Toretto v. Donnelley Financial Solutions, Inc.

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

PHILLIP TORRETTO, DANIEL C. KING, and SHERI BRAUN, individually and on behalf of all others similarly situated,

Plaintiffs, Case No. 1:20-cv-02667-GHW v.

DONNELLEY FINANCIAL SOLUTIONS, INC. and MEDIANT COMMUNICATIONS, INC., individually and as general partners,

Defendants.

ORDER CERTIFYING CLASS, APPROVING CLASS ACTION SETTLEMENT, AND AWARDING ATTORNEYS’ FEES AND SERVICE AWARDS

This matter is before the Court on Plaintiffs’ Unopposed Motion for Final Approval of the Parties’ Proposed Class Action Settlement Pursuant to Rule 23(e) and Class Counsel’s Unopposed Motion for an Award of Attorneys’ Fees and Expenses and for Plaintiff Service Awards. Plaintiffs, individually and on behalf of the proposed Settlement Class, and Mediant Communications Inc. (“Mediant”) have entered into a Settlement Agreement as of June 15, 2022, concerning the above- captioned litigation (the “Settlement”), which, together with its exhibits, is incorporated herein by reference. In their motions, Plaintiffs ask that the Court (1) approve the Settlement as fair, reasonable, and adequate; (2) certify the Settlement Class for purposes of entering judgment on the Settlement under Federal Rule of Civil Procedure 23(e); and (3) approve their requests for $700,00 in attorneys’ fees and expenses and a $2,500 service award to each of the three Class Representatives. Having considered the motions, the supporting memoranda of law, the Settlement together with all exhibits and attachments thereto, the record, and having conducted a Final Fairness Hearing on January 5, 2023, IT IS HEREBY ORDERED as follows: 1. Unless otherwise defined, all terms capitalized herein shall have the same meaning ascribed to those terms in the Settlement. 2. The Court has jurisdiction over this litigation, Plaintiffs Phillip Torretto, Daniel C.

King, and Sheri Braun (“Plaintiffs”), Mediant, the Settlement Class Members, and the Released Parties. 3. The Court finally and unconditionally grants approval of the Parties’ Settlement Agreement, including but not limited to, the Settlement Benefits, the Releases therein, and the procedures for distribution of Settlement Benefits to Settlement Class Members. 4. All Settlement Class Members who have not timely excluded themselves from the Settlement Class are bound by this Final Approval Order and Judgment, and this Final Approval Order shall have maximum res judicata, collateral estoppel, and all other preclusive effect on all causes of action, claims for relief, demands, petitions, or any other challenges or allegations that arise out of or relate to the subject matter of the Litigation and shall permanently bar Plaintiffs and

each Settlement Class Member who did not timely opt-out from bringing or participating in any action against Mediant or the Released Parties asserting any of the Released Claims, as provided in the Settlement Agreement. APPROVAL OF SETTLEMENT AS FAIR, REASONABLE AND ADEQUATE

5. On June 17, 2022, Class Counsel filed an Unopposed Motion for Preliminary Approval of Proposed Class Action Settlement Pursuant to Rule 23(e). Dkt. 145. This Court granted the motion on June 24, 2022, concluding that it would likely approve the Settlement as fair, reasonable, and adequate and certify the Settlement Class for purposes of judgment on the proposal, and thus directing that notice be issued to the Class. Dkt. 153 (the “Order”), ¶¶ 6-15. In addition, for purposes of issuing notice of the Settlement, the Court appointed J. Austin Moore of Stueve Siegel Hanson, LLP, Elaine A. Ryan of Auer Ryan P.C., and John A. Yanchunis of Morgan & Morgan as interim class counsel pursuant to Rule 23(g)(3). Id. ¶ 16. The Court appointed Epiq Class Action and Claims Solutions, Inc. (“Epiq”) to serve as the Settlement Administrator and to

execute the Notice plan set forth in the Settlement Agreement. Id. ¶¶ 17-20. The Court finally approves Epiq as the Settlement Administrator. 6. Plaintiffs summarize the relevant terms of the proposed Settlement as follows: a. Settlement Class Members can obtain twenty-four (24) months of three- bureau credit monitoring services without the need to submit a claim; b. Settlement Class Members can obtain reimbursement of Out-of-Pocket Losses up to $10,000.00 per claimant; c. Settlement Class Members can obtain reimbursement for Lost Time they spent addressing the Data Security Incident up to $160 per claimant; and d. Settlement Class Members will obtain structural relief in the form of

contractual commitments by Mediant to enhance its network and data security measures, as previously submitted to the Court under seal. 7. The Settlement provides a straight-forward method for Settlement Class Members to claim benefits and sets forth a process for notifying the Settlement Class, obtaining final approval of the Settlement, and administering the Settlement. 8. Pursuant to the Court’s June 24, 2022 Order directing that notice of the Settlement Agreement be issued to the Settlement Class, and in accordance with the terms of the Settlement Agreement, the Settlement Administrator issued notice of the Settlement Agreement and its benefits, including notice of the Final Approval Hearing, to the Settlement Class Members. The Court finds that the notice provided to the Class Members was the best notice practicable under the circumstances, and that it complies with the requirements of Rule 23(c)(2). The Settlement is Fair, Reasonable and Adequate 9. Pursuant to Federal Rule of Civil Procedure 23(e)(2), the Court first considers the

fairness, reasonableness, and adequacy of the Settlement. First, there have been no objections to the Settlement, and only one individual has opted out. The favorable response of the Settlement Class Members to the Settlement is an indication of its fairness. 10. The Court also finds that the Class Representatives and Class Counsel have adequately represented the class. Class Counsel are highly experienced in complex class actions and data breach litigation, and the Class Representatives’ interests align with those of the Settlement Class Members, as they all allege to have suffered the same injury: unauthorized access of their personal information in the Data Security Incident. Accordingly, the Court finally appoints J. Austin Moore of Stueve Siegel Hanson, LLP, Elaine A. Ryan of Auer Ryan P.C., and John A. Yanchunis of Morgan & Morgan as Class Counsel. The Court further finally appoints Phillip

Torretto, Daniel C. King, and Sheri Braun as Class Representatives. 11. Next, the Court finds that the Settlement is the result of adversarial, arm’s-length, informed, and non-collusive negotiations between Mediant and Plaintiffs and their counsel. The Parties pursued adversarial litigation for several years prior to reaching the Settlement, and the involvement of a mediator in the Parties’ negotiations, during two separate full-day mediation sessions, further supports the finding that the Settlement was negotiated at arm’s-length. 12. Further, the relief provided to the Settlement Class Members under the Settlement is adequate, taking into account the substantial risks of continued litigation, especially in data incident cases such as this one. The Settlement offers Class Members benefits including reimbursement for Out-of-Pocket Losses and Lost Time spent addressing the Data Security Incident. These cash reimbursement benefits are uncapped, meaning Settlement Class Members’ recoveries will not be reduced depending on the number of claimants. In addition, the Settlement offers protection against prospective harm from the Data Security Incident, by providing up to

two-years of free Credit Monitoring Services and through Mediant’s commitment to improving its network and data security measures. That there have been no objections to the Settlement, only one opt-out, and many claims for benefits confirms the adequacy of the relief it provides the Settlement Class Members. 13. In addition, the proposed method for distributing relief to the Settlement Class Members is adequate and effective. Pursuant to the notice plan set forth in the Settlement, the Settlement Class was notified of the Settlement directly via U.S. Mail, and Claimants were able to submit claims for Out-of-Pocket Losses and Documented or Attested Time either via a Settlement Website or by mail. In addition, Settlement Class Members who provided an email address and unique claimant identifier to the Settlement Administrator will have access to Credit Monitoring

Services whether or not they submit a Claim. Mediant’s information security improvements will benefit Settlement Class Members without requiring any action by Settlement Class Members. 14. The Settlement’s provisions for awards of attorneys’ fees and costs and service payments to the Class Representatives, which will be paid separately by Mediant, were negotiated at arms-length between the Parties, and will not diminish the recovery available to Settlement Class Members, are reasonable. In accordance with the terms of the Settlement, Class Counsel timely filed a motion seeking $700,000 in attorneys’ fees and expenses, and $2,500 service awards for each of the Class Representatives. The Court considers that motion separately below. 15. Further, the proposed Settlement treats all Settlement Class Members equitably relative to each other. 16. As to the additional factors courts in this Circuit consider in assessing a proposed class settlement, see City of Detroit v. Grinnell Corp., 495 F.2d 488, 463 (2d Cir. 1974), the ability

of Mediant to withstand a greater judgment weighs in favor of approval, and the Settlement Class Members’ recovery is within a reasonable range in light of the best possible recovery and all the attendant risks of litigation. Settlement Class Members are entitled to recover their actual losses and time spent addressing the Data Security Incident, which will not be reduced depending on the number of claimants, and to obtain comprehensive Credit Monitoring Services to avoid or minimize future harms. The Settlement also requires Mediant to separately pay the costs of notice and claims administration, attorneys’ fees and expenses to Class Counsel and service awards to Class Representatives, and the costs of implementing enhanced information security measures. Weighed against the risks of continued litigation, the relief afforded by the Settlement is within a reasonable range. Therefore, the Grinnell factors weigh in favor of approval of the Settlement.

17. Thus, the Court approves the Settlement as fair, reasonable, and adequate. 18. Next, the Court certifies the Settlement Class for purposes of judgment on the Settlement under Rule 23(e), as: a. the Settlement Class contains approximately 224,650 individuals and joinder of all such persons would be impracticable and therefore the Settlement Class is sufficiently numerous; b. there are questions of law and fact that are common to the Settlement Class, including whether Mediant had a duty to secure its clients’ investors’ personal data and whether it took reasonable steps to do so, and those common questions of law and fact predominate over any questions affecting any individual in the Settlement Class; c. the claims of the Plaintiffs are typical of the claims of the Settlement Class they seek to represent for purposes of the Settlement, as they suffered and seek to

remedy the same injury; d. a class action is superior to other available means of adjudicating the dispute, as it is the most efficient and effective means of resolving the claims of the geographically dispersed Settlement Class Members; and e. Plaintiffs and Class Counsel are adequate representatives of the Settlement Class, as Class Counsel are experienced and qualified, and Plaintiffs have no conflicts of interest with the Settlement Class. 19. The Court thus certifies the following class for settlement purposes only: The approximately 224,650 individuals who were mailed a notification that their personal information may have been impacted in the Data Security Incident experienced by Mediant on or around April 1, 2019.

20. One member of the Settlement Class has timely opted out of the Settlement. Other than the individual who has opted out of the Settlement, identified in Attachment 5 to the Declaration of Cameron R. Azari on Implementation and Adequacy of Notice Plan and Notices, all other members of the Settlement Class are bound by the terms of the Settlement, including the Releases as outlined in the Settlement, upon entry of the Final Judgment in this action. Releases 21. Each Settlement Class Member, including Plaintiffs are hereby deemed to have completely and unconditionally released, forever discharged, and acquitted Mediant and the Released Parties from all Released Claims as defined by and laid out more fully within the Settlement Agreement. The Settlement Class Members and Plaintiffs are barred and permanently enjoined from asserting, instituting, or prosecuting, either directly or indirectly, any Released Claim, as provided in the Settlement Agreement. Approval of Attorneys’ Fees and Service Awards

22. On September 12, 2022, Class Counsel submitted their Unopposed Motion for an Award of Attorneys’ Fees and Expenses and for Plaintiff Service Awards. Dkts. 156-58. Notice of this Motion was properly given to the Settlement Class Members, as it was posted on the Settlement Website. Notice of the agreed-upon Attorneys’ Fees and Expenses and Plaintiff Service Awards was also included in the Long Form Notice and in the Frequently Asked Questions section of the Settlement Website. No Settlement Class Member has objected to Class Counsel’s Motion. 23. Upon consideration of Class Counsel’s Unopposed Motion for Attorneys’ Fees and Service Awards, this Court approves Class Counsel’s request for $700,000 in combined attorneys’ fees and expenses, as agreed between the Parties in their Settlement. 24. The fees and expenses were negotiated at arm’s-length by counsel for Plaintiffs and

Mediant and will be paid by Mediant separate from any relief to the Settlement Class Members. 25. Next, an analysis of Class Counsel’s lodestar demonstrates the reasonableness of the requested sum in this action. This analysis demonstrates that the agreed-upon fees and expenses in this action are significantly less than Class Counsel’s lodestar for their work, even before accounting for the additional hours they have expended since the time of their Motion, and their expenses, which they advanced on an entirely contingent basis. 26. Further, the Court has considered the factors set forth by the Second Circuit in Goldberger v. Integrated Resources, Inc., 209 F.3d 43, 50 (2d Cir. 2000), and finds that: (a) Class Counsel reasonably expended more than 1,500 hours on the litigation and resolution of this case, given the complexity and evolving nature of the issues and the substantive motions at each stage of the case.

(b) The magnitude and complexities of the litigation justify the requested attorneys’ fees and expenses, as the jurisprudence of data incident claims is still relatively novel and defendant vigorously contested Plaintiffs’ claims at every step of the litigation.

(c) Class Counsel faced several risks in prosecuting this action, including the risk of litigating in an area that continues to evolve, and the inherent risk involved in prosecuting a class action litigation on an entirely contingent basis.

(d) The fees and expenses requested by Class Counsel are also reasonable in light of the quality of their representation of the class, as indicated by their significant class action, litigation, and trial experience, including experience and expertise in data breach and data privacy litigation, as well as by the favorable results achieved for the Settlement Class.

(e) The requested fees and expenses are reasonable in light of the result achieved for the Settlement Class Members, which offers to make Class Members whole for any Lost Time or Out-of-Pocket Losses they suffered as a result of the Data Security Incident, as well as providing prospective protection from further harm through free access to credit-monitoring and reforms to Mediant’s data security practices.

(f) Public policy also favors an award of the agreed-upon fees, as it will incentivize dedicated and experienced counsel to bring these types of cases, which inure to the public benefit by encouraging companies to protect the sensitive personal information in their possession.

27. For their service on behalf of the Settlement Class Members in this action, the Court also approves the Plaintiffs’ request for $2,500 each, to be paid by Mediant separate and apart from any relief made available to the Settlement Class. OTHER PROVISIONS 28. Nothing contained in this Order, the Settlement Agreement, or documents thereto is, or may be construed as, any admission or concession by or against Mediant or the Released Parties on any point of fact or law. 29. Neither the terms of the Settlement nor any publicly disseminated information regarding the Settlement, including but not limited to, the Settlement Notice, court filings, orders, and public statements, may be used as evidence in any other action or proceeding.

IT IS SO ORDERED.

Entered this 5 day of January, 2023.

Hon. att H. Woods United States District Judge