who may elect to receive Cash payments consisting of: (1) a Documented Loss Cash Payment in a maximum amount of $15,000.000 per individual; and (2) a Tier 1, 2, or 3 Cash payment depending on whether they are a Tier 1, 2, or 3 Settlement Class Member; and (3) Financial Account Monitoring. Id. ¶ 92. All Settlement Class Member Cash Payments may be subject to a pro rata increase or decrease, depending on the number of Valid Claims and the value of all Cash Payments claimed. Id. If a Settlement Class Member does not submit a Valid Claim, the Settlement Class Member will release his or her claims against without receiving a Settlement Class Member Benefit. Id. Documented Loss Cash Payment All Settlement Class Members may submit a Claim Form for a Documented Loss Cash Payment for up to $15,000.00 per Settlement Class Member upon presentment of documented losses fairly traceable to either Data Incident and attest under penalty of perjury to incurring documented losses, supported by reasonable documentation. These losses may include, without limitation, unreimbursed losses relating to fraud or identity theft; professional fees including attorneys’ fees, accountants’ fees, and fees for credit repair services; costs associated with freezing or unfreezing credit with any credit reporting agency; credit monitoring costs incurred on or after the applicable Data Incident through the date of claim submission; and miscellaneous expenses such as notary, facsimile, postage, copying, mileage, and long-distance telephone charges. The supporting documentation may include receipts or other documentation not “self-prepared” by the Claimant. “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but can be considered to add clarity or support other submitted documentation. The lack of reasonable documentation supporting a loss, or if the Claim is rejected by the Settlement Administrator for any reason, and the Settlement Class Member fails to cure his or her Claim, the Claim will be rejected. Id. ¶ 92.a. Tier Cash Payments In addition to a Documented Loss Cash Payment, all Settlement Class members may elect a Tier Cash Payment, which is a flat cash payment based on whether the Settlement Class member is a Tier 1 Settlement Class Member, Tier 2 Settlement Class Member, or Tier 3 Settlement Class Member. The tiers are determined by the type of data a Settlement Class member had exposed in the Data Incidents. The Notice will provide a unique identifier that Settlement Class members can use on the Settlement Website to determine the applicable tier. Id. ¶ 92.b.-d. 1. Tier 1 Cash Payment - $75.00 for Tier 1 Settlement Class members In addition to a Documented Loss Cash Payment, Tier 1 Settlement Class Members may also elect to receive a Tier 1 Cash Payment, which is an estimated flat cash $75.00 payment. Id. ¶ 92.b. 2. Tier 2 Cash Payment - $50.00 for Tier 2 Settlement Class members In addition to a Documented Loss Cash Payment, Tier 2 Settlement Class members may also elect to receive a Tier 2 Cash Payment, which is an estimated flat cash $50.00 payment. Id. ¶ 92.c. 3. Tier 3 Cash Payment - $20.00 for Tier 3 Settlement Class members In addition to a Documented Loss Cash Payment, Tier 3 Settlement Class members may also elect to receive a Tier 3 Cash Payment which is an estimated flat cash $20.00 payment. Id. ¶ 92.d. Financial Account Monitoring In addition to electing a Cash Payment, all Settlement Class Members may elect to submit a Claim for Financial Account Monitoring consisting of identity theft protection and credit monitoring as follows: one year of CyEx Identity Defense Total with three-bureau monitoring and at least $1,000,000 of fraud/identity theft insurance. The one-year period will commence when Settlement Class Members use their codes to activate the Financial Account Monitoring product. Id. ¶ 92. D. Settlement Class Notice - The Parties have agreed on a comprehensive Notice Program, which includes Email Notice, Postcard Notice, Publication Notice, Long Form Notice, a Settlement Website, and Settlement telephone line for frequently asked questions. Id. § VIII. Within 10 days of Preliminary Approval, Defendant will provide the Settlement Administrator with a Class List containing, if available, the Settlement Class members’ names, email addresses, postal addresses, and telephone numbers. Id. ¶¶ 38, 99. Within 30 days of Preliminary Approval, the Settlement Administrator will initiate Publication Notice (digitally publish on the internet and on select social media platforms) and send Email Notice to all Settlement Class members for which an email address has been provided by Defendant. Id. ¶¶ 67, 100. Those Settlement Class Members whose Email Notice is undelivered or bounces back, as well as those Settlement Class members for which email addresses are unknown, shall be sent a Postcard by U.S. Mail no later than 60 days before the original scheduled Final Approval Hearing date. Id. ¶ 107. Notice shall also be published on the Settlement Website and available by mail in a Long Form Notice upon request of the Settlement Administrator. Id. ¶¶ 53, 100. The Notice Program shall be completed 45 days before the original scheduled Final Approval Hearing. Id. ¶ 108. Settlement Class members may review the Long Form Notice, key documents and dates, and answers to frequently asked questions on the Settlement Website, and they can also obtain answers to those frequently asked questions and request the Long Form Notice and Claim Form by calling a toll-free telephone number. Id. ¶¶ 97(d)-(e),101-102. The Notice, in forms similar to those attached to the Agreement as Exhibits 1-4, will inform the Settlement Class of the general terms of the Settlement, including a description of the Actions, the identity of the Settlement Class, and what claims will be released. All Notices shall include, among other information: a description of the material terms; how to submit a Claim Form; the Claim Form Deadline; the Opt-Out deadline to be excluded from the Settlement Class; the Objection Deadline to object to the Settlement and/or the Application for Attorneys’ Fees, Costs, and Service Awards; the Final Approval Hearing date; and the Settlement Website address at which Settlement Class members may access the Agreement and other related documents and information. Additionally, the opt-out procedures will be explained in the Long Form Notice, as well as how Settlement Class Members may exercise their right to object to the proposed Settlement and/or Application for Attorneys’ Fees, Costs, and Services Awards at the Final Approval Hearing. Id. ¶¶ 101, 104-105. E. Claim Submission Process - To receive Settlement Class Member Benefits, Settlement Class Members must accurately and timely submit a Claim by the Claim Form Deadline. Id. § IX. A copy of the proposed Claim Form is attached to the Agreement as Exhibit 5. Claim Forms may be submitted online through the Settlement Website or through U.S. Mail sent to the Settlement Administrator at the address designated on the Claim Form. Id. ¶ 111. The Settlement Administrator will review all Claim Forms to determine their validity, eligibility, and the type and amount of the Cash Payment to which the Settlement Class Member may be entitled. Id. ¶ 112. The Claims process includes procedures for the Settlement Administrator to identify and reject duplicate Claims; to take any reasonable steps to prevent fraud and abuse; to send a Notice of Deficiency to a Settlement Class Member whose Claim Form was rejected for containing incomplete or inaccurate information, and/or omitting required information in the Claim Form, allowing for the submission of information to validate the Claim; and to reduce or reject a Claim. Id. ¶¶ 113-116. The Settlement Administrator will provide Settlement Class Members who submitted Valid Claims with their Settlement Class Member Benefits no later than 75 days after the Effective Date. Id. ¶ 120. Cash Payments will be made electronically or by paper check, and an email will be sent to Settlement Class Members electing Financial Account Monitoring with activation instructions. Id. ¶¶ 121-122. Greater detail on the Claims process is in Section IX of the Agreement. F. Disposition of Residual Funds - The Settlement is designed to exhaust the Settlement Fund. However, in the event there are funds remaining in the Settlement Fund, including from uncashed checks, within 45 days following the 180-day check negotiation period, the Parties will ask the Court to approve the distribution of all remaining funds to an appropriate cy pres recipient. Id. ¶ 128. G. Settlement Administrator - The proposed Settlement Administrator, Epiq, is a well- respected and reputable third-party administrator that has significant experience with data breach settlements. Id. ¶ 74; see also generally Declaration of Cameron R. Azari (“Admin. Decl.”). The Settlement Administrator shall effectuate the Notice Program, handle the Claims process, administer the Settlement Fund, and distribute the Settlement Class Member Benefits to Settlement Class Members. Agreement § VII. The Settlement Administrator’s duties include, inter alia: (i) initiating and completing the Court-approved Notice Program; (ii) establishing and maintaining the Settlement Fund Escrow Account; (iii) establishing and maintaining a post office box to receive opt-out requests, objections, and Claim Forms; (iv) establishing and maintaining the Settlement Website; (v) establishing and maintaining an automated toll-free telephone line for Settlement Class members to call; (vi) responding to any mailed Settlement Class member inquiries; (vii) processing all opt-out requests from the Settlement Class; (viii) providing weekly reports to Class Counsel and Defendant’s Counsel that summarize the number of Claims submitted, Claims approved and rejected, Notices of Deficiency sent, opt-out requests and objections received that week, the total number of opt-out requests and objections received to date, and other pertinent information; (ix) in advance of the Final Approval Hearing, preparing a declaration confirming the Notice Program was completed in accordance with the terms of the Agreement and the Preliminary Approval Order, describing how the Notice Program was completed, indicating the number of Claim Forms received and the amount of Valid Claims, providing the names of each Settlement Class member who timely and properly requested to opt-out from the Settlement Class, indicating the number of objections received, and other information as may be necessary to allow the Parties to seek and obtain Final Approval; (x) distributing, out of the Settlement Fund, Cash Payments electronically or by paper check and sending out Financial Account Monitoring activation emails; (xi) paying Court-approved attorneys’ fees, costs, and Service Awards out of the Settlement Fund; (xii) paying Settlement Administration Costs, including any required taxes, out of the Settlement Fund following approval by Class Counsel; and (xiii) any other Settlement Administration function at the instruction of Class Counsel and Defendant including, but not limited to, verifying the Settlement Fund has been properly administered and the Cash Payments have been properly distributed. Id. ¶ 97. The Parties shall jointly oversee the Settlement Administrator. Id. ¶ 95. H. Opt-Out and Objection Procedures - Consistent with the Settlement’s opt-out procedures, the Long Form Notice details that Settlement Class members who do not wish to participate in the Settlement may opt-out up to 30 days prior to the original Final Approval Hearing date. Id. ¶ 61. During the Opt-Out Period, they may mail an opt-out request to the Settlement Administrator including the Settlement Class member’s name, address, telephone number, and email address (if any), and a statement requesting to be excluded from the Settlement Class. Id. ¶ 104. Any Settlement Class member who does not timely opt-out shall be bound by the Agreement’s terms even if that Settlement Class Member does not submit a Claim Form. Id. The Agreement and Long Form Notice also specify how Settlement Class Members may object to the Settlement and/or the Application for Attorneys’ Fees, Costs, and Service Awards. Id. ¶ 105. Objections must be mailed to the Settlement Administrator. Id. For an objection to be considered by the Court, it must be submitted no later than the last day of the Objection Period, as specified in the Notice (30 days before the original Final Approval Hearing date). Id. If submitted by mail, an objection shall be deemed to have been submitted when posted if received with a postmark date indicated on the envelope if mailed first-class postage prepaid and addressed in accordance with the instructions. If submitted by private courier (e.g., Federal Express), an objection shall be deemed to have been submitted on the shipping date reflected on the shipping label. Id. It must set forth: (a) the objector’s full name, mailing address, telephone number, and email address (if any); (b) all grounds for the objection, accompanied by any legal support for the objection known to the objector or objector’s counsel; (c) the number of times the objector has objected to a class action settlement within the five years preceding the date that the objector files the objection, the caption of each case in which the objector has made such objection, and a copy of any orders related to or ruling upon the objector’s prior objections that were issued by the trial and appellate courts in each listed case; (d) the identity of all counsel who represent the objector, including any former or current counsel who may be entitled to compensation for any reason related to the objection to the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Awards; (e) the number of times in which the objector’s counsel and/or counsel’s law firm have objected to a class action settlement within the five years preceding the date of the filed objection, the caption of each case in which counsel or the firm has made such objection and a copy of any orders related to or ruling upon counsel’s or the counsel’s law firm’s prior objections that were issued by the trial and appellate courts in each listed case in which the objector’s counsel and/or counsel’s law firm have objected to a class action settlement within the preceding five years; (f) the identity of all counsel (if any) representing the objector who will appear at the Final Approval Hearing; (g) a list of all persons who will be called to testify at the Final Approval Hearing in support of the objection (if any); (h) a statement confirming whether the objector intends to personally appear and/or testify at the Final Approval Hearing; and (i) the objector’s signature (an attorney’s signature is not sufficient). Class Counsel and/or Defendant’s Counsel may conduct limited discovery on any objector or objector’s counsel. Id. I. Release of Claims - Plaintiffs and Settlement Class Members who do not timely and validly opt-out of the Settlement Class will be bound by the Settlement terms, including the Releases discharging the Released Claims against the Released Parties. Id. § XIII. The Released Claims are narrowly tailored to only claims arising out of or relating to the Data Incidents. See Joint Declaration. J. Service Awards - The amount of any Service Awards for the Class Representatives shall be determined by the Court and payable from the Settlement Fund. Agreement ¶ 125. Class Counsel will apply to the Court for a Service Award in the amount of $10,000.00 each for those Plaintiffs that were deposed in the 2019 Action and $3,500.00 each for all other Plaintiffs. Id. The Settlement is not contingent on approval of the requests for Service Awards, and if the Court grants amounts other than what was requested, the remaining provisions of the Agreement shall remain in force. Id. ¶ 127. The Notice will advise the Settlement Class of the amounts of the Service Awards that will be sought. Id., Ex. 1-4. Because Plaintiffs will separately apply for the Service Award at the time of seeking Final Approval of the proposed class action Settlement, the Court does not reach a determination as to the fairness of the proposed Service Awards. K. Attorneys’ Fees and Costs - The amount of any attorneys’ fees and costs shall be determined by the Court and payable from the Settlement Fund. Agreement ¶ 126. Class Counsel will apply to the Court for an award of attorneys’ fees of up to 30% of the Settlement Fund, plus reimbursement of costs. Id. The attorneys’ fees and costs will be formally sought in the Application for Attorneys’ Fees, Costs, and Service Awards filed as part of the Motion for Final Approval. The Settlement is not contingent on approval of the requests for attorneys’ fees and costs, and if the Court grants amounts other than what was requested, the remaining provisions of the Agreement shall remain in force. Id. ¶ 127. The Notice will advise the Settlement Class of the amount of attorneys’ fees that Class Counsel intends to seek. Id., Ex. 1-4. Because Plaintiffs will separately apply for the attorneys’ fees at the time of seeking Final Approval of the proposed class action Settlement, the Court does not reach a determination as to the fairness of the proposed attorneys’ fees. A class action may not be settled without the approval of the court. Fed. R. Civ. Proc. 23(e). The decision to approve or reject a proposed settlement “is committed to the sound discretion of the trial judge[.]” See Hanlon v. Chrysler Corp., 150 F.3d 1011, 1026 (9th Cir. 1998). The Supreme Court has recognized the benefits of a proposed settlement of a class action can be realized only through the certification of a settlement class. See Amchem Prods. Inc. v. Windsor, 521 U.S. 591, 620 (1997). The Ninth Circuit has declared that a strong judicial policy favors settlement of class actions. Class Plaintiffs v. City of Seattle, 955 F.2d 1268, 1276 (9th Cir. 1992). However, a class action may not be settled without court approval. Fed. R. Civ. P. 23(e). When the parties to a putative class action reach a settlement agreement prior to class certification, “courts must peruse the proposed compromise to ratify both the propriety of the certification and the fairness of the settlement.” Staton v. Boeing Co., 327 F.3d 938, 952 (9th Cir. 2003). At the preliminary stage, the court must first assess whether a class exists. Id. (citing Amchem, 521 U.S. 591 at 620). Second, the court must determine whether the proposed settlement “is fundamentally fair, adequate, and reasonable.” Hanlon, 150 F.3d at 1026. If the court preliminarily certifies the class and finds the proposed settlement fair to its members, the court schedules a fairness hearing where it will make a final determination as to the fairness of the class settlement. Third, the court must “direct notice in a reasonable manner to all class members who would be bound by the proposal.” Fed. R. Civ. P. 23(e)(1). The Motion for Preliminary Approval contends the Court should find the Settlement is within the range of reasonableness necessary to grant Preliminary Approval under Fed. R. Civ. P. 23(e) and enter an order: (i) granting Preliminary Approval of the Settlement; (ii) provisionally certifying the Settlement Class for settlement purposes; (iii) appointing the Plaintiffs as Class Representatives; (iv) appointing John Yanchunis, Doug McNamara, E. Michelle Drake, David Berger, J. Gerard Stranch IV, Lynn Toops, James Pizzirusso, Gary Klinger, and Jeff Ostrow as Class Counsel for the Settlement Class; (v) approving the form of the Notices and the Notice Program; (vi) approving the Claim Form and the Claim process; (vii) appointing Epiq Class Action & Claims Solutions, Inc. as the Settlement Administrator; (viii) establishing procedures and deadlines for members of the Settlement Class to opt-out of or object to the Settlement; and (ix) scheduling a Final Approval Hearing at which time the Court will consider whether to grant Final Approval of the Settlement and the Application for Attorneys’ Fees, Costs and Service Awards. Accordingly, the Court grants class certification for the purposes of settlement and approves the proposed Settlement on a preliminary basis as fair, reasonable, and adequate. A. Provisional Class Certification. Plaintiffs must satisfy all Fed. R. Civ. P. 23(a) requirements (numerosity, commonality, typicality, and adequacy), and one of the requirements of Fed. R. Civ. P. 23(b). Plaintiffs seek certification under Rule 23(b)(3), requiring common questions of law or fact to predominate over any individual issues and class treatment to be the superior method for efficiently handling the case. Fed. R. Civ. P. 23(b)(3). The Court finds that the Settlement Class meets these class certification requirements. 1. Ascertainability - Ascertainability is an implied prerequisite of Rule 23. Before a district court can consider whether a potential class satisfies Rule 23(a), it must find the proposed class is “precise, objective, and presently ascertainable.” Andersen v. Briad Restaurant Group LLC, No. 2:14-cv-00786-GMN-BNW, 2020 WL 633599, at *1 (D. Nev. Jan. 13, 2020). Class certification and ascertainability typically involve one inquiry because, without an adequate definition for a proposed class, a district court cannot ascertain who belongs in the class. For purposes of class certification, a proposed class is ascertainable if it is adequately defined such that its membership is capable of determination. Ascertainability may be satisfied if it is “administratively feasible” for the court to determine whether a particular individual is a member, though this is not a prerequisite to certification. Briseno v. ConAgra Foods, Inc., 944 F.3d 1121 (9th Cir. 2017). Here, the Settlement Class is adequately defined and clearly ascertainable because the Settlement Class definition contains sufficient objective criteria to allow an individual to determine whether he or she is a member of the Settlement Class—i.e., whether they were sent notice that their Private Information may have been accessed during the Data Incidents. Agreement ¶ 76. 2. Rule 23(a) - Under Rule 23(a), the Court must determine whether: (1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Each requirement is satisfied here. Numerosity - Rule 23(a)(1) requires that a class include so many members that joinder of all would be impracticable. “Impracticability does not mean ‘impossibility,’ but only the difficulty or inconvenience of joining all members of the class.’” Harris v. Palm Springs Alpine Estates, Inc., 329 F.2d 909, 913–14 (9th Cir. 1964) (citation omitted). Generally, numerosity is satisfied when the class exceeds 40 members. Andersen v. Briad Restaurant Group, LLC, 333 F.R.D. 194, 202 (D. Nev. 2019). Here, there are millions of Settlement Class members. Therefore, the Court can safely conclude the Settlement Class is sufficiently numerous such that the joinder of each member would be impracticable. Commonality - Rule 23(a)(2) requires a showing that there are questions of law or fact common to the class. This requirement is satisfied where the plaintiffs assert claims that “depend upon a common contention” that is “of such a nature that it is capable of class-wide resolution— which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). Commonality is a permissive requirement, and “not all questions of fact and law need be common to satisfy the rule.” Hanlon, 150 F.3d at 1019. The “existence of shared legal issues with divergent factual predicates is sufficient, as is a common core of salient facts coupled with disparate legal remedies within the class.” Id. at 1019–20. A single common question will do. Andersen, 333 F.R.D. at 203. Courts in this Circuit have previously addressed this requirement in the context of data breach class actions and found it satisfied. See, e.g., In re PostMeds, Inc. Data Breach Litig., No. 23-cv- 05710-HSG, 2024 WL 4894293, at *2 (N.D. Cal. Nov. 26, 2024) (commonality satisfied because claims turn on whether defendant had legal duty to use reasonable security measures to protect class members’ personal information, whether that duty was breached, and whether defendant’s data security was adequate to protect personal information). Here, as in other data breach cases, the claims turn on whether Defendant’s security environment was adequate to protect the Settlement Class’ Private Information. That inquiry can be fairly resolved because it revolves around evidence that does not vary between members, at least for purposes of the Settlement, for all Settlement Class members at once. Indeed, the Data Incidents impacted each Settlement Class member’s Private Information. The Court is therefore satisfied that, if Plaintiffs were to continue to pursue the Actions, the answers to these questions would result in classwide resolution of the claims asserted. Therefore, the Court finds Plaintiffs have satisfied the commonality requirement. Typicality - The commonality and typicality analyses often overlap—both focus on whether a sufficient nexus exists between the legal claims of the named class representatives and those of individual class members to warrant class certification. Hashemi v. Bosley, Inc., No. CV 21-946 PSG (RAOx), 2022 WL 2155117, at *3 (C.D. Cal. Feb. 22, 2022) (citing Gen. Tel. Co. Sw. v. Falcon, 457 U.S. 147, 157 n.13 (1982)). “The test of typicality ‘is whether other members have the same or similar injury, whether the action is based on conduct which is not unique to the named plaintiffs, and whether other class members have been injured by the same course of conduct.’” Ellis v. Costco Wholesale Corp., 657 F.3d 970, 984 (9th Cir. 2011) (citation omitted). See also Andersen, 333 F.R.D. at 203 (same). “Typicality refers to the nature of the claim or defense of the class representative, and not to the specific facts from which it arose or the relief sought.” Id. “Under the ‘permissive standards’ of Rule 23(a)(3), ‘representative claims are ‘typical’ if they are reasonably co-extensive with those of absent class members; they need not be substantially identical.’” Hanlon, 150 F.3d at 1020. The Court is satisfied that typicality is met because Plaintiffs’ interests are aligned with the Settlement Class in that they all received a notice letter informing them their Private Information may have been compromised as a result of the Data Incidents and were therefore impacted by the same purportedly inadequate data security that allegedly harmed the rest of the Settlement Class. Their claims are based on the same legal theories and underlying event. Adequacy of Representation – “‘To satisfy constitutional due process concerns, absent class members must be afforded adequate representation before entry of a judgment which binds them.’” Andersen, 333 F.R.D. at 204 (citation omitted). Fed. R. Civ. P. 23(a)(4) requires the representative parties “fairly and adequately protect the interests of the class.” This determination turns on two questions: “(1) [d]o the representative plaintiffs and their counsel have any conflicts of interest with other class members, and (2) will the representative plaintiffs and their counsel prosecute the action vigorously on behalf of the class?” Staton, 327 F.3d 938, 957 (9th Cir. 2003); Andersen, 333 F.R.D. at 204. Both components are met. In the instant case, the Court is satisfied at this stage that Plaintiffs will adequately represent the Settlement Class. Like all Settlement Class members, Plaintiffs have claims against Defendant arising from the Data Incidents that allegedly impacted their Private Information. Plaintiffs were similarly injured by Defendant’s allegedly wrongful acts. Proof of Plaintiffs’ claims would necessarily involve adjudicating the same issues of law and fact as the claims of the Settlement Class as a whole. Thus, Plaintiffs and the Settlement Class they seek to represent have the same interests in recovering damages. Further, Plaintiffs have also diligently and adequately prosecuted the Actions through Class Counsel by, among other things, reviewing filings, promptly providing documents and information to Class counsel, the 2019 Plaintiffs responding to written discovery requests and being deposed, acting in the best interest of the Settlement Class, and accepting the classwide Settlement. See Joint Declaration. Plaintiffs’ willingness to serve as Class Representatives demonstrates their serious commitment to bringing about the best results possible for the Settlement Class. The Court further finds that Class Counsel have significant experience in data breach class action lawsuits and have adequately demonstrated their vigorous advocacy on behalf of the Settlement Class’ interests in the Actions. See Joint Declaration., Ex. 1-9. In retaining these firms, Plaintiffs employed counsel who are “qualified, experienced and able to conduct the proposed litigation.” Hester v. Vision Airlines, Inc., No. 2:09-cv-00117, 2009 WL 4893185, at *5 (D. Nev. Dec. 16, 2009) (internal quotation omitted). Class Counsel have litigated the Actions, including, inter alia, evaluating the claims, preparing comprehensive pleadings, pursuing formal and informal discovery, consulting with data security experts, responding to motions to dismiss and preparing and responding to other motions, complying with Court orders and requirements, and participating in a mediation that ultimately resulted in this Settlement. Accordingly, Plaintiffs and Class Counsel will adequately protect the Settlement Class. See Joint Declaration. 3. Rule 23(b)(3) - Rule 23(b)(3) requires the court to find “questions of law or fact common to class members predominate over questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). When assessing predominance and superiority, the court may consider the class will be certified for settlement purposes only, and that a showing of manageability at trial is not required. See Amchem, 521 U.S. at 620 (“Confronted with a request for settlement-only class certification, a district court need not inquire whether the case, if tried, would present intractable management problems, . . . for the proposal is that there be no trial.”). Predominance – The predominance inquiry looks at “the legal or factual questions that qualify each class member’s case as a genuine controversy, questions that preexist any settlement.” Amchem, 521 U.S. at 623. If common questions “present a significant aspect of the case and they can be resolved for all members of the class in a single adjudication,” then “there is clear justification for handling the dispute on a representative rather than on an individual basis,” and the predominance test is satisfied. Hanlon, 150 F.3d at 1022 (citing Amchem, 521 U.S. at 622). There is no definitive test, however, in general, predominance is met when there exists generalized evidence which proves or disproves an [issue or] element on a simultaneous, classwide basis, since such proof obviates the need to examine each class members’ individual position. The main concern is “the balance between individual and common issues.” In re Wells Fargo Home Mortg., 571 F.3d 953, 959 (9th Cir. 2009). Here, all Settlement Class members had their Private Information compromised in the Data Incidents and the security practices at issue did not vary from person to person. Thus, because these common questions represent a significant aspect of the case and they can be resolved for all members of the class in a single adjudication, there is a clear justification for handling the dispute on a representative rather than on an individual basis. Id. Predominance is satisfied. Superiority – “[T]he purpose of the superiority requirement is to assure that the class action is the most efficient and effective means of resolving the controversy.” Wolin v. Jaguar Land Rover N. Am. LLC, 617 F.3d 1168, 1175 (9th Cir. 2010). Rule 23(b)(3)’s non-exclusive factors are: “(A) the interest of members of the class in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already commenced by or against members of the class; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the difficulties likely to be encountered in the management of a class action.” All of these factors are present here. Adjudicating individual actions would be impractical. The amount in dispute for each Settlement Class member is too small, the technical issues too complex, and the expert testimony and document review too costly. See Joint Declaration. Further, individual claim prosecution would be prohibitively expensive, needlessly delay resolution, and may lead to inconsistent rulings. Id. Accordingly, a class action is the superior method of adjudicating this case. Id. Accordingly, because the Settlement Class satisfies the requirements of Rule 23(a) and 23(b), the Court hereby provisionally certifies the Settlement Class for settlement purposes. B. Preliminarily Approval of the Settlement. After determining settlement class certification is likely, the Court must determine whether the Settlement is worthy of preliminary approval and providing notice to the Settlement Class. The decision to approve or reject a proposed settlement “is committed to the sound discretion of the trial judge[.]” Hanlon, 150 F.3d at 1026. This discretion is to be exercised “in light of the strong judicial policy that favors settlements, particularly where complex class action litigation is concerned,” which minimizes substantial litigation expenses for both sides and conserves judicial resources. See Linney v. Cellular Alaska P’ship, 151 F.3d 1234, 1238 (9th Cir. 1998) (quotations omitted).3 Courts have long recognized that “settlement class actions present unique due process concerns for absent class members.” Hanlon, 150 F.3d at 1026. One inherent risk is that class counsel may collude with the defendants, “tacitly reducing the overall settlement in return for a higher attorney’s fee.” Knisley v. Network Assocs., Inc., 312 F.3d 1123, 1125 (9th Cir. 2002); see Evans v. Jeff D., 475 U.S. 717, 733 (1986). The question at the preliminary approval stage is whether the Court is likely to find the Settlement is fair, adequate, and reasonable under Fed. R. Civ. P. 23(e)(2) and considering the Ninth Circuit traditional “Churchill” factors.4 The Rule 23(e)(2) factors are:

3 Courts must give “proper deference to the private consensual decision of the parties,” since “the court’s intrusion upon what is otherwise a private consensual agreement negotiated between the parties to a lawsuit must be limited to the extent necessary to reach a reasoned judgment that the agreement is not the product of fraud or overreaching by, or collusion between, the negotiating parties, and that the settlement, taken as a whole, is fair, reasonable and adequate to all concerned.” Hanlon, 150 F.3d at 1027. Thus, in considering a potential settlement, the Court need not reach any ultimate conclusions on the issues of fact and law which underlie the merits of the dispute and need not engage in a trial on the merits. Officers for Justice v. Civil Service Comm’n, 688 F.2d 615, 625 (9th Cir. 1982), cert. denied sub nom. Byrd v. Civil Serv. Comm’n, 459 U.S. 1217 (1983). 4 Rule 23(e)(2) was amended in 2018 to include explicit class settlement approval factors. However, consistent with the Advisory Committee note to that rule amendment, courts in this Circuit have made clear the amendment does not entirely displace the traditional Ninth Circuit factors, which overlap with the express Rule 23(e)(2) factors. See, e.g., McKinney-Drobnis v. Oreshack, 16 F.4th 594, 609 n.4 (9th Cir. 2024) (citing Fed. R. Civ. P. 23 Advisory Committee’s note to the 2018 amendment). ((AB)) tthhee pclraospso rseapl rwesaesn ntaetgivoetisa taendd a ct laarsms cs’o ulennsgetlh h;a ve adequately represented the class; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other. The Churchill factors are: “(1) the strength of the plaintiff’s case; (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of maintaining class action status through trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) the experience and views of counsel; (7) the presence of a governmental participant; and (8) the reaction of the class members of the proposed settlement.” In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 946 (9th Cir. 2011) (quoting Churchill Vill., L.L.C. v. Gen. Elec., 361 F.3d 566, 575 (9th Cir. 2004)). Where, as here, “a settlement agreement is negotiated prior to formal class certification, consideration of these eight Churchill factors alone is not enough.” Id. Prior to formal class certification, there is an even greater potential for a breach of fiduciary duty owed the class during settlement. Accordingly, “such agreements must withstand an even higher level of scrutiny for evidence of collusion or other conflicts of interest than is ordinarily required under Rule 23(e) before securing the court’s approval as fair.” Id. (citing Hanlon, 150 F.3d at 1026); accord In re Gen. Motors Corp. Pick–Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 805 (3d Cir. 1995) (cautioning that courts must be “even more scrupulous than usual in approving settlements where no class has yet been formally certified”); Mars Steel Corp. v. Cont'l Ill. Nat’l Bank & Trust Co. of Chicago, 834 F.2d 677, 681 (7th Cir. 1987) (“[W]hen class certification is deferred, a more careful scrutiny of the fairness of the settlement is required.”); Weinberger v. Kendrick, 698 F.2d 61, 73 (2d Cir. 1982) (noting that reviewing courts must employ “even more than the usual care”); see also Manual for Complex Litig. § 21.612 (4th ed. 2004). Therefore, before approving a precertification settlement, the Court must not only show that it “has explored [the Rule 23(e)(2) and Churchill] factors comprehensively, but also that the settlement is not the product of collusion among the negotiating parties.” In re Bluetooth, 654 F.3d at 947. Because collusion is unlikely to be evident from the face of the settlement itself, “courts must be particularly vigilant not only for explicit collusion, but also for more subtle signs that class counsel have allowed pursuit of their own self-interests and that of certain class members to infect the negotiations.” Id. Because collusion is unlikely to be evident from the face of the settlement itself, “courts must be particularly vigilant not only for explicit collusion, but also for more subtle signs that class counsel have allowed pursuit of their own self-interests and that of certain class members to infect the negotiations.” Id. A few such signs include: (1) “when counsel receive a disproportionate distribution of the settlement”; (2) “when the parties negotiate a ‘clear sailing’ arrangement providing for the payment of attorneys’ fees separate and apart from class funds”; and (3) “when the parties arrange for fees not awarded to revert to defendants rather than be added to the class fund.” Id. For the following reasons, the Settlement is granted Preliminary Approval, applying the Rule 23(e)(2) and Churchill factors.5 The Court is likely to find the Settlement is fair, reasonable, and adequate at the final approval stage. 1. Adequacy of Representation (Rule 23(e)(2)(A) and Churchill Factor 5) – Both Class Counsel and the Class Representative have adequately represented the Settlement Class. Class Counsel have adequately represented the Settlement Class by fully investigating and litigating the facts and legal claims. Their substantial efforts are exhibited by the formal and informal discovery regarding the 2019 Data Incident, and, while settlement of the 2023 Data Incident claims is coming at an earlier stage, Class Counsel’s efforts to use informal discovery to learn what occurred to cause the 2023 Data Incident and the Private Information impacted, before attending a full-day mediation session with an experienced mediator, which allowed for arm’s length and good faith negotiations, without collusion. See Joint Declaration. Class Counsel used their experience in complex class action litigation, including similar data breach actions, and devoted substantial time and resources to vigorous litigation. Id.

5 The seventh factor is inapplicable, and the eighth factor is in applicable at this time and is best considered after Notice of the Settlement is sent to see if there is any opposition to the Settlement. The Class Representatives also have demonstrated their adequacy by (i) having a genuine personal interest in the outcome of the case; (ii) selecting well-qualified Class Counsel; (iii) producing information and documents to Class Counsel to permit investigation and development of the complaints; (iv) being available as needed, including to respond to discovery and in the case of the 2019 Plaintiffs sitting for deposition; (v) monitoring the Actions; and (vi) reviewing the Settlement terms. See Joint Declaration. Plaintiffs’ respective interests are coextensive and do not conflict with the interests of the Settlement Class. Id. Plaintiffs have the same interest in the Settlement relief, and the absent Settlement Class members have no diverging interests. Id. Therefore, the Court finds Rule 23(e)(2)(A) and Churchill factor 5 weigh in favor of approval. 2. The Settlement Was Negotiated at Arm’s Length (Rule 23(e)(2)(B) and Churchill Factor 6) – This Circuit puts “a good deal of stock in the product of arms-length, negotiated resolution.” Rodriguez v. W. Publ’g Corp., 563 F.3d 948, 965 (9th Cir. 2009) (citing Hanlon, 150 F.3d at 1027; Officers for Justice, 688 F.2d at 625). Critically, there is “[a]n initial presumption of fairness is usually involved if the settlement is recommended by class counsel after arm’s-length bargaining.” Wren v. RGIS Inventory Specialists, No. C-06-05778 JCS, 2011 WL 1230826, at *6 (N.D. Cal. Apr. 1, 2011), supplemented, No. C-06-05778 JCS, 2011 WL 1838562 (N.D. Cal. May 13, 2011). The Settlement is the result of good faith, informed, and arm’s-length negotiations between experienced attorneys familiar with class action litigation and with the legal and factual issues at stake. See Joint Declaration. Class Counsel recommend approval of the Settlement after they thoroughly investigated and analyzed Plaintiffs’ claims; fully briefed the motion to dismiss the 2019 Data Incident claims, which the court denied in part and granted in part; engaged in formal and informal discovery for the 2019 Data Incident and informal discovery for the 2023 Data Incident; and consulted with data security experts, enabling them to gain an understanding of the evidence related to central questions in the Actions and preparing them for well-informed settlement negotiations. Id. The Settlement was reached with the assistance of a well-respected and experienced mediator. Id. For these reasons and those discussed related to attorneys’ fees below, there was no fraud or collusion in arriving at the Settlement.6 Therefore, the Court finds Rule 23(e)(2)(B) and Churchill factor 6 weigh in favor of approval. 3. The Adequacy of the Settlement Relief (Rule 23(e)(2)(C) and Churchill Factors 1- 4) – Although Plaintiffs believe the claims asserted in the Actions are strong and meritorious and the Settlement Class would ultimately prevail at trial, continued litigation against Defendant poses significant risks that make any recovery for the Settlement Class uncertain. In assessing the degree of risk of continued litigation, “the court evaluates the time and cost required.” Adoma v. Univ. of Phoenix, Inc., 913 F.Supp.2d 964, 976 (E.D. Cal. 2012). “[U]nless the settlement is clearly inadequate, its acceptance and approval are preferable to lengthy and expensive litigation with uncertain results.” Id. (quoting Nat’l Rural Telecommunications Coop. v. DIRECTV, Inc., 221 F.R.D. 523, 526 (C.D. Cal. 2004)). “The parties . . . save themselves the time, expense, and inevitable risk of litigation. Naturally, the agreement reached normally embodies a compromise; in exchange for the saving of cost and elimination of risk, the parties each give up something that they might have won had they proceeded with litigation.” Officers for Justice, 688 F.2d at 624 (quoting United States v. Armour & Co., 402 U.S. 673, 681–82 (1971)). Data breach class actions are risky. See, e.g., In re Mednax Serv., Customer Data Sec. Breach Litig., No. 21-MD-02994-RAR, 2024 WL 1554329, at *7 (S.D. Fla. Apr. 10, 2024); In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1273 (11th Cir. 2021) (“Settlements also save the bench and bar time, money, and headaches”); FultonGreen v. Accolade, Inc., No. 18-274, 2019 WL 4677954, at *8 (E.D. Pa. Sept. 24, 2019) (noting that data breach class actions are “a risky field of litigation because [they] are uncertain and class certification is rare”). See also, e.g., In re Blackbaud, Inc., Customer Data Breach Litig., No. 3:20-mn-02972-JFA, 2024 WL 2155221 (D.S.C. May 14, 2024) (denying class certification in a data breach case). The Settlement’s fairness is underscored by consideration of the obstacles the Settlement Class would face in ultimately

6 None of the so-called “Bluetooth” factors are of concern. See In re Bluetooth, 654 F.3d at 947. First, Class Counsel will not receive a disproportionate distribution from the Settlement Fund. Second, there is no clear-sailing arrangement regarding the attorneys’ fees Class Counsel will seek. Agreement ¶ 127. Third, there is no provision that unawarded attorneys’ fees would revert to Defendant. succeeding on the merits, as well as the expense and likely duration of the litigation. Despite the risks involved with further litigation, the Settlement provides outstanding benefits, including Cash Payments and Financial Account Monitoring for all Settlement Class Members. Also, the Claim Form submission process and distribution of Settlement Class Member Benefits is fair, convenient, and effective. Settlement Class Members will promptly receive Cash Payments by electronic means or paper check issued by the Settlement Administrator and Financial Account Monitoring, if elected. The Settlement Administrator is highly qualified to manage the entire process. See Joint Declaration. Thus, through the Settlement, Plaintiffs and Settlement Class Members gain significant benefits without having to face further risk of not receiving any relief at all. Andersen, 2022 WL 181262 at *7. Furthermore, the attorneys’ fees do not impact the other terms of the Settlement, as Class Counsel and Defendant negotiated and reached agreement regarding attorneys’ fees and costs only after reaching agreement on all other material Settlement terms. See Joint Declaration. The Settlement, including disbursement of the Settlement Class Member Benefits, is also not contingent on approval of the attorneys’ fee or costs award to Class Counsel or the Service Awards. Agreement ¶ 127. As the Application for Attorneys’ Fees, Costs, and Service Awards will detail, the 30% of the common Settlement Fund that will be sought is within the typical range of acceptable attorneys’ fees in the Ninth Circuit. See Vizcaino v. Microsoft Corp., 290 F.3d 1043, 1048 (9th Cir. 2002); Smith v. One Nevada Credit Union, No. 2:16-cv-02156, 2018 WL 4407251, at *8 (D. Nev. Sept. 16, 2018). Finally, the Parties’ agreements are all in the Agreement. See Joint Declaration. Therefore, the Court finds Rule 23(e)(2)(C) and Churchill factors 1-4 weigh in favor of approval. 4. The Equitable Treatment of Settlement Class Members (Rule 23(e)(2)(D)) – All Settlement Class Members are given an equal opportunity to claim Settlement Class Member Benefits. Specifically, each has the option to be reimbursed for documented losses up to $15,000.00, may elect to receive a flat cash payment based upon their respective Settlement Class tier, and all may select Financial Account Monitoring. The tiering of additional flat cash payments reasonably assigns higher value to the more valuable categories of Private Information exfiltrated in the Data Incidents. All Settlement Class Member Cash Payments may be subject to a pro rata increase or decrease, depending on the number of Valid Claims and the value of all Cash Payments claimed. Thus, the Settlement Class Member Benefits distribution method will be equitable and effective. Therefore, the Court finds Rule 23(e)(2)(D) weighs in favor of approval. Accordingly, the Court is likely to find the Settlement is fair, reasonable, and adequately protects the interests of the Settlement Class members.

C. The Court Appoints the Proposed Class Representatives, Class Counsel, and Settlement Administrator. Plaintiffs have been integral to Class Counsel throughout litigation and settlement. See Joint Declaration. The 2019 Plaintiffs were very involved in this litigation. Id. They assisted with the preparation of the 2019 Complaint, provided necessary factual information and helped respond to written discovery requests, had their depositions taken, communicated with Class Counsel when needed, and reviewed settlement documents. Id. The 2023 Plaintiffs assisted with the preparation of the 2023 Complaint, provided necessary factual information, communicated with Class Counsel when needed, and reviewed settlement documents. Id. Moreover, Plaintiffs are committed to continuing to assist Class Counsel through Final Approval. Id. Because Plaintiffs are adequate, the Court appoints them as Class Representatives. For the same reasons discussed above for adequacy of representation, and when appointing them on an interim basis in the Actions, the Court designates John Yanchunis, Doug McNamara, E. Michelle Drake, David Berger, J. Gerard Stranch IV, Lynn Toops, James Pizzirusso, Gary Klinger, and Jeff Ostrow as Class Counsel. Fed. R. Civ. P. 23(g)(1)(A)’s four factors for appointing class counsel for a certified class are (1) “the work counsel has done in identifying or investigating potential claims in the action;” (2) “counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action;” (3) “counsel’s knowledge of the applicable law;” and (4) “the resources that counsel will commit to representing the class.” The Court may also “consider any other matter pertinent to counsel’s ability to fairly and adequately represent the interests of the class[.]” Fed. R. Civ. P. 23(g)(1)(B). Here, Plaintiffs and the Settlement Class are represented by qualified and competent Class Counsel who are leaders in the class action field with extensive experience prosecuting and resolving complex class actions. See Joint Declaration, Ex. 1-9. Before commencing litigation, they investigated the potential claims against Defendant, interviewed potential plaintiffs, and gathered information regarding the Data Incident. Id. Class Counsel has devoted substantial time and resources to the Actions and will continue to do so. Id. Finally, subject to Court approval, the Parties have agreed Epiq should be the Settlement Administrator. Epiq has a long history of successful class action administrations. See generally Admin. Decl. The Court approves Epiq as the Settlement Administrator. D. The Proposed Notice Program and Claim Process Are Reasonable. Under Fed. R. Civ. P. 23(e)(1), the Court should “direct notice in a reasonable manner to all class members who would be bound” by the proposed settlement. Notice of a proposed settlement must be the “best notice practicable.” Fed. R. Civ. P. 23(c)(2)(B). “[B]est notice practicable” means “individual notice to all members who can be identified through reasonable effort.” Eisen v. Carlisle & Jacquelin, 417 U.S. 156, 173 (1974); see also Andersen, 2022 WL 181262 at *6 (notice satisfactory if it describes the settlement terms in sufficient detail to alert those with adverse viewpoints to investigate and to come forward to be heard). The best notice practicable is that which “is reasonably calculated, under all of the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.” Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306, 314 (1950). Moreover, Fed. R. Civ. P. 23(h)(1) requires that “[n]otice of the motion [for attorneys’ fees] must be served on all parties and, for motions by class counsel, directed to class members in a reasonable manner.” The Notice Program satisfies the foregoing criteria. The Parties negotiated the form of the Notices with the Settlement Administrator’s input and assistance. The Notice will be directly disseminated to all persons who fall within the Settlement Class definition and whose names, email addresses, and postal addresses can be identified with reasonable effort from Defendant’s records, and through databases tracking nationwide addresses and address changes, as well as through publication on digital media. See In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 946 (9th Cir. 2015) (notice provided by mail and email was sufficient). In addition, Epiq will administer the Settlement Website containing relevant information about the Settlement and maintain the toll-free telephone line that Settlement Class members can call. Further, the Notices include, among other information: a description of the material terms of the Settlement; how to submit a Claim Form; the Claim Form Deadline; the last day of the Opt-Out Period for Settlement Class members to opt-out of the Settlement Class; the last day of the Objection Period for Settlement Class Members to object to the Settlement and/or Application for Attorneys’ Fees, Costs, and Service Awards; the Final Approval Hearing date; and the Settlement Website address at which Settlement Class members may access this Agreement and other related documents and information. Agreement § VIII. The Long Form Notice and Settlement Website will also detail the opt-out and objection procedures approved by the Court. Finally, the Notice Program satisfies the requirements of Rule 23(h)(1), as the Notices will notify the Settlement Class that Class Counsel may apply to the Court for an award of attorneys’ fees of up to 30% of the Settlement Fund, plus reimbursement of costs, and for Service Awards for the Class Representatives. Id. Thus, the Court approves the Notice Program, including the form and content of the Notices. Agreement, Exs. 1-4. The Court also approves the opt-out and objection procedures set forth in the Agreement and summarized in this Order. The Court also approves the Claim Form and Claim process. The Claim Form is easy to understand and may be submitted online through the Settlement Website or through U.S. Mail sent to the Settlement Administrator. Id. ¶ 111. As noted above, the Settlement Administrator will review all Claim Forms to determine their validity, eligibility, and the type and amount of the Cash Payment to which the Settlement Class Member may be entitled, and the Claim review process is robust. Id. ¶¶ 112-116. The Court directs the Settlement Administrator to disseminate the Notices and Claim Form as approved herein. Class Counsel and Defendant’s Counsel are hereby authorized to use all reasonable procedures in connection with approval and administration of the Settlement that are not materially inconsistent with this order or the Settlement, including making, without the Court’s further approval, minor form or content changes to the Notices and Claim Form they jointly agree are reasonable or necessary. IT IS HEREBY ORDERED that the Motion for Preliminary Approval (ECF No. __) is GRANTED as follows: 1. The Settlement Class is granted provisional class certification. 2. Plaintiff’s Counsel, John Yanchunis, Doug McNamara, E. Michelle Drake, David Berger, J. Gerard Stranch IV, Lynn Toops, James Pizzirusso, Gary Klinger, and Jeff Ostrow are appointed as Class Counsel. 3. Plaintiffs are appointed as Class Representatives. 4. Epiq Class Action & Claims Solutions, Inc. is appointed as Settlement Administrator. 5. The proposed Settlement agreement is preliminarily approved as fair, reasonable, and adequate. 6. If the Settlement is terminated, not approved, canceled, fails to become effective for any reason, or the Effective Date does not occur, this Preliminary Approval Order shall become null and void and shall be without prejudice to the rights of Plaintiffs, the Settlement Class members, and Defendant, all of whom shall be restored to their respective positions in the Actions as provided in the Agreement. 7. All pretrial proceedings in the Actions are stayed and suspended until further order of this Court, except such actions as may be necessary to implement the Settlement and this Preliminary Approval Order. 8. Upon the entry of this Preliminary Approval Order, with the exception of Class Counsel’s, Defendant’s Counsel’s, Defendant’s, and the Class Representatives’ implementation of the Settlement and the approval process in the Actions, all members of the Settlement Class shall be provisionally enjoined and barred from asserting any claims or continuing any litigation against Defendant and the Released Parties arising out of, relating to, or in connection with the Released Claims prior to the Court’s decision as to whether to grant Final Approval of the Settlement. 9. For the benefit of the Settlement Class and to protect this Court’s jurisdiction, this Court retains continuing jurisdiction over the Settlement proceedings to ensure the effectuation thereof in accordance with the Settlement preliminarily approved herein and the related orders of this Court. 10. The Final Approval Hearing will be conducted for the following purposes: (a) to determine whether the proposed Settlement, on the terms and conditions provided for in the Settlement, is fair, reasonable, and adequate, and should be approved by the Court; (b) to determine whether an order of Final Judgment should be entered dismissing the Actions on the merits and with prejudice; (c) to determine whether the proposed plan of allocation and distribution of the Settlement Fund is fair and reasonable and should be approved; (d) to determine whether any requested award of attorneys’ fees and costs to Class Counsel and Service Awards to the Class Representatives should be approved; and (e) to consider any other matters that may properly be brought before the Court in connection with the Settlement. The Court may elect to hold the Final Approval Hearing virtually by Zoom or some other application, and if it does, the instructions on how to attend shall be posted by the Settlement Administrator on the Settlement Website. 11. Consistent with the Agreement, the following scheduled is imposed leading up to the Final Approval Hearing that shall take place on June 18 , 2025, at 9:00 a.m. in Courtroom 7D, located at Lloyd D. George Federal Courthouse, 333 Las Vegas Boulevard South, Las Vegas, Nevada 89101, before District Court Judge Gloria M. Navarro: Deadline to commence Notice Program Within 30 days of the Preliminary Approval Order Deadline to complete Notice Program 45 days before the original Final Approval Hearing date Deadline for filing Motion for Final Approval, | 45 days before the original Final Approval including Class Counsel’s Application for | Hearing date Attorneys’ Fees, Costs, and Service Awards Opt-Out Period Ends 30 days before the original Final Approval Hearing date Objection Period Ends 30 days before the original Final Approval Hearing date ) Claim Form Deadline 15 days before the original Final Approval Hearing date Final Approval Hearing June 18 , 2025 at 9:00 a.m. DATED this 21 day of _ January __, 2025. Ae Gloria avarro, District Judge UNITED Sf#ATES DISTRICT COURT 29