WILSTERMAN v. DELPHINUS ENGINEERING, INC.

• Court: District Court, E.D. Pennsylvania
• Decided: June 10, 2025
• Docket: 2:24-cv-01810
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA JASON WILSTERMAN, individually and : on behalf of all others similarly situated, : Plaintiff, : : Civ. No. 24-1810 v. : : DELPHINUS ENGINEERING, INC., : Defendant. : Diamond, J. June 10, 2025 MEMORANDUM OPINION In this putative class action, Plaintiff Jason Wilsterman brings state law claims against his former employer, Delphinus Engineering, Inc., for failing to prevent a widespread employee data breach. (Doc. No. 1); 28 U.S.C. § 1332(d)(2). For settlement purposes, Wilsterman moves unopposed for class certification, preliminary approval of the class action settlement, and related settlement terms. (Doc. No. 23.) Because there are glaring deficiencies in Wilsterman’s submissions, I will deny his Motion without prejudice. I. BACKGROUND AND FACTUAL ALLEGATIONS A cyber-security company, Delphinus has its principal place of business in this District. (Doc. No. 1 ¶¶ 2, 9, 12; Doc. No. 23-1 at 3.) It failed adequately to protect sensitive employee identification data, resulting in a data breach on October 16, 2023. (Doc. No. 23-1 at 4.) As alleged, the consequences were catastrophic: “CL0P (a.k.a. “TA505”) . . . an especially notorious cybercriminal group” was responsible for the breach. (Doc. No. 1 ¶¶ 33-36.) As a result, employees’ Personal Identifiable Information—names, Social Security numbers, dates of birth, and passport numbers—“[was] compromised” causing “widespread injury and monetary damages,” as CL0P would likely sell the PII “on the black market” and the “Dark Web.” (Id. ¶¶ 21, 26, 37, 60.) Remarkably, it took Delphinus some six months to “beg[i]n notifying its affected current and former employees [including Wilsterman] about the data breach”—a delay that “exacerbated Plaintiff and Class members’ injury.” (Id. ¶ 23, 66; Doc. No. 23-1 at 4.) Indeed, Wilsterman has

suffered “injuries [that] go far beyond . . . mere worry or inconvenience.” (Doc. No. 1 ¶ 52.) “Because of the Data Breach, Plaintiff anticipates spending considerable amounts of time and money to try and mitigate his injuries.” (Id. ¶ 56.) Wilsterman initiated the instant action on April 30, 2024, alleging: (1) negligence, (2) negligence per se, (3) breach of implied contract, (4) unjust enrichment, (5) breach of fiduciary duty, (6) breach of confidence, and (7) declaratory judgment. (Doc. No. 1.) Settlement negotiations began some two months later (in June 2024). (Miller Decl. ¶ 5.) The Parties reached an agreement on the material terms in September 2024. (Id. ¶ 12.) They apparently continued to “refine” the Agreement through January 2025, when they filed the instant Motion (after I ordered

them to provide a status update). (Doc. Nos. 22, 23.) The proposed Settlement Agreement provides a non-reversionary Settlement Fund of $350,000.00 for some 3151 Class Members. (Sett. Agreement ¶¶ 1, 46, 49.) The Proposed Class is defined as follows: All individuals residing in the United States who have been identified by Defendant as potentially having their personally identifiable information (PII) compromised in the Data Breach experienced by Delphinus in October 2023, including all individuals who previously received notice that their PII may have been compromised in connection with the Data Breach.

Id. ¶ 46. A Class Member potentially may claim: (1) up to $10,000 for documented, unreimbursed, out-of-pocket losses because of fraud or identity theft related to the breach; (2) a pro rata cash fund payment from the Settlement Fund, even if not claiming out-of-pocket losses; and (3) three years of credit monitoring, even if not claiming out-of-pocket losses or a pro rata cash fund payment. (Id. ¶ 59.) At final approval, Settlement Class Counsel will seek a Service Award of

$5000 to Plaintiff, a Fee Award not to exceed $116,666.66, and up to $10,000 in costs. (Id. ¶¶ 87- 89; Doc. No. 23-1 at 9.) If approved, this would leave the Class with an average recovery of $70 per Member. II. LEGAL STANDARDS “Under [Rule] 23(e), the settlement of a class action requires court approval, which may issue only ‘on finding that [the settlement] is fair, reasonable, and adequate.’” In re NFL Players’ Concussion Injury Litig., 961 F. Supp. 2d 708, 713 (E.D. Pa. 2014) (second alteration in original) (quoting Fed. R. Civ. P. 23(e)(2)). “Review of proposed Rule 23 class settlement typically proceeds in two steps: (1) a preliminary fairness evaluation and (2) a formal fairness hearing

following a notice period.” Lundeen v. 10 W. Ferry St. Operations LLC, No. 24-cv-00109, 2024 U.S. Dist. LEXIS 184263, at *4 (E.D. Pa. Oct. 9, 2024). In the preliminary evaluation, the “‘fair, reasonable and adequate’ standard is lowered.” In re NFL Players, 961 F. Supp. 2d at 714. The court need only determine whether “the proposed settlement discloses grounds to doubt its fairness or other obvious deficiencies such as unduly preferential treatment of class representatives or segments of the class, or excessive compensation of attorneys, and whether it appears to fall within the range of possible approval.” Id. Nonetheless, “preliminary approval is not simply a judicial ‘rubber stamp’ of the parties’ agreement.” Id. Under Rule 23(e), “the district court acts as a fiduciary who must serve as a guardian of the rights of absent class members.” In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 534 (3d Cir. 2004) (quoting In re GMC Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 785 (3d Cir. 1995)). “[I]n cases . . . where settlement negotiations precede class certification, and approval for settlement and certification are sought simultaneously, [the Third Circuit] require[s] district courts to be even ‘more scrupulous than usual’ when examining the

fairness of the proposed settlement.” Id. (emphasis added); see also Zimmerman v. Zwicker & Assocs., P.C., No. 09-3905, 2011 U.S. Dist. LEXIS 2161, at *10 n.5 (D.N.J. Jan. 10, 2011) (“If a proposed settlement appears obviously deficient, the ruling should be issued before rather than after the parties incur the administrative expense to publish notice to the class and handle any objections.”). For preliminary approval of the settlement, courts in this Circuit consider whether:

(1) the negotiations occurred at arm’s length; (2) there was sufficient discovery; [and] (3) the proponents of the settlement are experienced in similar litigation.

In re GMC, 55 F.3d at 785. III. DISCUSSION Applying the GMC factors, I find there are obvious deficiencies in the proposed Settlement that preclude preliminary approval. See id. First, it is by no means clear that the Settlement Agreement was negotiated at arm’s length. “Whether a settlement arises from arm’s length negotiations is a key factor in deciding whether to grant preliminary approval.” In re Comcast Corp., No. 09-md-2034, 2018 U.S. Dist. LEXIS 150712, at *12 (E.D. Pa. Sep. 5, 2018). Courts have repeatedly found that the “participation of an independent mediator in settlement negotiations virtually [e]nsures that the negotiations were conducted at arm’s length and without collusion between the parties.” Rose v. Travelers Home & Marine Ins. Co., No. 19-977, 2020 U.S. Dist. LEXIS 126761, at *17 (E.D. Pa. July 20, 2020) (alteration in original) (quoting Bellum v. Law Offices of Frederic I. Weinberg & Assocs., P.C., No. 15-2460, 2016 U.S. Dist. LEXIS 124202, at *15 (E.D. Pa. Sep. 12, 2016)); see also In re Comcast Corp., 2018 U.S. Dist. LEXIS 150712, at *12 (parties “participated in five formal mediation sessions”); Ehrheart v. Verizon Wireless, 609 F.3d 590, 592, 594 (3d Cir. 2010) (parties

engaged in mediation); Currie v. Joy Cone Co., No. 2:23-CV-00764-CCW, 2024 U.S. Dist. LEXIS 111294, at *2 (W.D. Pa. June 25, 2024) (same). Wilsterman himself notes that when considering this factor, courts look for use of a neutral mediator. (Doc. No. 23-1 at 17 (first citing In re NFL Players Concussion Injury Litig., 301 F.R.D. 191, 198 (E.D. Pa. 2014); and then citing Gates v. Rohm & Haas Co., 248 F.R.D. 434, 444 (E.D. Pa. 2008)). Yet, there is no indication here that the Parties were assisted by a mediator. (See Doc. No. 23-1; Miller Decl.) This weighs against a finding that negotiations were conducted at arm’s length. Moreover, negotiations began and concluded quickly. Wilsterman filed suit on April 30, 2024. (Doc. No. 1.) Proposed Class Counsel Cassandra Miller avers that by June 2024, the Parties

were engaged in settlement negotiations resulting in a term sheet on September 20, 2024. (Miller Decl. ¶¶ 5, 12.) Although the Parties “continued negotiating” through January 2025—when I ordered a status update—Miller avers this included addressing “finer points of the Settlement Agreement” only. (Id. ¶ 14; Doc. No. 24.) Although public policy favors voluntary resolution of class actions, such hurried negotiations suggest they were not conducted at arm’s length, especially given the complex nature of data breach cases. See In re Wawa, Inc. Data Sec. Litig., No. 19- 6019, 2023 U.S. Dist. LEXIS 184635, at *33 (E.D. Pa. Oct. 12, 2023) (“[D]ata breach class actions involve ‘a risky field of litigation because data breach class actions are uncertain and class certification is rare.’”). It also appears that there was insufficient discovery to ensure that the Parties “were aware of the strengths and weaknesses of their case[s].” In re NFL Players’ Concussion Injury Litig., 821 F.3d 410, 436 (3d Cir. 2016). In Miller’s flimsy affidavit—which seems to have been, in part, cut and pasted from something she prepared in another case (see Miller Decl. ¶ 22 (“Notice will be provided . . . via contact information [Class Members] provided to Defendant when they

obtained medical services from Defendant.” (emphasis added)))—Miller avers that in July 2024, “Plaintiff requested, and Defendant produced, key information about the size and composition of the Settlement Class, how the Data Breach occurred, Defendant’s response to the Data Breach, and security changes Defendant undertook as a result of the Data Breach.” (Id. ¶ 7.) Informal discovery thus took three months at most. (See id.) Yet, Miller provides almost no detail about the information exchanged. (See id.) It is thus difficult to see how “meaningful discovery” could have occurred. See In re Linerboard Antitrust Litig., 292 F. Supp. 2d 631, 640 (E.D. Pa. 2003) (“A presumption of correctness is said to attach to a class settlement reached in arms-length negotiations between experienced, capable counsel after meaningful discovery.”). Miller also

avers that “[p]rior to filing suit, proposed Settlement Class Counsel conducted extensive investigations into the Data Security Incident.” (Miller Decl. ¶ 3.) Yet, Delphinus notified affected individuals, including Wilsterman, of the breach in a letter dated April 10, 2024, and Wilsterman filed suit within the month, on April 30, 2024. (Doc. Nos. 1, 1-1; Doc. 23-1 at 4.) It thus seems highly doubtful that “extensive investigations” could have taken place. Finally, as I have noted, after counsel fees, costs, and the service award are paid, the average recovery for each Class Member will be less than modest, the grievous injuries allegedly suffered notwithstanding. Yet, the proposed Class Counsel Fee Award would constitute some 33% of the Settlement Fund—at the top end awarded in similar data breach cases. See Currie, 2024 U.S. Dist. LEXIS 111294, at *10 (“If Mr. Currie seeks the entire $100,000 in attorneys’ fees, it would represent 33% of the settlement, which has been held to be ‘on the higher end in databreach [sic] cases.’”); Holden v. Guardian Analytics, Inc., No. 23-cv-2115, 2024 U.S. Dist. LEXIS 100349, at *34-35 (D.N.J. June 5, 2024) (“However, in class action settlements of data breach cases, attorney fees awards have generally been between 20% to 30% of the settlement.”).

It thus appears that benefit to the Class was of tertiary concern (coming after benefits to Class Counsel and Defendant) during the “arm’s length” negotiations. In these circumstances, I am unable to conclude, even under a “lowered” standard, that the proposed settlement is fair, reasonable, and adequate. In re NFL Players, 961 F. Supp. 2d at 714; Fed. R. Civ. P. 23(e)(2). Quite to the contrary, there are “grounds to doubt its fairness.” In re NFL Players, 961 F. Supp. 2d at 714. In light of my decision respecting the Settlement, I will not address whether the proposed Class should be provisionally certified. IV. CONCLUSION

Without greater detail respecting precisely what “discovery” and “exhaustive investigations” took place, and actual evidence showing that “arm’s length” negotiations took place, the GMC factors preclude preliminary approval of the Settlement Agreement. In re GMC, 55 F.3d at 785. Accordingly, I will deny Plaintiff’s Motion without prejudice. Should Wilsterman again seek preliminary approval, he should cure the obvious deficiencies in his initial Motion. This includes providing the Court with supporting information regarding the matters mentioned in the Motion and the Miller affidavit, including: (1) The materials the Parties exchanged such as the “key information about the size and composition of the Settlement class, how the Data Breach occurred, Defendant’s response to the Data Breach,” and the dates of exchange. (Miller Decl. ¶ 7.) (2) Details respecting the “extensive investigations into the Data Security Incident,” including dates, undertaken by proposed Class Counsel prior to filing suit, such as those

into the Defendant’s “business and its relationship with current and former [employees],” “Defendant’s response to the Data Security Incident and whether it was sufficiently thorough,” and whether Defendant’s notices “submitted to the various governmental entities . . . complied with state mandated notice requirements.” (Id. ¶ 3.) (3) Details respecting Plaintiff’s assistance in the case investigation, such as interviews with, and “relevant documents” provided to, proposed Class Counsel. (Id. ¶ 11; Doc. No. 23-1 at 18.) (4) Evidence confirming that negotiations were at “arm’s length.” (See Miller Decl. ¶¶ 7-

8, 12.) An appropriate Order follows.

AND IT IS SO ORDERED. /s/ Paul S. Diamond ________________________ Paul S. Diamond, J.