Thomsen v. Morley Companies, Inc.

• Court: District Court, E.D. Michigan
• Decided: November 4, 2022
• Docket: 1:22-cv-10271
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MICHIGAN NORTHERN DIVISION

CHRISTINE THOMSEN et al.,

Plaintiffs, Case No. 1:22-cv-10271

v. Honorable Thomas L. Ludington United States District Judge MORLEY COMPANIES, INC.,

Defendant. ________________________________________/ OPINION AND ORDER (1) GRANTING PLAINTIFFS’ MOTION FOR PRELIMINARY APPROVAL OF SETTLEMENT, (2) CERTIFYING SETTLEMENT CLASS, (3) APPOINTING CLASS REPRESENTATIVES, (4) APPOINTING CLASS COUNSEL, (5) APPROVING NOTICE PLAN, (6) APPOINTING CLAIMS ADMINISTRATOR, (7) DIRECTING PUBLICATION OF NOTICE, AND (8) SETTING SCHEDULING ORDER

Fifteen Plaintiffs brought this data-breach class action against Defendant Morley Companies, alleging their personal information was stolen from Defendant during a “massive ransomware-type malware attack” in August 2021. ECF No. 16 at PageID.448. After successful settlement negotiations, Plaintiffs filed an unopposed motion for (1) settlement class certification; (2) appointment of Plaintiffs as class representatives; (3) appointment of Attorney Bryan L. Bleichner as class counsel for settlement purposes; (4) preliminary approval of the settlement; (5) approval of the proposed notice plan; and (6) appointment of Equip Class Action & Claims Solutions, its affiliate Hilsoft Notifications, or both as claims administrator. ECF No. 26 I. In February 2022, Plaintiff Christine Thomsen sued Defendant for negligence, alleging her personal information was stolen from Defendant during a malware attack because of Defendant’s lack of cyber security. ECF No. 1. Other plaintiffs filed similar lawsuits against Defendant, voluntarily dismissed their claims without prejudice, and joined this case. See ECF No. 17 at PageID.778–79. In March 2022, Plaintiffs filed an amended complaint adding claims of unjust enrichment and breach of contract. Id. In May 2022, the parties reached a settlement, ECF No. 15, and spent three months negotiating the details, ECF No. 26 at PageID.1680. On September 5, 2022, Plaintiffs filed an

unopposed motion for preliminary approval of the settlement agreement (the “Agreement”) under Federal Rule of Civil Procedure 23(e). ECF No. 26. The Agreement provides payments to the members of the proposed settlement class (the “Class”), release of claims, class-notice procedures, settlement administration, attorney’s fees, service awards, and termination of the Agreement. See generally ECF No. 26-2. II. The claims of “a class proposed to be certified for purposes of settlement[] may be settled, voluntarily dismissed, or compromised only with the court’s approval.” FED. R. CIV. P. 23(e). The question at the preliminary-approval stage is “simply whether the settlement is fair

enough” to begin the class-notice process. Garner Props. & Mgmt. v. City of Inkster, 333 F.R.D. 614, 626 (E.D. Mich. 2020). At the preliminary-approval stage, Rule 23(e) requires the parties to “provide the court with information sufficient to enable it to determine whether to give notice of the proposal to the class.” FED. R. CIV. P. 23(e)(1)(A). “The court must direct notice” of a proposed settlement “to all class members who would be bound” by it if “the court will likely be able to approve the proposal under Rule 23(e)(2)[] and certify the class for purposes of judgment on the proposal.” FED. R. CIV. P. 23(e)(1)(B). After preliminary approval, notice, and time for objections, the proposed settlement may be finally approved “only after a hearing and only on finding that it is fair, reasonable, and adequate.” FED. R. CIV. P. 23(e)(2). III.

A. RULE 23 CLASS CERTIFICATION Plaintiffs define the Class as “all natural persons residing in the United States who were sent notice letters notifying them that their Private Information was compromised in the Data Incident announced by Defendant on or about August 1, 2021.” ECF No. 26 at PageID.1680. The Class excludes (1) Defendant and its respective officers and directors; (2) all members of the Class who timely and validly request exclusion from the settlement class; (3) the undersigned Judge assigned to evaluate the fairness of the settlement; and (4) any other person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity that caused the August 2021 Data Incident to occur or who pleads nolo contendere to any such charge. ECF No. 26-2 at PageID.1721.

As explained below, the Class will be certified under Rules 23(a) and (b). 1. Rule 23(a) Requirements i. Numerosity

The Class must be “so numerous that joinder of all members is impracticable.” FED. R. CIV. P. 23(a)(1). Although “there is no strict numerical test, ‘substantial’ numbers usually satisfy the numerosity requirement.” Daffin v. Ford. Motor Co., 458 F.3d 549, 552 (6th Cir. 2006). The Class satisfies numerosity. It includes 694,679 people who might have had their personal information stolen. ECF No. 26 at PageID.1687. This “sheer” volume satisfies numerosity. See Barry v. Corrigan, 79 F. Supp. 3d 712, 731 (E.D. Mich. 2015) (holding that “sheer number of” 4,562 people independently satisfied numerosity, even though “number of potential class members is not dispositive”), aff’d sub nom. Barry v. Lyon, 834 F.3d 706 (6th Cir. 2016). ii. Commonality

The Class must share common questions of law or fact. FED. R. CIV. P. 23(a)(2). Commonality requires “a common contention” that, if resolved, would resolve claims of all class members “in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). A common question of law or fact exists if all the Class’s members suffered the same injury. Id. at 349–50. Plaintiffs rely on the common question of whether Defendant’s data security adequately protected the Class’s personal information. ECF No. 26 at PageID.1688. This factual question is common to all the members of the Class. Therefore, it is capable of class-wide resolution, satisfying commonality. See Coulter-Owens v. Time, Inc., 308 F.R.D. 524, 533–34 (E.D. Mich. 2015) (finding commonality is satisfied if “the litigation is driven by issues that are common to the entire putative class”). iii. Typicality

“[T]he claims or defenses of the representative parties [must be] typical of the claims and defenses of the class.” FED. R. CIV. P. 23(a)(3). Typicality is satisfied if the representative’s claim “arises from the same [transaction or occurrence as] the claims of other class members, and [they] are based on the same legal theory.” Beattie v. CenturyTel, Inc., 511 F.3d 554, 561 (6th Cir. 2007). The claims of Plaintiffs and the Class arise from the same Data Incident and resulted in similar theft of personal information. ECF No. 26 at PageID.1689. Thus, resolving one plaintiff’s claims would resolve them for the Class, satisfying typicality. Sprague v. Gen. Motors Corp., 133 F.3d 388, 399 (6th Cir. 1998) (“[A]s goes the claim of the named plaintiff, so go the claims of the class.”). iv. Adequacy of Representation

Finally, “the representative parties [must] fairly and adequately protect the interest of the class.” FED. R. CIV. P. 23(a)(4). Adequacy is governed by two criteria: “1) the representative must have common interests with unnamed members of the class, and 2) it must appear that the representatives will vigorously prosecute the interests of the class through qualified counsel.” In re Am. Med. Sys., Inc., 75 F.3d 1069, 1083 (6th Cir. 1996). The Class satisfies both criteria. Plaintiffs have the same claims as the Class: that their personal information was stolen after Defendant was the victim of a malware attack. Plaintiffs add that they have “participated actively” in the case. ECF No. 26 at PageID.1689. And the proposed lead-plaintiff incentive award does not misalign the interests of Plaintiffs and the Class. ECF No 26-2 at PageID.1746 (proposing “up to $1,500” as a “service award” for “each” lead plaintiff); see also Hadix v. Johnson, 322 F.3d 895, 897 (6th Cir.2003) (expressing a “sensibl[e] fear that incentive awards may lead named plaintiffs to expect a bounty for bringing suit or to compromise the interest of the class for personal gain”).

2. Rule 23(b) Requirements The Class must also satisfy one of the three requirements of Rule 23(b). Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 345 (2011). Plaintiffs contend the Class satisfies Rule 23(b)(3), which permits class actions if (1) the common questions of law and fact predominate over any questions affecting only individuals and (2) the class-action mechanism is superior to the other available methods for the fair and efficient adjudication of the controversy. FED. R. CIV. P. 23(b)(3). i. Common questions of law or fact predominate Predominance is satisfied if the Class’s individual questions of law or fact “are sufficiently cohesive to warrant adjudication by representation.” Amchem Prods. v. Windsor, 521 U.S. 591, 623 (1997). Here, the injury of each member of the Class—the theft of personal information—was the result of Defendant’s alleged “uniform” course of conduct. ECF No. 26 at PageID.1691. In this way, all the claims of the entire Class involve the same questions of law and fact, satisfying predominance. See Powers v. Hamilton Cnty. Pub. Def. Comm’n, 501 F.3d 592, 619 (6th Cir. 2007) (“Cases alleging a single course of wrongful conduct are particularly well-suited to class

certification.” (citation omitted)). ii. Class action is the superior method to adjudicate the controversy fairly and effectively Superiority “is met if the class action is a better way than individual litigation to adjudicate a claim.” Calloway v. Caraco Pharm. Lab’ys, 287 F.R.D. 402, 407 (E.D. Mich. 2012) (citing Daffin v. Ford Motor Co., 458 F.3d 549, 554 (6th Cir. 2006)). A class action is superior if it would “vindicate[] ‘the rights of groups of people who individually would be without effective strength to bring their opponents into court at all.’” See Amchem, 521 U.S. at 617 (citation omitted). A class action is the best way to vindicate the Class’s rights under these circumstances. Because the data-breach issues predominate, it would be impractical for the members of the Class

to individually sue the same defendant for theft of their personal information. See In re Sonic Corp. Customer Data Breach Litig., No. 1:17-MD-02807-JSG, 2020 WL 6701992, at *6 (N.D. Ohio Nov. 13, 2020) (finding that class action was superior because all class members suffered same injury from same data breach). For these reasons, superiority is satisfied. B. APPOINTMENT OF ATTORNEYS AS CLASS COUNSEL After certifying a class, the court must appoint class counsel. FED. R. CIV. P. 23(g)(1). Before appointing class counsel, the court must consider: (1) the work counsel has done in identifying or investigating potential claims in the action; (2) counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action; (3) counsel’s knowledge of the applicable law; and (4) the resources that counsel will commit to representing the class.

Id. Plaintiffs propose Bryan L. Bleichner as Class counsel. ECF No. 26 at PageID.1692. He has invested many hours investigating the claims in this case. See ECF No. 26-3 at PageID.1804– 08. And he has extensive experience in prosecuting data-breach class actions. See id. at PageID.1824–32 (listing data-breach class actions with Bleichner as class counsel). Through that experience, he has ample knowledge of the applicable law and the necessary resources. Id. Therefore, Bryan L. Bleichner will be appointed as Class Counsel. C. PRELIMINARY APPROVAL OF SETTLEMENT AGREEMENT There are two steps for approving class settlements: “(1) preliminary approval of the settlement and the content and method of class notice; and (2) final approval after notice and a fairness hearing.” Sheick v. Auto. Component Carrier, LLC, No. 09-14429, 2010 WL 3070130, at *11 (E.D. Mich. Aug. 2, 2010) (citing Gautreaux v. Pierce, 690 F.2d 616, 621 n.3 (7th Cir. 1982)). At the preliminary-approval stage, the issue is whether the Agreement “is fair enough . . . to expend the effort and costs associated with sending potential class members notice and processing opt-outs and objections.” Garner Props. & Mgmt. v. City of Inkster, 333 F.R.D. 614, 626 (E.D. Mich. 2020). The Agreement should be preliminarily approved if it “(1) ‘does not disclose grounds to doubt its fairness or other obvious deficiencies, such as unduly preferential treatment to class representatives or of segments of the class, or excessive compensation for

attorneys,’ and (2) ‘appears to fall within the range of possible approval’” at the final-approval stage. Sheick, 2010 WL 3070130, at *11 (quoting In re Inter–Op Hip Prosthesis Liab. Litig., 204 F.R.D. 330, 350 (N.D. Ohio 2001)). At the final-approval stage, the Agreement will be approved if it is fair, reasonable, and adequate. FED R. CIV. P. 23(e)(2). To that end, factors from the Sixth Circuit and the Federal Rules of Civil Procedure guide the analysis.1 As explained below, the Agreement is fair, reasonable, and adequate and will be preliminarily approved to begin the notice process and objection period.

1. Rule 23(e) Factors Four factors govern whether the Agreement is “fair, reasonable, and adequate”: (1) whether the class representatives and class counsel have adequately represented the class, (2) whether the proposal was negotiated at arm’s length, (3) whether the relief provided for the class is adequate, and (4) whether the proposal treats class members equitably relative to each other.

FED R. CIV. P. 23(e). i. Adequate representation The named Plaintiffs and Class Counsel have adequately represented the Class. See discussion supra Section III.A.iii; see also 4 Newberg and Rubenstein on Class Actions § 13:48 (6th ed.), Westlaw (database updated June 2022) (noting that the first Rule 23(e) factor is “redundant of the requirements of Rule 23(a)(4) and Rule 23(g), respectively”). ii. Arm’s length negotiation of settlement The parties negotiated the Agreement at arm’s length. After conducting informal discovery, the parties settled through a neutral mediator, Bennett G. Picker, and there is no evidence of fraud

1 The Federal Rules of Civil Procedure were amended in 2018 to include four factors for approving settlement agreements. See FED. R. CIV. P. 23(e). Before this amendment, the Sixth Circuit developed seven factors. See Int’l Union, United Auto., Aerospace & Agric. Implement Workers v. Gen. Motors Corp., 497 F.3d 615, 631 (6th Cir. 2007). But the advisory committee made clear that the 2018 amendment did not replace any such factors. See FED. R. CIV. P. 23 advisory committee’s note to 2018 amendment (“The goal of this amendment is not to displace any factor [a circuit provided], but rather to focus the court and the lawyers on the core concerns of procedure and substance that should guide the decision whether to approve the proposal.”). or collusion. See ECF Nos. 19 at PageID.1182; 19-6 at PageID.1241; 25 at PageID.1676. Therefore, the second factor is satisfied. See Hilson v. Kelly Servs. Inc., No. 2:15-CV-10803, 207 WL 279814, at *6 (E.D. Mich. Jan. 23, 2017) (finding that settlement agreement was negotiated at arm’s length because procedural history reflected noncollusive negotiations, informal and formal discovery, and multiple mediation sessions).

iii. Adequate relief The adequacy of relief considers: (1) the costs, risks, and delay of trial and appeal; (2) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (3) the terms of any proposed attorney’s fee, including timing of payment; and (4) any agreement required to be identified under Rule 23(e)(2).

FED R. CIV. P. 23(e)(2)(C). The relief sought is adequate. Plaintiffs acknowledge that more litigation would be complex, costly, and likely continue for several years with no guarantee of relief. ECF No. 26 at PageID.1696. The proposed method of distributing relief to the Class, including the processing of its claims, ensures that each member of the Class can obtain relief without high administrative burdens. See ECF No. 26-2 at PageID.1749–50 (outlining method for providing awards to class members). And the proposed attorney’s fees will not exceed 33% of the Settlement Fund, see id. at PageID.1745, which is adequate, see Garner Props. & Mgmt. v. City of Inkster, 2020 WL 4726938, No. 17-cv-13960, at *10 (E.D. Mich. Aug. 14, 2020) (finding that 33% attorney’s fees were reasonable). Finally, other than the Agreement, no other agreements must be identified under Rule 23(e)(2)(iv). iv. Equal treatment of class members The Agreement must treat the members of the Class as relatively equal. The Agreement does so. It permits each member of the Class to receive the “automatic benefit” of a three-year extension of identity monitoring. ECF No. 26-2 at PageID.1724. It also provides a form for each member of the Class to obtain “Claimed Benefits,” including (1) out-of-pocket expenses, (2) lost-

time claims, (3) California claims,2 (4) credit monitoring, and (5) password-management services. See id. at PageID.1724–28. Such a system ensures the “apportionment of relief among class members takes appropriate account of differences among their claims” and injuries, thus satisfying equal treatment. See FED. R. CIV. P. 23(e)(2) advisory committees’ note to 2018 amendment. And lead Plaintiffs’ incentive award is only $1,500.00, see ECF No. 26-2 at PageID.1746, so there are no concerns about the incentive award creating inequality, see Green v. FCA US LLC, No. 20- 13079, 2022 WL 3153777, at *2 (E.D. Mich. Aug. 8, 2022) (noting that lead-plaintiff incentive awards can “create[] a misalignment of the interests of the class and the representatives”). 2. Sixth Circuit Factors

The Sixth Circuit provides seven factors to determine whether a class settlement is fair, reasonable, and adequate: (1) the risk of fraud or collusion; (2) the complexity, expense, and likely duration of the litigation; (3) the amount of discovery engaged in by the parties; (4) the likelihood of success on the merits; (5) the opinions of class counsel and class representatives; (6) the reaction of absent class members; and (7) the public interest.

2 Under California law, class members who were residents of California during the Data Incident are eligible to request $75.00 “as compensation for their statutory claim(s).” ECF No. 26-2 at PageID.1726. Int’l Union, United Auto., Aerospace & Agric. Implement Workers v. Gen. Motors Corp., 497 F.3d 615, 631 (6th Cir. 2007). i. The risk of fraud or collusion “Courts presume the absence of fraud or collusion in class action settlements unless there is evidence to the contrary.” Leonhardt v. ArvinMeritor, Inc., 581 F. Supp. 2d 818, 838 (E.D. Mich.

2008) (citing IUE-CWA v. Gen. Motors Corp., 238 F.R.D. 583, 598 (E.D. Mich. 2006)). No evidence of fraud or collusion exists here. On the contrary, the parties settled with a neutral mediator, ECF No. 26 at PageID.1695, so this factor favors approval, see Bert v. AK Steel Corp., No. 1:02-CV-467, 2008 WL 4693747, at *2 (S.D. Ohio Oct. 23, 2008) (“The participation of an independent mediator in settlement negotiations virtually [e]nsures that the negotiations were conducted at arm’s length and without collusion between the parties.”). ii. The complexity, expense, and likely duration of litigation Courts must also consider the complexity, expense, and likely duration of litigation because “the costs, delays[,] and multitudes of other problems” can outweigh the value of the plaintiff’s

claims. In re Delphi Corp. Sec., Derivative & “ERISA” Litig., 248 F.R.D. 483, 497 (E.D. Mich. 2008). Plaintiffs acknowledge that continued litigation would be complex, costly, and likely continue for several years with no guarantee of relief. ECF No. 26 at PageID.1696. So this factor also favors approval. iii. The amount of discovery engaged in by the parties A settlement is “more likely to be fair and reasonable under the circumstances” if the parties have conducted discovery. Green v. Platinum Rests. Mid-Am. LLC, No. 3:14-CV-439, 2022 WL 1240432, at *5 (W.D. Ky. Apr. 27, 2022) (citing O’Bryant v. ABC Phones of N.C., Inc., No. 19-CV-02378-SHM-TMP, 2020 WL 7634780, at *14 (W.D. Tenn. Dec. 22, 2020)). Although the parties did not conduct formal discovery, they have conducted ample informal discovery for Plaintiffs to “adequately assess their case and the desirability of the proposed settlement.” Kritzer v. Safelite Sols., LLC, 2012 WL 1945144, at *7 (S.D. Ohio May 30,

2012); see also Int’l Union, United Auto., Aerospace & Agric. Implement Workers v. Gen. Motors Corp., No. 07-CV-14074-DT, 2008 WL 2968408, at *26 (E.D. Mich. July 31, 2008) (noting that informal discovery is adequate for class counsel to make an informed decision about the adequacy of a proposed settlement). They shared “cyber-forensic reports, internal investigations, correspondence with government regulatory agencies, the number and type of persons affected, security measures taken post-Data Incident, the types of PII and PHI that were potentially compromised, and the amount of insurance coverage.” ECF No. 26 at PageID.1697. This factor thus favors approval. iv. The likelihood of success on the merits

The likelihood of success on the merits “provides a gauge from which the benefits of the settlement must be measured.” Poplar Creek Dev. v. Chesapeake Appalachia, L.L.C., 636 F.3d 235, 245 (6th Cir. 2011). Plaintiffs have acknowledged the risk of continued litigation, especially the “substantial hurdles” for data-breach cases at the pleadings stage. ECF No. 26 at PageID.1698. Therefore, this factor favors approval. v. The opinions of class counsel and class representatives “The endorsement of the parties’ counsel is entitled to significant weight, and supports the fairness of the class settlement.” UAW v. Ford Motor Co., No. 07-CV-14845, 2008 WL 4104329, at *26 (E.D. Mich. Aug. 29, 2008). Class Counsel supports the settlement. See generally ECF No. 26. So this factor favors

approval too. vi. The reaction of absent class members This factor is neutral because the proposed settlement is in the prenotice stage. See Green v. Platinum Rests. Mid-Am. LLC, No. 3:14-CV-439, 2022 WL 1240432, at *5 (W.D. Ky. Apr. 27, 2022) (finding that a court cannot evaluate this factor before notice). vii. The public interest “[T]here is a strong public interest in encouraging settlement of complex litigation and class action suits because they are ‘notoriously difficult and unpredictable’ and settlement conserves judicial resources.” In re Cardizem CD Antitrust Litig., 218 F.R.D. 508, 530 (E.D. Mich.

2003) (quoting Granada Invs. v. DWG Corp., 962 F.2d 1203, 1206 (6th Cir. 1992)). Settling this 694,679-person class action would further the public interest by providing relief for the entire Class and conserving judicial resources. Therefore, this factor favors approval. 3. Because the factors score 10–0–1, the Agreement is fair, reasonable, and adequate and will therefore be preliminarily approved. D. APPROVAL OF PROPOSED NOTICE PLAN

After preliminarily approving a settlement, the court must direct notice of the proposed settlement to all class members who would be bound by the proposal. FED. R. CIV. P. 23(e)(1)(B). Because the Class is being certified under Rule 23(b)(3), notice must be “the best notice practicable” and include “individual notice to all members who can be identified through reasonable effort.” FED. R. CIV. P. 23(c)(2)(B). Notice must also include the following in “plain, easily understood language”: (1) The nature of the action; (2) The definition of the class certified; (3) The class claims, issues, or defenses; (4) That a class member may enter an appearance through an attorney if the member so desires; (5) That the court will exclude from the class any member who requests exclusion; (6) The time and manner for requesting exclusion; and (7) The binding effect of a class judgment on members under Rule 23(c)(3).

Id. The parties’ proposed notice plan is in Section 3 of the Agreement, ECF No. 26-2 at PageID.1733–40, and their proposed notice materials are attached as exhibits to it, id. at PageID.1763–77. The parties have selected Equip Class Action & Claims Solutions as the Claims Administrator responsible for distributing class notice. The proposed notice plan is most practicable way under the circumstances to provide individual notice to the Class. It directs the Claims Administrator to mail notice to the members of the Class and provides detailed procedures for handling returned notices. It also establishes a settlement website that any member of the Class can access. The text of the proposed notice satisfies the requirements of Rule 23 and due process. See generally id. The proposed notice states that this is a class-action lawsuit against Defendant arising from the August 1, 2021 Data Incident. Id. at PageID.1767. It defines the Class as any person who was “mailed a notice letter notifying you that your Private Information was potential compromised in the Data Incident that occurred on or about August 1, 2021.” Id. It also discusses the claims and issues of the Class to the extent relevant for settlement notice. See id. at PageID.1769–70. It also informs the members of the Class that they may enter an appearance with an attorney. Id. And it conspicuously alerts the members of the Class that they may opt out of or object to the Agreement. Id. at PageID.1773–74. Although the notice does not yet include the deadlines to file a claim, to request an exclusion, or to object, it does include spaces to input such information, which will be provided in this Order. See generally id. at PageID.1772–76. Finally, the proposed notice informs

the members of the Class that they are bound by the terms of the Agreement unless they opt out. Id. at PageID.1774. Accordingly, the notice plan will be approved and the parties will be directed to begin the Notice Program according to the Agreement on or before December 6, 2022. As reflected in the Agreement, any member of the Class who wishes to opt out of the Agreement after receiving notice must send a written request to the designated post-office box established by the Claims Administrator, which must be postmarked on or before February 7, 2022. Any member of the Class who does not properly and timely opt out will be bound by the terms of the Agreement upon final approval by this Court.

IV. Accordingly, it is ORDERED that Plaintiff’s Unopposed Motion for Preliminary Approval of Class Action Settlement, ECF No. 26, is GRANTED. Further, it is ORDERED that the Class is CERTIFIED for settlement purposes only. Further, it is ORDERED that the Class is DEFINED as “all natural persons residing in the United States who were sent notice letters notifying them that their Private Information was compromised in the Data Incident announced by Defendant on or about August 1, 2021.” Further, it is ORDERED that the Class EXCLUDES (1) Defendant and its respective officers and directors; (2) all settlement class members who timely and validly request exclusion from the settlement class; (3) the undersigned Judge assigned to evaluate the fairness of the settlement; and (4) any other person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity that caused the August 2021 Data Incident to occur or who pleads nolo contendere to any such charge. Further it is ORDERED that Plaintiffs Christine Thomsen, Donna Miller, Shelbi

Farrington, Dianna Kometh, Sally Labree, Harry Peterson, Patrick Burnham, David Teverbaugh, Richard Journagin, Gale Marie Jackson, Edward Cable, Carole Dangelo, Sophia Marks, Albert Shearer, and Rebecca Younk are APPOINTED AS CLASS REPRESENTATIVES for settlement purposes only. Further, it is ORDERED that Attorney Bryan L. Bleichner, of Chestnut Cambronne, PA, is APPOINTED AS CLASS COUNSEL for settlement purposes only. Further, it is ORDERED that the Proposed Settlement Agreement, ECF No. 26-2, is PRELIMINARILY APPROVED. Further, it is ORDERED that the Proposed Settlement Notice Plan, including the Short

Notice, ECF No. 26-2 at PageID.1763–65, Long Notice, ECF No. 26-2 at PageID.1767–76, and Claim Form, ECF No. 26-2 at PageID.1779–83, is APPROVED. Further, it is ORDERED that Equip Class Action & Claims Solutions, Inc. is APPOINTED AS CLAIMS ADMINISTRATOR. Further, it is ORDERED that the Claim Administrator is DIRECTED to publish notice according to the Proposed Settlement Notice Plan. Further, it is ORDERED that any member of the Class who wishes to opt out of the Agreement must send a written request to the designated post-office box established by the Claims Administrator, postmarked on or before February 7, 2023. Further, it is ORDERED that any member of the Class who does not properly and timely opt out of the Agreement is, upon entry of a final order and judgment approving the Agreement, BOUND by all it terms and provisions. Further, it is ORDERED that the following schedule is ADOPTED:

Defendant to provide contact information of Settlement November 18, 2022 Class Members to Claim Administrator on or before: Notice Program Commences on or before: December 6, 2022 Notice Program Concludes on or before: January 3, 2023 Compliance with CAFA Waiting Period under 28 90 days after appropriate government U.S.C. § 1715(d): officials are served with CAFA notice Postmark deadline for request for exclusion (opt-out) February 7, 2023 or objections: Deadline to file Plaintiffs’ Motion for Final Approval of the Settlement Agreement and Motion for March 1, 2023 Attorneys’ Fees, Expenses, and Service Awards: Postmark / Filing deadline for members of the Class to March 20, 2023 file claims Deadline for Plaintiffs to file any Response to Objections or Supplement to Motion for Final April 5, 2023 Approval Deadline for Claims Administrator to file or cause to be filed, if necessary, a supplemental declaration with April 14, 2023 the court Final Approval Hearing April 19, 2023 at 2:00 PM EDT

Dated: November 4, 2022 s/Thomas L. Ludington THOMAS L. LUDINGTON United States District Judge