In re Yahoo! Inc. Customer Data Sec. Breach Litig.

Full title: IN RE: YAHOO! INC. CUSTOMER DATA SECURITY BREACH LITIGATION

Court: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

Date published: Jul 21, 2020

Case No. 16-MD-02752-LHK (N.D. Cal. Jul. 21, 2020)

Opinion

Case No. 16-MD-02752-LHK

07-21-2020

IN RE: YAHOO! INC. CUSTOMER DATA SECURITY BREACH LITIGATION

LUCY H. KOH United States District Judge

AMENDED ORDER GRANTING PLAINTIFFS' MOTION FOR FINAL APPROVAL OF CLASS ACTION SETTLEMENT; GRANTING IN PART PLAINTIFFS' ATTORNEYS' FEES, COSTS, AND EXPENSES AND SERVICE AWARDS ¹ Re: Dkt. Nos. 413, 415

1 This Order supersedes ECF No. 424.

This matter is before the Court on Plaintiffs' motion for final approval of the proposed class action settlement ("Settlement") between individual and representative Plaintiffs² and the Settlement Class they represent (collectively, "Plaintiffs"), and Defendants Yahoo! Inc. ("Yahoo") and Aabaco Small Business, LLC ("Aabaco") (together with Yahoo, "Defendants"). ECF No. 414 ("Mot. for Final Approval"). Class Counsel has also filed a motion for approval of attorneys' fees, costs, and expenses and incentive awards. ECF No. 416 ("Mot. for Atty's Fees"). Defendants do not oppose either motion. The Court held a Final Fairness Hearing on June 18, 2020.

2 All named Plaintiffs are identified in paragraphs 12 through 113 of the Second Amended Consolidated Class Action Complaint ("SACC"). See ECF No. 367-4 ("SACC") ¶¶ 18-28.

Having considered these motions, the parties' Settlement Agreement, the record in the instant case, and the arguments and evidence presented at the Final Fairness Hearing, IT IS HEREBY ORDERED as follows:

Unless otherwise defined herein, all terms that are capitalized herein shall have the meanings ascribed to those terms in the Settlement Agreement. The Court has jurisdiction over the subject matter of the Settlement Agreement with respect to and over all parties to the Settlement Agreement, including all Settlement Class Members and Defendants.

I. THE SETTLEMENT CLASS SATISFIES THE APPLICABLE REQUIREMENTS OF RULE 23

On July 20, 2019, this Court preliminarily certified, for settlement purposes only, the following class:

All U.S. and Israel residents and small businesses with Yahoo accounts at any time during the period of January 1, 2012 through December 31, 2016, inclusive; provided, however, that the following are excluded from the Settlement Class: (i) Defendants, (ii) any entity in which Defendants have a controlling interest, (iii) Defendants' officers, directors, legal representatives, successors, subsidiaries, and assigns; (iv) any judge, justice, or judicial officer presiding over this matter and the members of their immediate families and judicial staff; and (v) any individual who timely and validly opts-out from the Settlement Class.

ECF No. 390 at 2. Here, the Court provides further elaboration on the reasons for certification and finally certifies the above-defined class.

Class actions are governed by Rule 23 of the Federal Rules of Civil Procedure. The threshold task in determining whether to certify a class for settlement purposes is to examine whether the four requirements of Rule 23(a) are met. Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 614 (1997); Hanlon v. Chrysler Corp., 150 F.3d 1011, 1019 (9th Cir. 1998). Additionally, parties seeking certification must show that the action satisfies at least one subsection of Rule 23(b). Amchem, 521 U.S. at 614; Hanlon, 150 F.3d at 1022. Many of the qualifying criteria contained in Rule 23(a) and (b) exist to protect the interests of absentee class members and therefore deserve "undiluted, even heightened, attention" in the context of a settlement-only class certification. Amchem, 521 U.S. at 620; see also Ortiz v. Fibreboard Corp., 527 U.S. 815, 848-49 (1999) (explaining that when a district court "certifies for class action settlement only, the moment of certification requires 'heightene[d] attention' to the justifications for binding the class members" (quoting Amchem, 521 U.S. at 620)).

Rule 23(a) provides that a district court may certify a class only if: "(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class." Fed. R. Civ. P. 23(a). That is, the class must satisfy the requirements of numerosity, commonality, typicality, and adequacy of representation to maintain a class action. Mazza v. Am. Honda Motor Co., 666 F.3d 581, 588 (9th Cir. 2012).

If all four prerequisites of Rule 23(a) are satisfied, the action must also be maintainable under one of the three subsections of Rule 23(b). Hanlon, 150 F.3d at 1022. In the instant case, the parties propose certification pursuant to Rule 23(b)(3). Mot. at 17. To qualify for certification under that subsection, common questions of law or fact must "predominate over any questions affecting only individual members" and class resolution must be "superior to other available methods for fairly and efficiently adjudicating the controversy." Fed. R. Civ. P. 23(b)(3).

The Court first addresses whether the Settlement Class meets the requirements of Rule 23(a), then addresses whether the action meets the requirements of Rule 23(b)(3).

Rule 23(a) Requirements

Rule 23(a) conditions class certification on fulfillment of four requirements: (1) numerosity, (2) commonality, (3) typicality, and (4) adequacy of representation. Mazza, 666 F.3d at 588. The Court takes each requirement in turn.

1. Numerosity

Pursuant to Rule 23(a)(1), the class must be "so numerous that joinder of all members is impracticable." In the instant case, that requirement is easily met by the absolute number of Settlement Class Members. Although there is no talismanic numerical cutoff for impracticability of joinder, a class size of forty or more members usually is enough. Corley v. Google, Inc., 316 F.R.D. 277, 290 (N.D. Cal. 2016); see also 1 Newberg on Class Actions § 3:12 (5th ed. 2017). Here, the unfeasibility of bringing all of the class members before one court is readily apparent because the Settlement Class encompasses approximately 194 million Settlement Class Members. Mot. for Final Approval at 16. Beyond sheer size, joinder is also impracticable because the Settlement Class Members are widely dispersed geographically and unlikely to institute their own actions given the relatively small size of each individual claim. 1 Newberg, supra, § 3:12. Hence, the numerosity requirement is satisfied.

2. Commonality

Rule 23(a)(2) states that "[o]ne or more members of a class may sue or be sued as representative parties on behalf of all members only if there are questions of law or fact common to the class." Fed. R. Civ. P. 23(a)(2). This requirement has "been construed permissively, and all questions of fact and law need not be common to satisfy the rule." Ellis v. Costco Wholesale Corp., 657 F.3d 970, 981 (9th Cir. 2011) (citation, internal quotation marks, and alteration omitted). Indeed, "for purposes of Rule 23(a)(2)[,] even a single common question will do." Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 359 (2011) (citation, internal quotation marks, and alteration omitted); Mazza, 666 F.3d at 589 ("[C]ommonality only requires a single significant question of law or fact."). Thus, "[w]here the circumstances of each particular class member vary but retain a common core of factual or legal issues with the rest of the class, commonality exists." Parsons v. Ryan, 754 F.3d 657, 675 (9th Cir. 2014) (quoting Evon v. Law Offices of Sidney Mickell, 688 F.3d 1015, 1029 (9th Cir. 2012)).

Here, the parties have identified legal and factual issues common to the underlying claims that are susceptible to class-wide determination. These cases were originally selected for consolidated treatment by the U.S. Judicial Panel on Multidistrict Litigation ("JPML") on the basis that the "[c]ommon factual questions are presented with respect to Yahoo's practices in safeguarding its users' personal information, the investigation into the [2014 data] breach, the alleged delay in disclosing the [2014 data] breach, and the nature of the alleged damages." In re Yahoo! Inc., Customer Data Sec. Breach Litig., 223 F. Supp. 3d 1353, 1354 (U.S. Jud. Pan. Mult. Lit. 2016). In the case's current posture, whether Yahoo employed sufficient security measures to protect the Settlement Class Members' Personal Information from the Data Breaches lies at the heart of every claim. Related factual questions about whether Yahoo knew that its data security was inadequate and whether Yahoo timely disclosed and adequately responded to the Data Breaches also apply uniformly across the entire Settlement Class. Thus, these common factual contentions "that [are] central to the validity of each one of the claims" can be determined for all Settlement Class Members "in one stroke." Dukes, 564 U.S. at 350. Under these circumstances, commonality is satisfied.

3. Typicality

Under Rule 23(a)(3), a representative party must assert claims or defenses that are "typical of the claims or defenses of the class." Fed. R. Civ. P. 23(a)(3). Typicality is satisfied "when each class member's claim arises from the same course of events, and each class member makes similar legal arguments to prove the defendant's liability." Rodriguez v. Hayes, 591 F.3d 1105, 1124 (9th Cir. 2010) (citation omitted). This requirement is permissive and requires only that the representative's claims "are reasonably co-extensive with those of the absent class members; they need not be substantially identical." Meyer v. Portfolio Recovery Assocs., LLC, 707 F.3d 1036, 1042 (9th Cir. 2012) (quoting Hanlon, 150 F.3d at 1020). The purpose of the typicality requirement is to assure that "the interest of the named representative aligns with the interests of the class." Torres v. Mercer Canyons Inc., 835 F.3d 1125, 1141 (9th Cir. 2016) (quoting Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992)).

The parties have established typicality. "[T]he broad composition of the representative parties vitiates any challenge founded on atypicality." Hanlon, 150 F.3d at 1020. The Settlement Class Representatives consist of persons from both the United States and Israel. SACC ¶¶ 18-28. Moreover, the Settlement Class Representatives signed up for a range of Yahoo services, including email accounts, advertisement-free and premium email services, and small business services. Id. However, the Settlement Class Representatives, like the Settlement Class as a whole, were all Yahoo users who allegedly either suffered identity theft and/or were placed at substantial risk for identity theft. Id. Accordingly, Yahoo's allegedly inadequate data security harmed the Settlement Class Representatives in a common way as the rest of the Settlement Class Members. As the Ninth Circuit has instructed, "it is sufficient for typicality if the plaintiff endured a course of conduct directed against the class." Just Film, Inc. v. Buono, 847 F.3d 1108, 1118 (9th Cir. 2017). Under these circumstances, typicality is satisfied.

4. Adequacy of Representation

Finally, Rule 23(a)(4) asks whether "the representative parties will fairly and adequately protect the interests of the class." Fed. R. Civ. P. 23(a)(4). This inquiry seeks to uncover conflicts of interest between named parties and the class they seek to represent, thereby guarding the due-process right of absent class members not to be bound to a judgment without adequate representation by the parties participating in the litigation. See Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 158 n.13 (1982); Hansberry v. Lee, 311 U.S. 32, 42-43 (1940). Adequacy of representation turns upon resolution of two questions: "(1) do the named plaintiffs and their counsel have any conflicts of interest with other class members and (2) will the named plaintiffs and their counsel prosecute the action vigorously on behalf of the class?" In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 943 (9th Cir. 2015) (citation omitted). Further, where named plaintiffs will receive service awards, the Court must "scrutinize carefully the awards so that they do not undermine the adequacy of the class representatives." Radcliffe v. Experian Info. Sols. Inc., 715 F.3d 1157, 1163 (9th Cir. 2013).

The Settlement Class here does not contain intractable divisions or conflicts. All Settlement Class Members are victims of the same alleged security lapses by Yahoo. Thus, all Settlement Class Members generally seek the same relief: compensation for any harms incurred as a result of the Data Breaches, in addition to protection against the unauthorized use of their Personal Information going forward. To the extent that there are distinctions between Settlement Class Members, the Settlement Class Representatives are a representative cross-section of the entire Settlement Class. See Hanlon, 150 F.3d at 1021 (noting that "[r]epresentatives of other potential subclasses are included among the named representatives"). For instance, numerous Settlement Class Representatives have had various forms of information stolen—including Social Security numbers and bank account information—and while some have experienced fraudulent use of their Personal Information, others have not. SACC ¶¶ 18-28. Likewise, the Settlement Class Representatives differ in whether they have taken action to combat the Data Breaches and, if so, the kind of action they have undertaken. Id.

Notwithstanding the foregoing, Objector James McCain argues that the Settlement Class Representatives are inadequate because "the terms of this settlement create a clear conflict of interest between the class representatives and the class." ECF No. 429 at 5. Specifically, McCain contends that the Settlement Agreement "conditions an incentive award on support of the settlement" by the Settlement Class Representatives. Id. at 5. McCain relies heavily on Radcliffe v. Experian Info. Sols. Inc., 715 F.3d 1157 (9th Cir. 2014), in order to craft this argument. In Radcliffe, the Ninth Circuit held that class representatives were inadequate under Rule 23 when the settlement agreement "explicitly condition[ed] the incentive awards on the class representatives' support for the settlement." Id. at 1164. In addition to the explicit condition contained within the agreement, the record showed that counsel told a plaintiff that the plaintiff "would 'not be entitled to anything'" if the plaintiff did not support the settlement, and counsel had also told other plaintiffs "they 'don't see a way for people who don't support the settlement to receive an incentive award.'" Id. at 1164-65. Because the class representatives could receive settlement awards "only if they supported the settlement," the class representatives "had very different interests than the rest of the class." Id. at 1165. Thus, the class representatives were inadequate. Id.

Here, Plaintiffs have moved for Service Awards for the sixteen Settlement Class Representatives. Mot. for Atty's Fees at 25. However, the circumstances of that motion are very different from those of Radcliffe. Unlike the settlement agreement in Radcliffe, the Settlement Agreement here does not contain any promise that Plaintiff's counsel will seek Service Awards for the Settlement Class Representatives in exchange for their support of the Settlement. In fact, the Settlement Agreement does not contain any promise by counsel to seek Service Awards for the Settlement Class Representatives at all. The Settlement Agreement merely states that Class Counsel "may seek" Service Awards for the Settlement Class Representatives. Compare Settlement Agmt. ¶ 11.1 ("The Parties agree that Settlement Class Representatives and Class Counsel may seek Service Awards to the Settlement Class Representatives . . . ." (emphasis added)), with Radcliffe, 715 F.3d at 1162 ("Settlement Class Counsel shall file an application or applications to the Court for an incentive award, to each of the Named Plaintiffs serving as class representatives in support of the Settlement . . . ." (emphasis added)). Thus, unlike Radcliffe, "[t]he class settlement agreement provided no guarantee that the class representatives would receive incentive payments." In re Online DVD-Rental, 779 F.3d at 943.

Second, there is nothing in the record in the instant case that is remotely akin to the statements made in Radcliffe by counsel to the class representatives. 715 F.3d at 1164-65 (outlining statements conditioning service awards on support of agreement). On the contrary, at the Final Fairness Hearing, Class Counsel informed the Court that "[a]bsolutely no promises or guarantees of any kind were made to Settlement Class Representatives regarding Service Awards." ECF No. 442 at 13. Nothing in the record contradicts Class Counsel's categorical representation to the Court. See In re Toyota Motor Corp. Unintended Acceleration Marketing, Sales Practices, and Prods. Liab. Litig., No. 8:10ML 02151 JVS (FMOx), 2013 WL 12327929, at *38 (C.D. Cal. July 24, 2013) ("There is no evidence that the incentive awards are conditioned on support for the Settlement or that any individual was threatened with no award if she opposed the Settlement.").

Third, to the extent that the Settlement Agreement does contemplate that Class Counsel may seek Service Awards for the Settlement Class Representatives, the Settlement Agreement does not affirmatively condition a request for those Service Awards on the Settlement Class Representatives' support of the Settlement. McCain relies on the fact that elsewhere in the Settlement Agreement, the Settlement Class Representatives "agree not to object to any of the terms of this Agreement." Settlement Agmt. ¶ 18.10. However, that provision is not framed as a condition for the possible request for Service Awards. On the contrary, the Settlement Agreement states that "[n]otwithstanding any other provision of this Agreement . . . , nothing in this Agreement shall be deemed to in any way impair, limit, or preclude the Parties' rights to enforce any provision of this Agreement . . . in a manner consistent with the terms of this Agreement." Id. ¶ 13.4. Thus, even if the Settlement Class Representatives did decide to object to the Settlement, the service awards provision would separately remain in effect. Accord Kress v. Pricewaterhouse Coopers LLP, No. 2:08-cv-00965-TLN-AC, 2018 WL 1124212, at *12 (E.D. Cal. Jan. 9, 2018) (granting preliminary approval of settlement in which separate provisions contemplated that class representatives "agree not to object to the Settlement" and "Class Counsel will submit an application seeking an additional payment as a Class Representative Service Award" for class representatives); No. 2:08-cv-00965-TLN-AC, ECF No. 434 (E.D. Cal. May 7, 2018) (granting final approval of same). In short, the Settlement Agreement simply does not "condition[] an incentive award on support of the settlement" by the Settlement Class Representatives. ECF No. 429 at 5.

McCain also challenges the size of the Service Awards contemplated by the Settlement Agreement. Id. at 6. Once again, McCain relies heavily on Radcliffe, 715 F.3d 1157, to support this argument. In Radcliffe, the Ninth Circuit noted that "the significant disparity between the incentive awards and the payments to the rest of the class members further exacerbated the conflict of interest caused by the conditional incentive awards." Id. at 1165. According to the Radcliffe court, "[t]here is a serious question whether class representatives could be expected to fairly evaluate whether awards ranging from $26 to $750 is a fair settlement value when they would receive $5,000 incentive awards." Id. In other words, "the court questioned, but did not determine whether class representatives could be expected to fairly evaluate whether awards ranging from $26 to $750 are a fair settlement value when they would receive $5,000 incentive awards." In re Illumina, Inc. Secs. Litig., No.: 3:16-cv-3044-L-MSB, 2019 WL 6894075, at *8 (S.D. Cal. Dec. 18, 2019) (citing Radcliffe, 715 F.3d at 1165).

In order to evaluate the reasonableness of the size of a service award, the Ninth Circuit looks to "the number of named plaintiffs receiving incentive payments, the proportion of the payments relative to the settlement amount, and the size of each payment." In re Online DVD-Rental, 779 F.3d at 947 (internal quotation marks omitted). Here, the Settlement Agreement contemplates that sixteen Settlement Class Representatives may receive Service Awards, an unremarkable size in light of the Ninth Circuit's guidance. Id. at 947 (noting that conferring incentive awards to 29 class representatives may be problematic). The contemplated Service Awards total $87,500 out of the $117.5 million Settlement Fund, which is less than .1% of the total Settlement Fund. These amounts fall well below the levels that the Ninth Circuit has found to be fatal in the past. Id. at 948 (finding service awards to be reasonable in part because "the $45,000 in incentive awards ma[de] up a mere .17% of the total settlement").

As noted, the Settlement Agreement's contemplated Service Awards range from $2,500 to $7,500, depending on each Settlement Class Representative's participation in the underlying litigation. Half of the Settlement Class Representatives seek $5,000 or less, which is considered "presumptively reasonable" in this district. Villegas v. J.P. Morgan Chase & Co., No. CV 09-00261 SBA EMC, 2012 WL 5878390, at *7 (N.D. Cal. Nov. 21, 2012). As for the eight Settlement Representatives who seek Service Awards of $7,500, an amount slightly higher than that "presumptively reasonable" benchmark, McCain contends that the disparity between these Service Awards and the award received by an average claimant in the instant case destroys adequacy. ECF No. 429 at 6.

The Court disagrees. The Settlement Administrator has estimated that "payments for Alternative Compensation will be approximately $40 to $50 per claimant." ECF No. 465 ("Fenwick Decl.") ¶ 12. Even considering only these payments, and not any of the compensation for Out-of-Pocket Claims that are simultaneously available to Settlement Class Members, the Court does not find the disparity to be fatal. Indeed, in Online DVD, the Ninth Circuit rejected the argument that $5,000 incentive awards were "unreasonably large" when claimants would only receive $12 pursuant to the settlement. 779 F.3d at 947. The Ninth Circuit recognized that a "$5,000 incentive award is roughly 417 times larger than the $12 individual award," but the Ninth Circuit explained that more important considerations consist of the "number of class representatives, the average incentive award amount, and the proportion of the total settlement that is spent on incentive awards." Id. Here, even assuming that a claimant receives only $40 in Alternative Compensation, with no corresponding recovery of other Out-of-Pocket Costs, a $7,500 Service Award is only 187.5 times larger than a $40 individual award. That reflects a lower factor than the one the Ninth Circuit approved in Online DVD. Id. Moreover, as outlined above, the "number of class representatives, the average incentive award amount, and the proportion of the total settlement that is spent on incentive awards" are unproblematic in the instant case. Id. Of course, as discussed infra, the Court also finds that the $7,500 Service Awards for the eight Settlement Class Representatives are warranted based on their role in protecting the interests of the Settlement Class by being deposed and having their personal devices forensically imaged. For the foregoing reasons, the Court overrules this objection.

The second adequacy inquiry examines the vigor with which the Settlement Class Representatives and Class Counsel will pursue the common claims. The Court specifically selected Class Counsel based on the attorneys' experience in prosecuting complex class actions. ECF No. 58. Class Counsel have subjected the case to adversarial testing—including by engaging in discovery, litigating motions to dismiss and discovery motions, and briefing class certification and Daubert motions—and have shown a willingness to take the case to trial if necessary. Thus, this is not a case where Class Counsel "could not use the threat of litigation to press for a better offer." Amchem, 521 U.S. at 621. The Settlement Class Representatives have also demonstrated their dedication to pursuing and securing the best outcome for the Settlement Class. The Settlement Class Representatives have actively participated in the case by sitting for depositions and, in many instances, allowing their personal computers to be forensically examined by Defendants. The actions on the part of the named Plaintiffs and Class Counsel were taken to advance the litigation. See Hanlon, 150 F.3d at 1021. This vigorous prosecution of the case satisfies the Rule 23(a)(4) concerns.

In sum, the Court finds that the Settlement Class meets the Rule 23(a) requirements of numerosity, commonality, typicality, and adequacy of representation under the heightened scrutiny mandated in the settlement-only context. The Court now turns to Rule 23(b)(3).

Rule 23(b)(3) Requirements

As noted above, Rule 23(b)(3) can be broken into two component pieces: (1) predominance, and (2) superiority. Hanlon, 150 F.3d at 1022. The Court analyzes each in turn.

1. Predominance

Under Rule 23(b)(3), plaintiffs must show "that the questions of law or fact common to class members predominate over any questions affecting only individual members." Fed. R. Civ. P. 23(b)(3). The Rule 23(b)(3) predominance requirement is "even more demanding" than Rule 23(a)'s commonality counterpart. Comcast Corp. v. Behrend, 569 U.S. 27, 34 (2013). Predominance "tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation." Amchem, 521 U.S. at 623 (citation omitted). The Ninth Circuit has held that "there is clear justification for handling the dispute on a representative rather than an individual basis" if "common questions present a significant aspect of the case and they can be resolved for all members of the class in a single adjudication." Hanlon, 150 F.3d at 1022. Before certifying a settlement-only class under Rule 23(b)(3), a district court must conduct a rigorous analysis of predominance. Zinser v. Accufix Research Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001). The predominance analysis focuses on "the legal or factual questions that qualify each class member's case as a genuine controversy, questions that preexist any settlement." Amchem, 521 U.S. at 623. The ultimate question is whether "the common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aggregation-defeating, individual issues." Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036, 1045 (2016).

Here, Plaintiffs' case for liability depends in part on whether Yahoo used reasonable data security to protect Plaintiffs' Personal Information, and on whether Yahoo provided timely notice in connection with the Data Breaches. These questions can be resolved using the same evidence for all Settlement Class Members and all claims arise out of a common course of conduct by Yahoo. Indeed, the focus on a defendant's security measures in a data breach class action "is the precise type of predominant question that makes class-wide adjudication worthwhile." In re Anthem, Inc. Data Breach Litig., 327 F.R.D. 299, 312 (N.D. Cal. 2018); see also In re The Home Depot, Inc., Customer Data Sec. Breach Litig., No. 1:14-MD-02583-TWT, 2016 WL 6902351, at *2 (N.D. Ga. Aug. 23, 2016) (noting that "common questions include whether Home Depot failed to reasonably protect Class Members' personal and financial information, whether Yahoo had a legal duty to do so, and whether Home Depot failed to timely notify Settlement Class Members of the data breach").

Moreover, in the instant case, there is no chance that variations in state law will predominate over the common questions. This is so because the Settlement Class Members entered into contracts with California choice-of-law provisions that cover the asserted claims. SACC ¶¶ 175-81 (explaining that United States Class Members signed agreement that dictates that "the relationship between You and the Company shall be governed by the laws of the State of California," and that Israeli Class Members signed agreement which dictates that "the substantive law of the State of California governs the interpretation of this [Terms of Service] [] and applies to all claims related to it"). In accordance with the applicable choice-of-law provisions, the parties have agreed throughout the instant case that California substantive law governs all claims. See, e.g., ECF No. 357 at 14 ("The scope of class counsels' work in the instant case was substantially limited by the parties' agreement that California law governed . . . .").

Damages issues also do not predominate over the common issues in this case. Indeed, predominance is not defeated simply because "other important matters will have to be tried separately, such as damages." Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036, 1045 (2016) (internal quotation marks omitted). In sum, Rule 23(b)(3) predominance is met in the instant case.

2. Superiority

Rule 23(b)(3) provides four non-exhaustive factors for a court to consider in determining whether a class action is superior to other methods of adjudication. These factors are:

(A) the class members' interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). "[T]he purpose of the superiority requirement is to assure that the class action is the most efficient and effective means of resolving the controversy." Wolin v. Jaguar Land Rover N. Am., LLC, 617 F.3d 1168, 1175 (9th Cir. 2010) (alteration in original) (citation omitted). In cases where plaintiffs are unable to proceed individually because the disparity between litigation costs and the recovery sought is too high, the class-action device may be an effective means "to pool claims which would be uneconomical to litigate individually." Local Joint Exec. Bd. of Culinary/Bartender Tr. Fund v. Las Vegas Sands, Inc., 244 F.3d 1152, 1163 (9th Cir. 2001) (quoting Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 809 (1985)); see also 7AA Charles Alan Wright et al., Federal Practice and Procedure § 1779 (3d ed. 2018) ("[I]f a comparative evaluation of other procedures reveals no other realistic possibilities, [the superiority] portion of Rule 23(b)(3) has been satisfied."). Superiority has been established here.

The first factor is each class member's interest in "individually controlling the prosecution or defense of separate actions." Fed. R. Civ. P. 23(b)(3)(A). "Where recovery on an individual basis would be dwarfed by the cost of litigating on an individual basis, this factor weighs in favor of class certification." Wolin, 617 F.3d at 1175. Here, the amount at stake for individual Settlement Class Members is too small to bear the risks and costs of litigating a separate action. Litigation costs would be quite high, given that the case involves complex technical issues and requires substantial expert testimony. These exact circumstances have been held to "point[] to the need for class treatment." Just Film, 847 F.3d at 1123.

The second factor is "the extent and nature of any litigation concerning the controversy already commenced by or against members of the class." Fed. R. Civ. P. 23(b)(3)(B). Pursuant to an order from the JPML, five federal cases filed in three different districts were transferred to this Court for coordinated or consolidated pretrial proceedings. In re Yahoo, 223 F. Supp. 3d at 1355. As the JPML articulated, the "[c]ommon factual questions are presented with respect to Yahoo's practices in safeguarding its users' personal information," and "[c]entralization [would] eliminate duplicative discovery; prevent inconsistent pretrial rulings, including with respect to class certification; and conserve the resources of the parties, their counsel, and the judiciary." Id. at 1354. Since that time, the parties have alerted the JPML to additional actions that involve the same common questions of fact, and the JPML has transferred those additional actions to this Court. See ECF Nos. 6, 33. At there are at present 31 actions pending before this Court, which comprise the MDL Case. See ECF No. 369-3. At the same time, the parties seek to settle seven parallel cases consolidated in California state court, which comprise the JCCP Case. Id. The parties have not identified any other cases that have been brought. Consequently, this factor too weighs in favor of certification.

The third factor is "the desirability or undesirability of concentrating the litigation of the claims in the particular forum." Fed. R. Civ. P. 23(b)(3)(C). When the JPML issued its transfer order, it selected this district as the appropriate transferee district. In re Yahoo, 223 F. Supp. 3d at 1355. In addition to the numerous actions that were already pending in this district, the JPML explained that "Defendant Yahoo's corporate headquarters is located within the district, and therefore relevant documents and witnesses are likely to be located there." Id. In view of that fact, the "parties agree[d] that this district [would] serve the convenience of the parties and witnesses." Id. Thus, this factor likewise supports certification.

The fourth factor is manageability, which requires that courts consider "the likely difficulties in managing a class action." Fed. R. Civ. P. 23(b)(3)(D). However, when "[c]onfronted with a request for settlement-only class certification, a district court need not inquire whether the case, if tried, would present intractable management problems." Amchem, 521 U.S. at 620. In fact, parties settle precisely to avoid going to trial. Id. In this case, the Court need not address the manageability factor.

In sum, the predominant issue in this case is whether Yahoo properly secured the Settlement Class Members' Personal Information. That question can be resolved using the same evidence for all Settlement Class Members. Class treatment is the superior method of adjudicating the consumer claims arising from the data breach because the issues cannot practically be resolved through millions of individual trials or settlement negotiations. Indeed, class-wide settlements have been approved in other data-breach cases. E.g., In re Equifax Inc. Customer Data Sec. Breach Litig., No. 1:17-md-2800-TWT, 2020 WL 256132, at *45 (N.D. Ga. Mar. 17, 2020); In re Target Corp. Customer Data Sec. Breach Litig., No. 14-MD-02522-PAM, 2017 WL 2178306, at *9 (D. Minn. May 17, 2017); In re The Home Depot, Inc., Customer Data Sec. Breach Litig., 2016 WL 6902351, at *2.

Accordingly, as all requirements of class certification under Rule 23 are met, the Settlement Class will be certified for the purposes of settlement. II. THE SETTLEMENT IS FAIR, ADEQUATE, AND REASONABLE

In evaluating a proposed class action settlement under Federal Rule of Civil Procedure 23(e), the standard is whether the settlement "is fundamentally fair, adequate and reasonable." Officers for Justice v. Civil Serv. Comm'n, 688 F.2d 615, 625 (9th Cir. 1982); accord Torrisi v. Tucson Elec. Power Co., 8 F.3d 1370, 1375 (9th Cir. 1993). A district court may consider some or all of the following factors when making this determination: "the strength of plaintiffs' case; the risk, expense, complexity, and likely duration of further litigation; the risk of maintaining class action status throughout the trial; the amount offered in settlement; the extent of discovery completed, and the stage of the proceedings; the experience and views of counsel; the presence of a governmental participant; and the reaction of the class members to the proposed settlement." Officers for Justice, 688 F.2d at 625. The Court finds that the Settlement is fair, adequate, and reasonable in light of these factors.

First, the Settlement reflects the strength of Plaintiffs' case as well as the Defendant's position. This Court has been "exposed to the litigants, and their strategies, positions and proof," Hanlon, 150 F.3d at 1026 (9th Cir. 1988) (quoting Officers for Justice, 688 F.2d at 626), and finds that the judicial policy favoring the compromise and settlement of class action suits is applicable here, see Class Plaintiffs v. City of Seattle, 955 F.2d 1268, 1276 (9th Cir. 1992). The Court is also satisfied that the Settlement was reached after arm's length negotiations by capable counsel, aided by three experienced mediators, and was not a product of fraud, overreaching, or collusion among the parties. Id. at 1290.

Second, the risks, expense, complexity, and likely duration of further litigation also support final approval. The parties reached the settlement before the Court ruled on class certification and Daubert motions in the MDL Case, and before the California state court ruled on class certification in the JCCP Case. In the MDL Case, Yahoo contested class certification on multiple bases. Indeed, Yahoo contested whether Plaintiffs could determine on a class-wide basis whether class members ever transmitted Personal Information to Yahoo, the value of any Personal Information provided to Yahoo, and whether the Data Breaches caused a decrease in that value. ECF No. 295 at 13-18. Yahoo filed three Daubert challenges that sought to exclude Plaintiffs' expert damages models. ECF Nos. 301, 302, 303. Although the parties settled before Yahoo opposed Plaintiffs' motion for class certification in the JCCP Case, it is likely that Yahoo would have opposed on similar grounds as in the instant case. Further, in the event that Plaintiffs succeeded in class certification and the Daubert motions, Plaintiffs would have had to defend against a motion for summary judgment and further Daubert motions. ECF No. 195 ("Case Management Order"). Further litigation would have also required Plaintiffs to undertake more discovery. Moreover, any litigation outcome would be subject to potential appeals, which would have (at best) substantially delayed any potential recovery. Taken together, these circumstances suggest that further litigation would have delayed any potential recovery for the Settlement Class and would have been costly and risky. By contrast, the Settlement provides the Settlement Class with timely and certain recovery.

Third, as a result of this Settlement, Yahoo has agreed to implement concrete Business Practice Changes designed to rectify the harms suffered by Settlement Class Members in the instant case. Settlement Agmt. ¶ 2. Specifically, Yahoo has committed to allocate at least $66 million per year to its information security budget in 2019-2022, which is roughly four times the size of Yahoo's average information security budget in 2013-2016. Mot. for Final Approval at 8. Yahoo will also employ 200 full-time security employees through the end of 2022, up from 48 in 2016. Id. Yahoo has pledged to align its information security program with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and Yahoo has also agreed to undertake annual third-party assessments to ensure compliance with that framework every year for four years beginning in 2019. Id. Yahoo has also agreed to strictly limit access to its User Database ("UDB"), enhance security training for employees, adopt industry standard anomaly and intrusion detection security tools, maintain event logs for three years, and engage in proactive penetration testing. Id. at 8-9. These non-monetary forms of relief benefit millions of Settlement Class Members, including those who do not submit a Claim Form. The Court finds that this non-monetary relief weighs in favor of final approval.

Moreover, the Settlement provides for meaningful consideration—a Settlement Fund of $117.5 million where the Settlement Class size is approximately 194 million. The size of this Settlement Fund provides adequate recovery to the Settlement Class compared to other settlements that courts have approved in data breach cases. See In re Anthem, Inc. Data Breach Litig., 327 F.R.D. 299, 318 (N.D. Cal. 2018) (granting final approval of $115 million settlement to class of roughly 79 million); In re The Home Depot, Inc. Customer Data Sec. Breach Litig., No. 14-MD-02583-TWT, 2016 WL 6902351, at *7 (N.D. Ga. Aug. 23, 2016) (granting final approval of $28.4 settlement to consumer class of roughly 52 million); In re Target Corp. Customer Data Sec. Breach Litig., MDL No. 14-2522 (PAM), 2017 WL 2178306, at *4 (D. Minn. Nov. 17, 2015) (granting final approval of $23.3 million settlement to consumer class of roughly 110 million); see also In re Equifax, 2020 WL 256132, at *45 (granting final approval of $380.5 million settlement to consumer class of roughly 147 million). Additionally, there is no possibility of reversion to Yahoo.

However, in light of important distinctions between the instant case and other data breach cases, further discussion about the Settlement here is warranted. Indeed, there are numerous factors in the instant case that create the expectation of a larger recovery for the Settlement Class than in other data breach cases.

First of all, although many other data breach cases focus on one data breach, the instant case involves multiple Data Breaches over a period of five years, each of which Yahoo failed to timely disclose. By contrast, for instance, Anthem involved only a single, continuous data breach from December 2014 to January 2015. In re Anthem, Inc. Data Breach Litig., 162 F. Supp. 3d 953, 967 (N.D. Cal. 2016) (explaining that data breach occurred between December 2014 and January 2015). Anthem disclosed the data breach to affected users in February and March 2015 and provided two years of free credit monitoring prior to any settlement of litigation. Id.; ECF No. 357 at 23.

By contrast, Yahoo's data was breached in 2012,³ 2013, 2014, 2015, and 2016, and Yahoo denied any knowledge of unauthorized access of personal data in its filings with the U.S. Securities and Exchange Commission ("SEC") and delayed notification to users even when Yahoo had contemporaneous knowledge of the breaches. See SACC ¶¶ 32-162 (outlining allegations). For instance, in 2016, in an SEC filing regarding Verizon's purchase of Yahoo, Yahoo represented that Yahoo knew of no incidents of unauthorized access of personal data that might adversely affect the Verizon acquisition of Yahoo. Yahoo, Preliminary Proxy Statement (Schedule 14(A), at Exhibit A-18 (Sept. 9, 2016), available at https://www.altaba.com/static-files/ad5f11da-0a78-4f3e-90f8-dd204c1978fb. However, thirteen days later, on September 22, 2016, Yahoo publicly disclosed the 2014 data breach. ECF No. 196 ¶ 126. In the announcement, Yahoo claimed that it learned of the 2014 data breach during a "recent investigation." Yahoo Security Notice September 22, 2016, available at https://help.yahoo.com/kb/%20SLN28092.html. Six months later, Yahoo admitted on March 1, 2017 in its 10-K filing with the SEC that Yahoo had "contemporaneous knowledge" of the 2014 data breach. ECF No. 196 ¶ 129; Yahoo, 2016 Annual Report (Form 10-K), at 47 (Mar. 1, 2017).

3 The Court notes that even though Yahoo seeks a release of claims as to the 2012 data breach, Yahoo continues to deny that a breach occurred in 2012. ECF No. 357 at 23.

Second, the Settlement Class size here is far larger than in other data breach cases. Indeed, the 79 million class in Anthem was roughly 40% the size of the 194 million Settlement Class in the instant case. In re Anthem, 327 F.R.D. at 329 (class size of roughly 79 million). Further, Home Depot involved a consumer class of 52 million, Target involved a consumer class of 110 million, and Equifax involved a consumer class size of 147 million. Mot. for Atty's Fees at 6-7. These three settlements also involved separate settlements with other entities, including financial institutions and/or credit card companies. See, e.g., Financial Institutions' Memorandum of Law in Support of their Unopposed Motion for Preliminary Approval of Class Action Settlement at 19, 25, In re Equifax, No. 17-MD-2800-TWT (N.D. Ga. May 15, 2020), ECF No. 1107-1 (seeking preliminary approval of settlement of $5.5 million on behalf of "thousands of financial institutions"); Final Order and Judgment, In re The Home Depot, No. 14-MD-02583-TWT (N.D. Ga. Sept. 22, 2017), ECF No. 343 (approving settlement with roughly 11,000 financial institutions); Memorandum of Law in Support of Financial Institution Plaintiffs' Motion for Final Approval of Class Action Settlement at 2, In re Target, No. 14-MD-02522-PAM (D. Minn. Apr. 11, 2016), ECF No. 745 ($39 million settlement with a separate class of roughly 6,510 financial institutions). Even taking these additional affected entities into account, however, the Settlement Class in the instant case is still the largest class. The large size of the Settlement Class here is significant because, as discussed infra Section V.A.3.a, it means that the Settlement Fund yields a lower per-capita recovery for Settlement Class Members than in cases involving similar funds for smaller classes. Further, the existence of separate settlements in other cases indicate that the defendants in those cases paid far more in total for single data breaches than what Yahoo will pay pursuant to this Settlement for multiple data breaches over a five-year period.

Third, as the Court has already noted, "Yahoo's history of nondisclosure and lack of transparency related to the data breaches are egregious." ECF No. 357 at 24. As a result of Yahoo's lack of disclosure, Settlement Class Members were unaware of the need to take any steps to protect themselves against potential misuse of their data, and Yahoo has not provided any credit monitoring on its own up to this point. Thus, for eight years, Settlement Class Members were not provided with credit monitoring when it would have been most useful. Unlike cases such as Anthem, Yahoo's data was sold on the dark web, and Yahoo bought back the data on the dark web. Plaintiffs allege that others have also purchased Yahoo's data on the dark web.

Fourth, unlike in Anthem, Yahoo may have misled customers and shareholders. For instance, as outlined supra, in 2016 Yahoo represented in an SEC filing that Yahoo knew of no incidents of unauthorized access of personal data that might adversely affect the Version acquisition but subsequently revealed that Yahoo had contemporaneous knowledge of the 2014 data breach. On April 24, 2018, Yahoo settled for $35 million with the SEC for misleading investors by failing to disclose the data breaches. Press Release, SEC, Altaba, Formerly Known as Yahoo!, Charged with Failing to Disclose Massive Cybersecurity Breach; Agrees to Pay $35 Million (April 24, 2018), available at https://www.sec.gov/news/press-release/2018-71. On September 7, 2018, this Court granted final approval to Yahoo's $80 million settlement of a federal securities class action related to Yahoo's failure to disclose the 2013, 2014, and 2015-2016 data breaches. In re Yahoo! Inc. Secs. Litig., No. 17-CV-00373-LHK, ECF No. 118.

Each of these factors weighs in favor of a larger settlement in the instant case than in other data breach cases. However, on the other hand, the Court acknowledges that the Personal Information impacted by the Data Breaches in the instant case varies. Beyond email addresses, passwords, telephone numbers, birth dates, and security questions and answers, whether Settlement Class Members' more sensitive personal information, such as Social Security numbers, financial and bank records, and medical records, was stolen during the Data Breaches depended on the Settlement Class Members' accounts with Yahoo.

The Court now turns to a comparison of some specific terms of the instant Settlement with the settlement in Anthem, which the Court previously approved. The Court finds that the Yahoo Settlement Agreement compares favorably in some respects but unfavorably in others. Ultimately, the Yahoo Settlement Agreement is comparable to the Anthem settlement.

The Court begins with the provision of credit monitoring. Yahoo Settlement Class Members who receive Credit Services will likely not receive more than two years' worth of those services. Settlement Agmt. ¶ 4.7 (explaining that Credit Services are provided "for a period of at least two (2) years"). However, the settlement in Anthem was "likely to secure four years of credit monitoring for all Settlement Class Members." In re Anthem, 2018 WL 3960068, at *7. Moreover, in Anthem, Anthem provided two years of free credit monitoring to users prior to any settlement of litigation. ECF No. 357 at 23. Thus, class members in Anthem will likely receive six years of credit monitoring compared to the two years Yahoo Settlement Class Members will likely receive here. That means that Settlement Class Members here will likely receive credit monitoring for only 33% of the period for which Anthem class members will likely receive credit monitoring. The provision of credit monitoring here compares unfavorably to the provision of credit monitoring in Anthem.

Pursuant to the Settlement Agreement, Yahoo Settlement Class Members who were Small Business Users or Paid Users during the Class Period may recover up to 25% of the amount paid to Yahoo for the respective services. Settlement Agmt. ¶¶ 6.5, 6.7. Small Business Users, however, are capped at $500 reimbursement per year for this form of reimbursement. Id. This represents a provision of compensation that the Anthem settlement did not contain.

The provision of other forms of compensation across the two settlements is roughly comparable, though the compensation differs in certain details. First, with respect to Out-of-Pocket Costs, Yahoo Settlement Class Members are capped at $25,000 in Out-of-Pocket Costs, but Anthem settlement class members were capped at a lower $10,000 figure. Settlement Agmt. ¶ 6.4; Anthem, 327 F.R.D. at 319 ("A sum of $15 million is set aside to reimburse up to $10,000 for each Settlement Class Member who incurred out-of-pocket costs as a result of the data breach."). Moreover, in both Yahoo and Anthem, recovery for out-of-pocket costs may include time spent responding to data breaches. Yahoo Settlement Class Members who spent time responding to the Data Breaches are entitled to reimbursement at a minimum rate of $25 per hour, which is more favorable than the $15 per hour rate provided in Anthem. Settlement Agmt. ¶ 1.29; In re Anthem, No. 15-MD-02617-LHK, ECF No. 869-8 ¶ 1.23 (N.D. Cal.).

Documentation requirements for Out-of-Pocket Costs also differ between settlements. In the instant case, Yahoo Settlement Class Members are entitled to reimbursement for up to five hours of time without the need to show any corroborating documentation. Settlement Agmt. ¶ 1.29. By contrast, in Anthem, a class member could not receive reimbursement for any time without documentation, including a detailed showing of how the time was expended and why it was necessary for any time claimed above ten hours. In re Anthem, No. 15-MD-02617-LHK, ECF No. 869-8 ¶ 1.23 (N.D. Cal.).

On the other hand, the Settlement in Yahoo is less favorable with respect to Out-of-Pocket Costs than the settlement in Anthem in at least one respect. The Settlement Agreement in Yahoo caps reimbursement for time spent remedying the Data Breaches at fifteen hours. Settlement Agmt. ¶ 1.29. The settlement in Anthem did not cap reimbursable time.

Alternative Compensation in the form of cash for Yahoo Settlement Class Members who already have credit monitoring is also comparable to the amount provided in Anthem. Under the Yahoo Settlement Agreement, Settlement Class Members may technically receive up to $358.80, depending on the distribution of funds. Settlement Agmt. ¶ 5.3. However, given current trends, the Settlement Administrator predicts that "payments for Alternative Compensation will be approximately $40 to $50 per claimant." Fenwick Decl. ¶ 12. Similarly, Anthem class members who already had credit monitoring were "likely to receive" alternative compensation in the amount of $50. In re Anthem, 2018 WL 3960068, at *31. In sum, and as noted, the Court finds that the non-credit monitoring aspects of the Settlement Agreement here are largely comparable to the ones in Anthem.

All in all, in light of the number of Data Breaches, the larger Settlement Class size, Yahoo's failures to timely disclose, Yahoo's misleading public statements, and the sale of the breached Yahoo data on the dark web, the Court would have expected a larger settlement here than in Anthem. Instead, the parties largely followed the Anthem settlement. Nonetheless, the Court concludes that the $117.5 million amount offered in settlement is a significant sum and weighs in favor of approval.

Fourth, the extent of discovery completed and the stage of proceedings support approval. The parties litigated two motions to dismiss in the MDL Case and one demurrer in the JCCP Case. ECF No. 369 at 33. Plaintiffs took seven depositions, and Plaintiffs also produced four different expert reports. Plaintiffs' four experts were deposed, and nine named Plaintiffs in the MDL Case were deposed. The parties ultimately settled only after Plaintiffs had filed a motion for class certification in the MDL Case, and Yahoo filed an opposition but Plaintiffs did not file a reply. Further, after the Court denied Plaintiffs' first motion for preliminary approval, Plaintiffs took three confirmatory depositions in connection with the new Settlement. Both parties had therefore developed a perspective on the strengths and weaknesses of their respective cases in order to "make an informed decision about settlement." In re Mego Fin. Corp. Sec. Litig., 213 F.3d 454, 459 (9th Cir. 2000) (quoting Linney v. Cellular Alaska Partnership, 151 F.3d 1234, 1239 (9th Cir. 1998)). This discovery is indicative of a lack of collusion, as the parties have litigated the case in an adversarial manner. 4 Newberg on Class Actions § 13:50 (5th ed. 2018).

Fifth, the views of Plaintiffs' counsel, who are experienced in litigating and settling complex consumer class actions, weigh in favor of final approval. Linney v. Cellular Alaska Partnership, No. 96-3008-DJL, 1997 WL 450064, at *5 (N.D. Cal. July 18, 1997), aff'd 151 F.3d 1234 (9th Cir. 1998). Class Counsel endorses the Settlement as fair, adequate, and reasonable. ECF No. 369-1 ¶ 43; ECF No. 369-16 ¶¶ 8-10.

Finally, the reaction of the Settlement Class Members supports the Court's final approval of the Settlement. Out of approximately 194 million Settlement Class Members, only 31 Settlement Class Members submitted objections.⁴ ECF No. 442 at 1. That amounts to roughly 0.00000016% of the Settlement Class. A larger portion of Settlement Class Members opted out of the Settlement. Specifically, 1,779 Settlement Class Members have opted out of the Settlement, which amounts to roughly 0.00000916% of the Settlement Class). Id. The same attorney represented 1,287 Settlement Class Members who opted out. Id. at 1 n.1. More importantly, such low rates of objections and opt-outs are "indicia of the approval of the class." Hughes v. Microsoft Corp., No. C98-1646C, C93-0178C, 2001 WL 34089697, at *1, *8 (W.D. Wash. Mar. 26, 2001) (finding indicia of approval when 9 class members out of 37,155, or just over .02%, who received notice submitted objections, and "less than 1%" opted out); see also Sugarman v. Ducati N. Am., Inc., No. 5:10-CV-05246-JF, 2012 WL 113361, at *3 (N.D. Cal. Jan. 12, 2012) (objections from 42 of 38,774 class members—more than 0.1 percent—is a "positive response"); Churchill Vill., LLC v. Gen. Elec., 361 F.3d 566, 577 (9th Cir. 2004) (affirming district court's approval of settlement where forty-five of 90,000 class members objected to the settlement (.05%), and 500 class members opted out (.56%)).

4 Plaintiffs initially construed a pro se filing by Leonard Deshawn Scott as an objection. ECF No. 422. However, the Court construes this pro se filing as a request for an exclusion, not an objection. Id. at 2 ("Plaintiff makes this, his timely motion for exclusion from the current class members and their proposed settlement agreement . . . .").

The Court has considered each objection and the arguments made by five objectors at the Final Fairness Hearing. Attorney Robert Clore appeared at the Final Fairness Hearing for Objector James McCain. ECF No. 429. Objectors Carol Gonzales, Edward Orr, Darlene Orr, and Seth Katz appeared at the Final Fairness Hearing pro se. ECF Nos. 433, 438-3 Ex. T, 450. The Court appreciates the concerns expressed by the objectors. However, the Court concludes that none of the objections warrant rejection of the Settlement. See Browne v. Am. Honda Motor Co., No. CV 09-06750 MM DTBX, 2010 WL 9499072, at *15 (C.D. Cal. July 29, 2010) ("The fact that there is opposition does not necessitate disapproval of the settlement. Instead, the court must independently evaluate whether the objections being raised suggest serious reasons why the proposal might be unfair." (brackets and internal quotation marks omitted)). Here, the Court addresses general objections to the Settlement and to the Settlement Fund.

As an initial matter, the Court notes that at least six of the objectors failed to comply with the requirements of the Settlement Agreement. Settlement Agmt. ¶ 9.7 ("The written objection must include the objector's name, address, personal signature, a statement of grounds for the objection, a statement indicating the basis for the objector's belief that he, she, or it is a Member of the Settlement Class (to the extent the objector did not receive notice), a statement identifying the number of class action settlements objected to by the Settlement Class Member in the last three years, a statement whether the objector intends to appear at the Final Fairness Hearing, either in person or through counsel, and if through counsel, identifying counsel by name, address, and telephone number.").

Specifically, Pedro Payne, Michael Cherepko, Mark Wagner, Steven Kent Luker, Leah Elliott, and Carol Gonzales failed to provide information required by the Settlement Agreement. ECF No. 438-1 Ex. B (Objection of Pedro Payne) (no indication of whether objector intended to appear);⁵ ECF No. 438-1 Ex. E (Objection of Michael Cherepko) (no signature provided); ECF No. 438-1 Ex. H (Objection of Mark Wagner) (no indication of whether objector intended to appear); ECF No. 425 (Objection of Steven Kent Luker) (no indication of whether objector had previously filed objections or intended to appear); ECF No. 438-2 Ex. M (Objection of Leah Elliott) (no indication of whether objector intended to appear); ECF No. 438-2 Ex. Q (Objection of Carol Gonzales) (no indication of whether objector intended to appear). The Court need not consider these noncompliant objections. See Chavez v. PVH Corp., No. 13-CV-01797-LHK, 2015 WL 9258144, at *3 (N.D. Cal. Dec. 18, 2015) (explaining that court may reject "procedurally improper" objections on that basis alone); see also Moore v. Verizon Commc'ns Inc., No. C 09-1823 SBA, 2013 WL 4610764, at *12 (N.D. Cal. Aug. 28, 2013) (overruling objections that were submitted because these objections "fail[ed] to comply with the procedural requirements for objecting to the Settlement"). Nevertheless, the Court also rejects these objections on the merits.

5 It is also unclear whether Pedro Payne is a Settlement Class Member because Payne cites a breach in "August 25, 2010," several years before the Class Period in the instant case. ECF No. 438-1 Ex. B at ECF 5.

Numerous objectors challenge the sufficiency of the relief provided for the Settlement Class. Indeed, eleven objectors claim that the amount of the Settlement Fund is inadequate. For instance, Sarah Tuel asserts that she "do[es] not believe $117,500,000 is nearly enough." ECF No. 441-1 Ex. Z. Similarly, Jeromy Carpenter states that "[t]he sum of money is far too little and not enough is going to the class members to motivate future victims of identity theft to hold those corporations . . . accountable." ECF No. 438-1 Ex. G; see also ECF No. 437 (Objection of Durell Belmont) (objecting to Settlement because "damages are more than offered"); ECF No. 438-1 Ex. P (Objection of Audun Huslid) (objecting to Settlement in part because the Settlement "does not impose adequate penalties on the Defendants"); ECF No. 438-13 Ex. U (Objection of Mitchell Schwartz) (objecting to Settlement in part because "Yahoo needs to be punitively punished"); ECF No. 440-2 Ex. Y (Objection of Paul Taylor) (objecting to Settlement in part because the Settlement should "issue a tax credit" in lieu of "credit monitoring []or compensation").

In objecting to the size of the Settlement, these Settlement Class Members fail to adequately take into account the risks and delays involved in proceeding to class certification, summary judgment, and/or trial. They ignore that the Settlement provides the class with a timely, certain, and meaningful recovery, while further litigation and any subsequent appeal are uncertain, would entail significant additional costs, and in any event would substantially delay any recovery achieved. "[T]he very essence of a settlement is compromise, a yielding of absolutes and an abandoning of highest hopes." Linney, 151 F.3d at 1242 (quoting Officers for Justice, 688 F.2d at 624). "Estimates of what constitutes a fair settlement figure are tempered by factors such as the risk of losing at trial, the expense of litigating the case, and the expected delay in recovery (often measured in years)" Browne, 2010 WL 9499072, at *12. Thus, "[t]he fact that a proposed settlement may only amount to a fraction of the potential recovery does not, in and of itself, mean that the proposed settlement is grossly inadequate and should be disapproved." Linney, 151 F.3d at 1242 (internal quotation marks omitted). Additionally, these objectors do not account for the fact that the Settlement Fund does not constitute all of the relief to the Settlement Class. As discussed above, Yahoo has also implemented concrete Business Practice Changes designed to rectify the harms suffered by Settlement Class Members in the instant case. Settlement Agmt. ¶ 2.

Objectors Edward and Darlene Orr argue that the Settlement is inadequate because California law should not be applied. ECF No. 433 at 18. Indeed, Edward and Darlene Orr maintain that Vermont law is "substantially different from, and better for consumers, than California law in regard to an action against Yahoo." Id. at 15. According to Edward and Darlene Orr, the application of Vermont law would have resulted in a more favorable settlement for Plaintiffs, or would have enabled Plaintiffs to ultimately prevail at trial. Id. at 18. However, Edward and Darlene Orr fail to acknowledge the existence of a California choice-of-law provision in their agreement with Yahoo. In the instant case, the SACC alleges, and the parties have maintained from the beginning of the litigation, that all of the Settlement Class Members signed agreements that require application of California substantive law. SACC ¶¶ 175-81 (explaining that United States Class Members signed agreement that dictates that "the relationship between You and the Company shall be governed by the laws of the State of California," and that Israeli Class Members signed agreement which dictates that "the substantive law of the State of California governs the interpretation of this [Terms of Service] [] and applies to all claims related to it"). Under California law, "[t]he parties' choice generally will be enforced unless the other side can establish both that the chosen law is contrary to a fundamental policy" of the other state, and that the other state "has a materially greater interest in the determination of the matter." Washington Mutual Bank, FA v. Superior Court, 24 Cal.4th 906, 917 (2001). Edward and Darlene Orr make no showing that the application of California law in the instant case is contrary to any "fundamental policy" of Vermont, or that Vermont "has a materially greater interest in the determination of the matter" than California, where Yahoo was headquartered at the time of the underlying allegations. Id.

Finally, some objectors claim that the Settlement amount is insufficient because the objectors suffered unique damages. See ECF No. 438-1 Ex. J (Objection of Catherine Garrett) (arguing that the Settlement is inadequate in part because Data Breaches caused damage to "international trade in the Crystal business"); ECF No. 438-2 Ex. K (Objection of Marc Garrett) (arguing that the Settlement is inadequate in part because Data Breaches caused issues with objector's patents and divorce proceeding); ECF No. 440-1 Ex. X (Objection of Wilbur Hiligh) (arguing that Settlement is inadequate because objector is entitled to "special damages" based on content of email account).

For instance, Edward and Darlene Orr assert that they have spent over 3,383 hours, or almost 141 days' worth of continuous time, addressing the Data Breaches.⁶ ECF No. 363 at 6. Edward and Darlene Orr also claim that they suffered over $267,465 in damages, seemingly as a result of hacking targeting "global patents" they hold. Id. at 14. There is no evidence that damages of this magnitude are widespread. Thus, to the extent that Settlement Class Members suffered unique damages of this nature, the correct response is to opt out from the Settlement Class in order to pursue those damages on an individual basis. See, e.g., In re Conseco Life Ins. Co. Cost of Ins. Litig., No. ML 04-1610 AHM (Mcx), 2005 WL 5678842, at *9 (C.D. Cal. Apr. 26, 2005) (noting that "plaintiffs with large claims may prefer to pursue actions individually"); In re Lidoderm Antitrust Litig., No. 14-md-02521-WHO, 2017 WL 679367, at *15 (N.D. Cal. Feb. 21, 2017) ("[T]he possibility that a number of additional 'large claim' DPPs might opt out to control their own cases or seek lost profits damages only increases the utility of the class device.").⁷

6 The substance of this objection was made by Edward and Darlene Orr as to the parties' first class action settlement, of which the Court denied preliminary approval. ECF No. 363. Nevertheless, Edward and Darlene Orr appear to incorporate by reference their earlier objections against the current Settlement as well. ECF No. 433 at 25 ("[T]he undersigned hereby incorporate any and all of our prior objections, submissions, arguments, etc.").

7 Edward and Darlene Orr assert that their claims may be untimely because "THE CLOCK WAS STILL TICKING IN REGARD TO THE STATUTE OF LIMITATIONS" even though it was "literally impossible . . . to make a timely and viable case" due to Yahoo's concealment of information. ECF No. 363 at 4. However, the Orrs do not cite any cases that have found a claim untimely in those circumstances, and courts in fact regularly apply equitable exceptions under such circumstances. See, e.g., Regents of Univ. of Cal. v. Superior Court, 20 Cal.4th 509, 533 (1999) ("In articulating the doctrine [of fraudulent concealment], the courts have had as their purpose to disarm a defendant who, by his own deception, has caused a claim to become stale and a plaintiff dilatory."); see also American Pipe & Const. Co. v. Utah, 414 U.S. 538, 554 (1974) (explaining that "the commencement of a class action suspends the applicable statute of limitations as to all asserted members of the class").

Relatedly, Edward and Darlene Orr argue that the Settlement is inadequate because it impermissibly "lump[s] together the disparately large claims of the handicapped," which Edward and Darlene Orr argue will be disproportionately affected by the fifteen-hour cap for time spent remedying the Data Breaches. ECF No. 433 at 10. "An objector to a proposed settlement agreement bears the burden of proving any assertions they raise challenging the reasonableness of a class action settlement." In re Linkedin User Privacy Litig., 309 F.R.D. 573, 583 (N.D. Cal. 2015) (citing United States v. Oregon, 913 F.2d 576, 581 (9th Cir. 1990). The Court accepts the premise that certain types of handicaps may prolong the amount of time required to respond to the Data Breaches and hence entitle claimants to larger Out-of-Pocket Costs. However, Edward and Darlene Orr provide no evidence that a significant number of handicapped claimants in such a situation will exceed the fifteen-hour cap and thereby render the Settlement inadequate. The Court has heard no other objections as to the time cap, from handicapped objectors or otherwise.

Objector Audun Huslid argues that the Settlement Agreement erroneously treats the Data Breaches "as one consolidated data breach." ECF No. 438-2 Ex. P at 1. The Settlement Agreement does indeed recognize that the Data Breaches comprised separate incidents, however. Settlement Agmt. ¶ 1.15 (citing discussion of Data Breaches contained within SACC). Plaintiffs assert that the Data Breaches all arose from a common course of conduct by Yahoo, such as failure to adequately protect the Settlement Class Members' Personal Information, which renders class treatment appropriate. See supra Section I; see also Harvey v. Morgan Stanley Smith Barney LLC, No. 18-CV-02835-WHO, 2020 WL 1031801, at *13 (N.D. Cal. Mar. 3, 2020) (explaining that claims should "normally be tried together" when they "derive from a common nucleus of facts"). Huslid also argues that the Settlement should include an admission of wrongdoing and compensate Settlement Class Members for "past, present and future emotional stress." ECF No. 438-2 Ex. P at 1-2. First, the Settlement is adequate notwithstanding the lack of an admission of wrongdoing by Yahoo. The requirement of such an admission would no doubt reduce the amount of compensation available to Settlement Class Members or preclude the possibility of settlement altogether. See Alliance to End Repression v. City of Chicago, 561 F. Supp. 537, 554 (N.D. Ill. 1982) ("It would defeat an important purpose of settlement, and therefore render settlements less attractive to parties, if the settlement agreement were required to include admissions of wrongdoing by the defendants."). Second, courts have deemed emotional distress too speculative to constitute a measure of damages in data breach cases. See Pruchnicki v. Envision Healthcare Corp., No. 219CV1193JCMBNW, 2020 WL 853516, at *5 (D. Nev. Feb. 20, 2020) ("[P]laintiff's allegations of emotional distress are insufficient to satisfy the damages element of her claims.").

Eleven objectors argue that the Settlement is inadequate due to dissatisfaction with the Credit Services the Settlement provides. Some objectors maintain that the credit monitoring in the instant case lacks value. For instance, objector Aaron Miller, represented by Steve A. Miller, objects to the fact that "class members do not have a choice and must accept the offered 'credit monitoring services,' as set forth on the website, instead of selecting cash." ECF No. 432; see also ECF No. 438-1 Ex. D (Objection of Mihail Seroka) ("[P]laintiffs do not want credit monitoring. They want cash compensation."); ECF No. 438-1 Ex. I (Objection of Vivian Saegesser) ("I believe the costs of monitoring credit should be sent to those affected in the form of a check . . . .").

As an initial matter, these objectors are simply incorrect to the extent that they argue that Settlement Class Members cannot receive cash compensation if they decline credit monitoring from Yahoo. The Settlement entitles Settlement Class Members to cash for Out-of-Pocket Costs incurred as a result of the Data Breaches irrespective of whether the Settlement Class Members choose to receive credit monitoring. As discussed, these Out-of-Pocket Costs include reimbursement of up to five hours' worth of time spent responding to the Data Breaches, at a minimum rate of $25 per hour, with no documentation requirement. Although it is true that Settlement Class Members may only receive Alternative Compensation in the form of cash if Settlement Class Members already possess credit monitoring, this feature of the Settlement does not render the Settlement inadequate. See In re Anthem, 327 F.R.D. at 310 ("[T]he Settlement's main form of relief—credit monitoring—would not be of much value to Settlement Class Members who already have such services, so the Settlement allows them to claim an alternative cash payment.").

Aaron Miller and several other objectors further maintain that the Credit Services lack value because they have concerns about AllClear ID. ECF No. 432 at 7-12; ECF No. 438-1 Ex. C (Objection of Patrick Catel) ("I do not see the benefit of providing my personal information to yet another company as a so-called solution to that very information having been compromised by a company I had already entrusted with said information."); ECF No. 438-2 Ex. M (Objection of Leah Elliott) (arguing that "credit monitoring providers [] are not worthy (or capable) to protect anyone's data"). For instance, Aaron Miller cites numerous online complaints previously made by customers of AllClear ID. ECF No. 432 at 7-12. This evidence does not render the Settlement inadequate. AllClear ID supplies credit monitoring to 2,228,748 individuals around the world. ECF No. 442-2 ("AllClear Decl.") ¶ 12. Moreover, AllClear ID possesses an A+ rating from the Better Business Bureau and "has consistently maintained a 96% customer satisfaction rating along with 100% success resolving financial identity theft cases," based on consumer surveys. Id. ¶ 4.

Some objectors, by contrast, maintain that the Credit Services lack value because the objectors believe that Yahoo itself will provide the credit monitoring. See ECF No. 438-1 Ex. A (Objection of Wanda Jewell) ("By making that settlement, we are basically being forced to use the settlement to pay Yahoo for something that it should have already been protecting against through their service in the first place."); ECF No. 438-1 Ex. F (Objection of Julianna Lawnsdale) ("I can't afford ID/data protection for myself rn, [sic] but I don't trust Yahoo with it, so I'm excluded from compensation."); ECF No. 438-2 Ex. K (Objection of Marc Garrett) ("Even more valueless is their [Yahoo's] offer to 'pay for two years' of careful watch over your credit information . . . which they have already demonstrated to be incapable of by their own admission."). These objections are based on a mistaken assumption. AllClear ID, not Yahoo, provides the Credit Services pursuant to the Settlement. Settlement Agmt. ¶ 4.1 ("Credit Services shall be provided by AllClear ID.").

Several objectors argue that the timing of the Credit Services is problematic. For instance, Vivian Saegesser states that she "[does not] see any benefit to start watching credit 4 to 5 years after a security breach." ECF No. 438-1 Ex. I; see also ECF No. 438-1 Ex. H (Objection of Mark Wagner) ("Also what benefit will anyone gain by receiving credit protection over three to seven years after the breach?"). Although Yahoo should have disclosed the Data Breaches timely and provided credit monitoring services earlier, objectors provide no support for their belief that forward-looking credit monitoring lacks value. On the contrary, testimony in the instant case indicates that for Settlement Class Members for whom data was compromised, "significant risk of identity fraud and other harms . . . will be of a particularly lasting nature." ECF No. 258-4 Ex. 94 ("Van Dyke Decl.") ¶ 35; see also id. ¶ 32 (explaining that in light of Data Breaches, it is possible that criminals could "steadily aggregate enough data to commit identity fraud").

On the other hand, some objectors maintain that the Credit Services lack value because they do not last longer than two years. See ECF No. 438-2 Ex. N (Objection of Nancy McCarthy) ("My loss of data and its potential for misuse lasts a lifetime yet the proposed settlement only lasts a few years. Any settlement should last as long as I do . . . a lifetime!"); see also ECF No. 438-2 Ex. O (Objection of Michael Brown) ("My loss of data and its potential for misuse lasts a lifetime yet the proposed settlement only lasts a few years. Any settlement should last as long as I do . . . a lifetime!"). As an initial matter, the Settlement provides for Business Practice Changes that may indeed benefit Settlement Class Members well into the future. To the extent that objectors would prefer the Settlement to provide longer term Credit Services, this preference does not render the Settlement inadequate. See Linney, 151 F.3d at 1242 ("The fact that a proposed settlement may only amount to a fraction of the potential recovery does not, in and of itself, mean that the proposed settlement is grossly inadequate and should be disapproved." (internal quotation marks and citation omitted)).

Finally, some objectors assert that the Credit Services lack value because some Settlement Class Members already possess credit monitoring services. See ECF No. 438-1 Ex. E (Objection of Michael Cherepko) ("Credit monitoring is already a widespread amenity offered by many credit card services."). For instance, Michael Cherepko argues that he "ha[s] a settlement from Experian offering the exact same compensation," i.e., credit monitoring through the In re Experian Data Breach settlement. However, Alternative Compensation in the form of cash is available under the Settlement irrespective of whether the source of that credit monitoring is another settlement. Settlement Agmt. ¶ 5.1 (explaining that Alternative Compensation is available to Settlement Class Members who "already have some form of credit monitoring or protection"); In re Experian Data Breach Litig., No. 8:15-cv-01592 AG (DFMx), ECF No. 322 (C.D. Cal. May 10, 2019) (granting final approval of Experian data breach settlement).

Similarly, objector Seth Katz cites the fact that credit monitoring is available to him pursuant to a pending settlement in In re Equifax. ECF No. 438-3 Ex. T; see In re Equifax Inc. Customer Data Sec. Breach Litig., No. 1:17-md-2800-TWT, 2020 WL 256132 (N.D. Ga. Mar. 17, 2020) (granting final approval of Equifax data breach settlement). Under the Settlement Agreement in the instant case, in order to receive Alternative Compensation, Settlement Class Members must state that they have "some form of credit monitoring or protection as of the date the Claim Form is submitted." Settlement Agmt. ¶ 5.1. Thus, Katz is not entitled to Alternative Compensation in the instant case because the Equifax settlement "has not yet become effective," and therefore Katz does not already have credit monitoring through the Equifax settlement. As an initial matter, the Court rejects the premise that the instant Settlement provides "absolutely no value" to objectors in Katz's position. ECF No. 438-3 Ex. T at 2. First of all, Seth Katz declares that he was a Paid User during the Class Period. Id. at 1. Pursuant to the Settlement, Paid Users are entitled to recover "up to 25% per year of service paid for between January 1, 2012 and December 31, 2016." Settlement Agmt. ¶ 6.5. This amount is in addition to the other Out-of-Pocket Costs incurred by Katz, including compensation for any time spent responding to the Data Breaches. Settlement Agmt. ¶ 1.29. This compensation is independent of the Credit Services.

Moreover, the credit monitoring in the instant case is not entirely duplicative of the credit monitoring in Equifax. First, the Equifax settlement contemplates credit monitoring provided by different credit monitoring services, and in a different package, than the one provided by AllClear ID in the instant case. In re Equifax, 2020 WL 256132, at *2 (noting that credit monitoring is provided by Experian and Equifax). Credit monitoring by multiple, independent entities still provides value to Settlement Class Members. Second, importantly, it is unclear whether the Equifax credit monitoring will ever overlap with the Credit Services provided by the instant Settlement in the first place because the Equifax settlement is currently pending appeal before the Eleventh Circuit. It is therefore entirely possible that the two years' worth of Credit Services offered in the instant case will expire before the Equifax credit monitoring becomes active. Third, and finally, the Equifax settlement postdates the instant Settlement, and it would be inequitable to retrospectively render this Settlement invalid based on the contents of a subsequent settlement reached in a different court in a different case.

Accordingly, the Court overrules the foregoing objections to the Settlement and the Settlement relief. The Court next addresses the Notice Program and objections thereto.

III.THE NOTICE PLAN IS APPROPRIATE

Federal Rule of Civil Procedure 23(c)(2)(B) requires that the settling parties provide class members with "the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort. The notice must clearly and concisely state in plain, easily understood language: (i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through an attorney if the member so desires; (v) that the court will exclude from the class any member who requests exclusion; (vi) the time and manner for requesting exclusion; and (vii) the binding effect of a class judgment on members under Rule 23(c)(3)."

The Court finds that the Notice Plan has been fully implemented in compliance with this Court's Order, ECF No. 390, and complies with Fed. R. Civ. P. 23(c)(2)(B). Notice was sent by email, published in two magazines, and advertised online. The various forms of Notice, which were reviewed and approved by this Court, provided clear descriptions of who is a member of the Settlement Class and Settlement Class Members' rights and options under the Settlement. The Notices explained the conduct at issue in the litigation, how to receive money from the Settlement, how to opt out of the Settlement, how to object to the Settlement, how to obtain copies of relevant papers filed in the case, and how to contact Class Counsel and the Settlement Administrator. See ECF No. 396-6 (outlining the content of the Notice Plan).

The Court approved this Notice Plan. ECF No. 390. Pursuant to the Settlement Agreement and this Court's order, the Settlement Administrator initiated an email campaign on September 3, 2019 that continued until September 30, 2019. ECF No. 414-1 ("Finegan Decl.") ¶ 11. Pursuant to the email campaign, a total of 942,628,887 emails were attempted for delivery to all current Yahoo email account holders who had email accounts during the Class Period, and 204,906,633 emails were successfully delivered. Id. In order to remind Settlement Class Members of the Settlement, the Settlement Administrator then undertook a second email campaign that ran from January 27, 2020 until February 5, 2020. Id. ¶ 3 n.1; Fenwick Decl. ¶ 8. The second email campaign resulted in another 183,650,398 deliverable emails. Id.

The Settlement Administrator provided notice in multiple other ways. First, the Settlement Administrator published notice in two widely circulated United States magazines—People and National Geographic. Finegan Decl. ¶¶ 13-14. Second, the Settlement Administrator published notice in eleven widely circulated Israeli newspapers. Id. ¶¶ 16-28. Third, the Settlement Administrator issued online display advertisements that targeted individuals who may have migrated away from Yahoo in the wake of the Data Breaches, which resulted in more than 57 million advertising impressions that directed observers to the Settlement Website. Id. ¶¶ 29-31. Fourth, the Settlement Administrator purchased more than 272 million social media impressions across Twitter, Instagram, Facebook, and numerous Israeli news outlets that also directed observers to the Settlement Website. Id. ¶¶ 33-35. These ads were designed to target Settlement Class Members. The Settlement Administrator estimates that "an estimated 81 percent of targeted Settlement Class Members in the United States were reached by the media program on average approximately 3.2 times and approximately 77 percent of Settlement Class Members in Israel were reached on average approximately 3 times." Id. ¶ 47. All of these alternative routes of communication support a finding that Settlement Class Members received adequate notice of the Settlement.

Settlement Class Members can submit Claim Forms through the Settlement Website or by mail. Id. ¶ 11. To claim Credit Services, Settlement Class Members are required to fill out a Credit Monitoring Services or Alternative Compensation Claim Form. ECF No. 369-11 Ex. 7. If a Settlement Class Member requests Alternative Compensation, the Settlement Class Member is required to confirm the timing and type of the credit monitoring services currently held by the Settlement Class Member. Id. To claim Out-of-Pocket Costs, Settlement Class Members are required to submit a Claim Form for Out-of-Pocket Costs, which does not require documentation for up to five hours of time spent addressing the Data Breaches, but requires basic documentation for reimbursement of other costs. ECF No. 369-10 Ex. 6. Moreover, Settlement Class Members who were previously Paid Users or Small Business Users can submit a Claim Form for Paid Users or Claim Form for Small Business Users, respectively, in order to receive 25% of the amount that they paid per year between January 1, 2012 and December 31, 2016 for Paid User or Small Business services. ECF No. 369-12 Ex. 8; ECF No. 369-13 Ex. 9. Settlement Class Members who are entitled to payments are offered two options to receive payment: direct deposit into the Settlement Class Member's bank account or payment by check. ECF No. 369-10 Ex. 6; ECF No. 369-12 Ex. 8; ECF No. 369-13 Ex. 9.

Settlement Class Members have a variety of methods by which to view relevant documents, contact the Settlement Administrator or Class Counsel, opt out of the Settlement, or object to the Settlement. These methods included mail, telephone, email, and the Settlement Website. For example, the Settlement Website received 8,306,271 visits, and 1,284,498 Claim Forms were submitted online as of June 12, 2020. Fenwick Decl. ¶¶ 4, 11. Additionally, the Settlement Administrator received 45,015 calls on the toll-free number dedicated to providing information to and answering questions from Settlement Class Members. Id. ¶ 5. Of these calls, 29,774 calls were handled by an Interactive Voice Response system created by the Settlement Administrator, and 15,241 calls were handled by live operators. Id.

Notwithstanding these extensive notice efforts, only 1,292,037 Settlement Class Members out of the approximately 194 million Settlement Class Members, or about 0.6% of the total Class, submitted claims as of June 12, 2020. Id. ¶ 11. Nevertheless, the Court concludes that the notice program provided the best notice that is practicable under the circumstances and complied with due process. Notably, "neither Rule 23 nor the Due Process Clause requires actual notice to each individual class member." Briseno v. ConAgra Foods, Inc., 844 F.3d 1121, 1128 (9th Cir. 2017), cert. denied sub nom. ConAgra Brands, Inc. v. Briseno, 138 S. Ct. 313 (2017); see also Shutts, 472 U.S. at 812 ("The notice must be the best practicable, 'reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.'") (quoting Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306, 314-15 (1950)). Courts in this district have approved notice plans nearly identical to the one here as reasonably designed to inform absent class members of the action. See, e.g., Perkins v. Linkedin Corp., No. 13-CV-04303-LHK, 2016 WL 613255 at *7 (N.D. Cal. Feb. 16, 2016) (approving notice plan that provided for email notice and settlement website); see also Briseno, 844 F.3d at 1128 ("Courts have routinely held that notice by publication in a periodical, on a website, or even at an appropriate physical location is sufficient to satisfy due process.").

Seven individuals objected to the Notice: Aaron Miller, Edward and Darlene Orr, Ryan Bowman, Wilbur Hiligh, and Julianna Lownsdale. ECF Nos. 424; 432; 433; 438-1 Ex. F; 438-2 Ex. Q; 440-1 Ex. X. Several objectors argue that the content of the Notice is deficient. Objector Aaron Miller argues that "[t]he FAQs [on the Settlement Website] do not inform the class members that the 'credit monitoring' is being paid out of the settlement fund of $117 million." ECF No. 432. The Court disagrees. The Settlement Website states that "Defendants will also pay for a Settlement Fund of $117.5 million. The Settlement Fund will provide a minimum of two years of Credit Monitoring Services to protect Settlement Class Members from future harm, or an alternative cash payment for those who verify they already have credit monitoring or identity protection." ECF No. 442 at 19 n.19. Moreover, the Notice documents available on the Settlement Website repeat this language. ECF No. 388-1 (Long-Form Notice) at 1; ECF No. 388-2 (Short-Form Notice) at 1; ECF No. 388-3 (Publication Notice) at 1.

Ryan Bowman and Julianna Lownsdale also argue that the Notice Program is deficient. Ryan Bowman argues that "the identity of the intended recipients of the cy pres money is not revealed" and also that the Notice "fails to inform the class of how much really is at stake." ECF No. 424 at 10, 15. Additionally, Julianna Lownsdale argues that the "web design" of the Settlement Website consists of "hostile, hard to parse blocks of text." ECF No. 438-1 Ex. F. These arguments are not well-taken. The proposed cy pres recipients, the Electronic Privacy Information Center and the Center for Democracy and Technology, are both listed in the Settlement Agreement and the Long-Form Notice available on the Settlement Website. Settlement Agmt. ¶ 7.1(c); ECF No. 388-1 (Long-Form Notice) at 1. Further, as the Court previously held, the Notice Plan is "reasonably calculated to apprise Settlement Class Members of the nature of this litigation, the scope of the Settlement Class, the terms of the [] Settlement Agreement, the right of Settlement Class Members to object to the [] Settlement Agreement or exclude themselves from the Settlement Class and the process for doing so, and of the Final Approval Hearing." ECF No. 390 at 5.

Other Settlement Class Members argue that the Notice suffered from procedural flaws. Specifically, Edward and Darlene Orr cite the Northern District of California's Procedural Guidelines for Class Actions, which states that "[a]ll objections will be scanned into the electronic case docket and the parties will receive electronic notices of filings." Procedural Guidance for Class Action Settlement, available at https://www.cand.uscourts.gov/forms/procedural-guidance-for-class-action-settlements/ (last updated Dec. 5, 2018); see also ECF No. 433 at 35. However, the objections were indeed filed on the public docket of the instant case in March 2020, months before the Final Fairness Hearing, which Edward and Darlene Orr attended. Wilbur Hiligh asserts that Settlement Class Members did not receive sufficient time to object or opt out. ECF No. 440-1. Wilbur Hiligh implies that he only received an email on February 4, 2020. Id. at 1 ("Also, claimants were given exactly about one month before the deadline(February 4, 2020 to march 6, 2020) [sic] to . . . exclude oneself from the class action lawsuit."). However, Wilbur Hiligh seemingly refers to the second email campaign conducted by the Settlement Administrator, which was undertaken to remind Settlement Class Members of the Settlement. The first email campaign concluded by September 30, 2019. Finegan Decl. ¶ 11. The rest of the Notice Plan was "substantially completed on October 17, 2019." Id. ¶ 3. Accordingly, Settlement Class Members like Wilbur Hiligh had far longer than a month to object or opt out of the Settlement. Thus, the Court overrules the foregoing objections.

In sum, the Court finds that the Notice Plan was fully implemented and complies with both due process and Rule 23. IV.THE DISTRIBUTION PLAN IS FAIR, REASONABLE, AND ADEQUATE.

The Court finds that the distribution plan is fair, adequate, and reasonable. "A plan of allocation that reimburses class members based on the type and extent of their injuries is generally reasonable." In re Cathode Ray Tube (Crt) Antitrust Litig., No. 07-CV-05944-JST, 2016 WL 721680, at *21 (N.D. Cal. Jan. 28, 2016) (citing In re Citric Acid Antitrust Litig., 145 F. Supp. 2d 1152, 1154 (N.D. Cal. 2001)); see also In re Oracle Sec. Litig., No. 90-CV-00931-VRW, 1994 WL 502054, at *1 (N.D. Cal. June 18, 1994) ("A plan of allocation that reimburses class members based on the extent of their injuries is generally reasonable."). For this reason, "an allocation formula need only have a reasonable, rational basis, particularly if recommended by experienced and competent counsel." Rieckborn v. Velti PLC, No. 13-CV-03889-WHO, 2015 WL 468329, at *8 (N.D. Cal. Feb. 3, 2015) (quoting Vinh Nguyen v. Radient Pharm. Corp., No. 11-CV-00406, 2014 WL 1802293, at *5 (C.D. Cal. May 6, 2014)).

The distribution plan contemplated by the Settlement Agreement passes muster under these standards. The plan is structured to fit the various injuries that different Settlement Class Members face. First and foremost, as discussed, the Settlement requires Yahoo to undertake numerous Business Practice Changes designed to increase information security and that directly relate to the inadequacies alleged by Plaintiffs. Settlement Agmt. ¶¶ 2.1-2.4. All Settlement Class Members benefit from this form of relief, irrespective of whether they ultimately submit a Claim Form.

Settlement Class Members can elect to receive additional relief through a claims process that draws from a $117.5 million common Settlement Fund. Centrally, Settlement Class Members may receive credit monitoring by submitting a Credit Services or Alternative Compensation Claim Form. Id. ¶¶ 4.1-4.10. The emphasis on this form of relief is logical because it is directly responsive to the injury that resulted from the Data Breaches. However, the distribution plan recognizes that some Settlement Class Members may already have credit monitoring and therefore allows these individuals to claim an alternative cash payment so long as they provide certain information about their current credit monitoring services. Id. ¶ 5.1. Settlement Class Members may also request reimbursement for Out-of-Pocket Costs incurred in connection with the Data Breaches. Id. ¶ 6.1. Out-of-Pocket Costs include reimbursement for losses and preventative measures undertaken in response to the Data Breaches and are capped at $25,000 per Settlement Class Member. Id. ¶ 6.3. Out-of-Pocket Costs also include reimbursement for time spent responding to the Data Breaches, at a minimum rate of $25 per hour. Id. ¶ 1.29. In order to receive payment for Out-of-Pocket Costs, Settlement Class Members must submit an Out-of-Pocket Costs Claim Form that includes documentation to support the claimed Out-of-Pocket Costs. Id. ¶ 1.30. However, Settlement Class Members are entitled to reimbursement for up to five hours of undocumented time spent to respond to the Data Breaches. Id. ¶ 1.29. Finally, Settlement Class Members who were Small Business Users or Paid Users during the Class Period may submit Small Business User Claim Forms or Paid User Claim Forms to recover up to 25% of the amount paid to Yahoo for the respective services. Id. ¶¶ 6.5, 6.7. Small Business Users are capped at $500 reimbursement per year. Id.

Following initial distributions, the Settlement Fund is used to first increase the amount of Alternative Compensation to Settlement Class Members who selected that form of relief, up to an amount of $358.80. Id. ¶ 7.1. Once that cap is reached, then the Settlement Fund will be used to purchase additional months of Credit Services for Settlement Class Members who selected that form of relief. Id. Once no additional months can be purchased, the final residue of the Settlement Fund will be divided into two equal portions and distributed cy pres to the Electronic Privacy Information Center (EPIC) and the Center for Democracy & Technology. Id. Under no circumstances will any amount revert to Yahoo.

Two objectors raise concerns about the distribution plan. First, objector Ryan Bowman argues that the Settlement is inadequate because the Settlement does not contain a large enough cy pres component. ECF No. 424 at 6. As discussed, under the Settlement, cy pres is available only to the extent that the Settlement Fund contains residual funds after pro rata increases to Alternative Compensation and purchases of additional months of Credit Services for Settlement Class Members. Id. Bowman's argument that the Settlement should include a larger cy pres component is not well-taken, as "cy pres is a disfavored substitute for distribution of benefits directly to class members." In re Cathode Ray Tube (Crt) Antitrust Litig., No. 07-CV-05944-JST, 2016 WL 3648478, at *18 (N.D. Cal. July 7, 2016). Moreover, the recipient that Bowman appears to propose as a new cy pres recipient, Pennsylvania Outdoor Veterans, Inc., bears no connection to the harm suffered by Settlement Class Members in the instant case. ECF No. 424 at 16-17; see Nachshin v. AOL, LLC, 663 F.3d 1034, 1040 (9th Cir. 2011) (explaining that cy pres distribution should "(1) address the objectives of the underlying statutes, (2) target the plaintiff class, or (3) provide reasonable certainty that any member will be benefitted").

Second, objector Audun Huslid complains that the Settlement requires documentation of Out-of-Pocket Costs without sufficiently explaining the level of documentation required. ECF No. 438-2 Ex. P at 2. Huslid also argues that there are insufficient safeguards to ensure that the Settlement Administrator is impartial as to the distribution of Out-of-Pocket Costs. Id. The Court disagrees as to both points. As to the first point, the Settlement Agreement indicates that the documentation requirement for Out-of-Pocket Costs is limited to "documentation [that] should naturally exist and has been retained or is readily obtainable." Settlement Agmt. ¶ 6.1; see also In re Equifax Customer Data Sec. Breach Litig., No. 1:17-MD-2800-TWT, 2020 WL 256132, at *8 (N.D. Ga. Jan. 13, 2020) ("Those claiming out-of-pocket losses must supply documentation of their losses, but such requirements are routine and likely less stringent than a plaintiff would have to present during discovery or trial. Some documentation requirements are necessary to ensure that the settlement fund is used to pay legitimate claims."). Moreover, the Out-of-Pocket Costs Claim Form provides numerous concrete examples of supporting documentation that satisfy the requirement, such as receipts for professional fees incurred and account statements with unauthorized charges highlighted. ECF No. 369-10 Ex. 6 at 5.

As to the second point, in the event of any deficiencies in documentation, the Settlement Administrator must "notify the Settlement Class Member of the deficiencies and give the Settlement Class Member thirty (30) days to cure the deficiencies." Settlement Agmt. ¶ 6.2. This notice-giving requirement constrains the Settlement Administrator's ability to make arbitrary or biased decisions. Indeed, no objector, including Audun Huslid, argues that the Settlement Administrator has actually wrongfully denied any claims for Out-of-Pocket Costs. Moreover, the Settlement Administrator is an experienced, repeat participant in class action settlements, that "has provided notification and/or claims administration services in more than 2,500 cases." Fenwick Decl. ¶ 2. Thus, the Court overrules the foregoing objections.

The Court therefore finds that the distribution plan is fair, reasonable, and adequate.

V. THE REQUESTED ATTORNEYS' FEES ARE TOO HIGH.

"Where," as here, "a settlement produces a common fund for the benefit of the entire class, courts have discretion to employ either the lodestar method or the percentage-of-recovery method." In re Bluetooth Headset Prod. Liab. Litig., 654 F.3d 935, 942 (9th Cir. 2011). "[T]he choice between lodestar and percentage calculation depends on the circumstances, but . . . 'either method may . . . have its place in determining what would be reasonable compensation for creating a common fund.'" Six (6) Mexican Workers v. Arizona Citrus Growers, 904 F.2d 1301, 1311 (9th Cir. 1990) (third alteration in original) (quoting Paul, Johnson, Alston & Hunt v. Graulty, 886 F.2d 268, 272 (9th Cir. 1989)). To guard against an unreasonable result, the Ninth Circuit encourages district courts to "cross-check[] their calculations against a second method." In re Bluetooth, 654 F.3d at 944; see also Vizcaino v. Microsoft Corp., 290 F.3d 1043, 1050-51 (9th Cir. 2002) (applying a lodestar cross-check to ensure the percentage-of-recovery method yielded a reasonable result).

Where the percentage-of-recovery method is employed, it is well established that 25% of a common fund is a presumptively reasonable amount of attorneys' fees. See, e.g., In re Bluetooth, 654 F.3d at 942 ("[C]ourts typically calculate 25% of the fund as the 'benchmark' for a reasonable fee award, providing adequate explanation in the record of any 'special circumstances' justifying a departure."); Six (6) Mexican Workers, 904 F.2d at 1311 ("[W]e established 25 percent of the fund as the 'benchmark' award that should be given in common fund cases."). That said, "[t]he 25% benchmark rate, although a starting point for analysis, may be inappropriate in some cases." Vizcaino, 290 F.3d at 1048. Upward departures may be warranted in particular circumstances, while downward departures may be warranted where there is no "realistic risk of nonrecovery." Perkins, 2016 WL 613255, at *14 (quoting In re Quantum Health Res., Inc., 962 F. Supp. 1254, 1257-58 (C.D. Cal. 1997)).

Under the lodestar method, a "lodestar figure is calculated by multiplying the number of hours the prevailing party reasonably expended on the litigation (as supported by adequate documentation) by a reasonable hourly rate for the region and for the experience of the lawyer." In re Bluetooth, 654 F.3d at 941 (citing Staton v. Boeing Co., 327 F.3d 938, 965 (9th Cir. 2003)). The district court may adjust this lodestar figure "upward or downward by an appropriate positive or negative multiplier reflecting a host of 'reasonableness' factors." Id. at 941-42.

Whatever method a court chooses, the decision "must be supported by findings that take into account all of the circumstances of the case." Vizcaino, 290 F.3d at 1048. The Ninth Circuit has approved a number of factors which may be relevant to the district court's determination: (1) the results achieved; (2) the risk of litigation; (3) the skill required and the quality of work; (4) the contingent nature of the fee and the financial burden carried by the plaintiffs; and (5) awards made in similar cases. Id. at 1048-50.

Here, Plaintiffs seek the application of the percentage-of-recovery method. ECF No. 416 at 4 ("As a preliminary matter, the nature of this action warrants the application of percentage-of-the-fund approach as the principal method determining the reasonableness of Settlement Class Counsel's fee request."). According to Plaintiffs, the percentage-of-recovery method is appropriate as the principal method here because "the novel and complex nature of this data breach action affords a dearth of established precedent and other guidance by which to employ the lodestar method." Id. Class Counsel request $30 million in attorneys' fees. This is the maximum amount allowed by the Settlement Agreement. Settlement Agmt. ¶ 12.1.

The Court disagrees that percentage-of-recovery represents the best principal method in the instant case. Instead, having overseen this case for four years, the Court finds that justice would be best served by applying the lodestar method—i.e., tying the fee awards for Class Counsel to the actual hours they reasonably expended on this litigation and then selecting a multiplier.

First, and most importantly, the Ninth Circuit has made clear that in "megafund" cases, such as the instant case, courts should "employ the lodestar method" or depart downward if rote application of the 25% benchmark "would yield windfall profits for class counsel in light of the hours spent on the case." In re Bluetooth, 654 F.3d at 942. Here, rote application of the 25% benchmark would indeed produce a windfall for Class Counsel because the recovery in the instant case is largely a function of the size of the Settlement Class. See also Gutierrez v. Wells Fargo Bank, N.A., No. C 07-05923 WHA, 2015 WL 2438274, at *4 (N.D. Cal. May 21, 2015) (rejecting class counsel's request to apply the percentage-of-recovery method to a $203 million restitution award and deploying the lodestar method first because "blindly adopting the 25-percent benchmark . . . would result in a windfall to class counsel"). If the Court awarded the 25% benchmark, Class Counsel would receive $29,375,000, which amounts to roughly $10 million more than Plaintiffs' proposed lodestar.

Courts have previously deployed the lodestar method when "the vast recovery is not entirely attributable to class counsel's skill but partly due to the sheer size of the class." Id. at *5; see also id. ("When the large size of the recovery is due to the large size of the class rather than counsel's specialized skill and efforts, use of the lodestar method may be more appropriate."). Here, the Settlement Class is far larger than the classes involved in other major data breach cases. Indeed, Home Depot involved a class size of 52 million, Anthem involved a class size of 79 million, Target involved a class size of 110 million, and Equifax involved a class size of 147 million. Mot. for Atty's Fees at 6-7. By contrast, the parties report that the Settlement Class in the instant case consists of 194 million Settlement Class Members and is therefore roughly 30% larger than the class in Equifax, the next closest case.

Even this 194 million Settlement Class number, however, may be too low. This number is a "reasonably plausible" estimate, crafted just for this Settlement and based in large part on the assumption of numerous "heuristics." ECF No. 369-26 ¶¶ 6, 11. However, Yahoo touted far larger numbers in the past. For instance, Yahoo CEO Marissa Mayer's July 25, 2016 press release announcing Verizon's acquisition of Yahoo claimed that Yahoo reaches "a global audience of more than 1 billion monthly active users." Press Release, Verizon, Verizon to Acquire Yahoo's Operating Business (July 25, 2016), available at https://www.verizon.com/about/news/verizon-acquireyahoos-operating-business. Further, in its 2016 Annual Report to the SEC, filed in March 2017, Yahoo stated that it had "[m]ore than 650 million [] monthly users." Yahoo, 2016 Annual Report (Form 10-K), at 15 (Mar. 1, 2017).

The Settlement Fund also results in a far lower per-capita recovery for Settlement Class Members than in comparable cases. For instance, in Anthem, the counsel achieved recovery for the class amounted to $1.46 per class member. ECF No. 254-9 Ex. 96 ("Ratner Decl.") ¶ 31. Here, by contrast, the per-capita recovery is roughly $0.60 per Settlement Class Member. In light of this disparity, the Court is therefore convinced that the size of the Settlement Fund is largely a function of the size of the Settlement Class, and "not entirely attributable to class counsel's skill." Gutierrez, 2015 WL 2438274, at *5.

Other factors support the decision to use lodestar as the primary method of analysis. First, the Court notes that Class Counsel has seemingly switched positions on this question. In connection with the first motion for preliminary approval, Plaintiffs represented to the Court that "[t]he amount of Attorneys' Fees was negotiated based on MDL and JCCP Counsel's lodestar, including projected additional amounts for settlement approval and appeals and a multiplier and not as a percentage of a common fund." ECF No. 338-1 at 17; see also ECF No. 357 at 19 ("In their supplemental filing, class counsel explains that attorneys' fees were only calculated based on the lodestar."). In other words, in the previous motion for preliminary approval, Plaintiffs did not deploy the percentage-of-recovery method even as a cross-check, but Plaintiffs now seek to use percentage-of-recovery as the principal method to assess attorneys' fees. It is not clear to the Court why Class Counsel's position has changed.

Second, Plaintiffs' main argument in support of percentage-of-recovery is that there is a "dearth of established precedent and other guidance" for a case of this nature. ECF No. 416 at 4. Not so. In fact, as the Court explains below, several of the Court's own precedents "addressed key issues in the current case." ECF No. 357 at 16. All of Plaintiffs' other statements in favor of the percentage-of-recovery method simply amount to generic descriptions of the relative strengths of the percentage-of-recovery method, detached from any connection to the instant case. ECF No. 416 at 4 (citing 5 Newberg on Class Actions §§ 15:62, 15:65 (5th ed. 2018)). The lodestar method has important advantages of its own, however. For instance, the lodestar method permits consistency "according to regular variables (timing and billing rates) that can be compared across cases." 5 Newberg on Class Actions § 15:65. The Court previously relied on this feature of the lodestar method to conclude that Plaintiffs' previously asserted lodestar appeared "unreasonably high" in light of the existence of a lower lodestar in a separate "novel and highly complex" case. ECF No. 357 at 17. In light of the Court's previous analysis, the Court believes that this feature of the lodestar method provides an important advantage over the percentage-of-recovery method in the instant case.

As such, the Court concludes that using the lodestar method with a percentage-of-recovery cross-check would achieve the fairest and most reasonable result in this case. The Court now performs that analysis below.

A. Lodestar Method

Under the lodestar method, a "lodestar figure is calculated by multiplying the number of hours the prevailing party reasonably expended on the litigation (as supported by adequate documentation) by a reasonable hourly rate for the region and for the experience of the lawyer." In re Bluetooth, 654 F.3d at 941 (citing Staton v. Boeing Co., 327 F.3d 938, 965 (9th Cir. 2003)). Although "the lodestar figure is 'presumptively reasonable,' the court may adjust it upward or downward by an appropriate positive or negative multiplier reflecting a host of reasonableness factors." Id. at 941-42 (citations and internal quotation marks omitted).

1. Billing Rates

Having reviewed the billing rates for the attorneys, paralegals, and litigation support staff at each of the firms representing Plaintiffs in this case, the Court finds that these rates are reasonable in light of prevailing market rates in this district and that counsel for Plaintiffs have submitted adequate documentation justifying those rates. See, e.g., In re High-Tech, 2015 WL 5158730, at *9 (approving "billing rates for partners rang[ing] from about $490 to $975," "billing rates for non-partner attorneys, including senior counsel, counsel, senior associates, associates, and staff attorneys, rang[ing] from about $310 to $800, with most under $500," and "billing rates for paralegals, law clerks, and litigation support staff rang[ing] from about $190 to $430, with most in the $300 range"); see also Miller Decl. ¶¶ 56-59 (concluding that "counsel's reported hourly rates are reasonable and in line with rates charged in similar cases").

The Court previously opined on the lodestar figures in the instant case in connection with Plaintiffs' first motion for preliminary approval. In connection with that motion, Class Counsel claimed to have spent 38,278.81 hours on the litigation, with a lodestar figure of $22,069,890.30. ECF No. 337-6 at 3. The Court explained that a comparison between the lodestar in the instant case to the lodestar claimed in a novel and highly complex case, High-Tech, suggested that the lodestar numbers were unreasonably high. Because of the Court's concern in Anthem that contract attorneys who primarily conducted document review, were paid $25 to $35 per hour, but were billed at rates as high as $595 per hour, MDL Counsel and JCCP Counsel in the instant case retroactively capped the document review rate for any lawyer who performed document review at $240 per hour. Mot. for Atty's Fees at 12; compare, e.g., ECF No. 337-6 at ECF 2, ECF 9 (explaining that lodestar calculation still required "a process of rate normalization and standardization," and listing a particular associate's billing rate as $450 per hour), with ECF No. 412-35 Ex. A (listing same associate's billing rate as $240 per hour for full amount billed to the instant case, which comprised 282 hours of document review). JCCP Counsel ultimately reduced their lodestar from $3,768,273 to $2,906,661. ECF No. 416-6 ("Colaw Decl.") ¶ 55. Similarly, MDL Counsel reduced their lodestar from $18,304,817.30 to $16,518,130. Mot. for Atty's Fees at 12. This reduction produced a combined total of 40,047.40 hours and a lodestar of $19,424,791.

In the instant case, the billing rates for partners range from about $450 to $900, depending on seniority level. See ECF No. 474-6 Ex. A (listing hourly billing rate for all MDL Case billers); ECF No. 473-3 Ex. A (listing hourly billing rate for all JCCP Case billers). The billing rates for non-partner attorneys, including of counsel, associates, and staff/project attorneys, range from about $160 to $850, with most under $500. See ECF No. 474-6 Ex. A; ECF No. 473-3 Ex. A. The billing rates for paralegals range from $50 to $380. See ECF No. 474-6 Ex. A; ECF No. 473-3 Ex. A. Finally, the billing rates for several investigators who performed litigation support tasks range from $100 to $495. See ECF No. 474-6 Ex. A; ECF No. 473-3 Ex. A. The Court finds that these billing rates are reasonable and in line with amounts charged in similar cases. See, e.g., In re Anthem, 2018 WL 3960068, at *17 (finding billing rates appropriate when "the billing rates for partners range[d] from about $400.00 to $970.00," "[t]he billing rates for non-partner attorneys, including senior attorneys, of counsel, and associates, range[d] from about $185.00 to $850.00, with most under $500.00," and "[t]he billing rates for paralegals, law clerks, and litigation support staff range from about $95.00 to $440.00, with most under $300.00"). At the Final Fairness Hearing, the Court specifically inquired about a summer associate. The Court finds the rate of $200 to be reasonable for this biller. ECF No. 474-3; see also In re Anthem, 2018 WL 3960068, at *17.

Moreover, as noted, any amount of time that any billers spent on document review or coding was billed at $240 or lower. ECF No. 416-2 Ex. 2 ("Yanchunis Decl.") ¶ 48. Further, following the Final Fairness Hearing, the Court ordered that "for any individual who is listed as a 'Staff/Project Attorney' or is paid hourly, Plaintiffs shall identify the individual's salary and/or hourly wage" in a subsequent filing. ECF No. 472. The Court has reviewed the relevant salaries and hourly wages, and the Court finds the mark-ups for these billers to be reasonable. See In re Anthem, 2018 WL 3960068, at *20 (noting that "the Court finds that $240.00 per hour adequately accounts for the qualifications and experience of the contract and staff attorneys as well as the largely document-review work they performed").

2. Hours

The hours component of the lodestar is comprised of "the number of hours the prevailing party reasonably expended on the litigation." In re Bluetooth, 654 F.3d at 941 (citing Staton, 327 F.3d at 965). Accordingly, the Court may excise from the calculation any hours that are duplicative, excessive, or otherwise unnecessary. See Chalmers, 796 F.2d at 1210; see also Hensley, 461 U.S. at 434 (explaining that district courts should remove "hours that are excessive, redundant, or otherwise unnecessary"). The Court acknowledges that it "may not attempt to impose its own judgment regarding the best way to operate a law firm, nor to determine if different staffing decisions might have led to different fee requests." Moreno v. City of Sacramento, 534 F.3d 1106, 1115 (9th Cir. 2008). At the same time, however, the Ninth Circuit has explained that "district courts have a duty to ensure that claims for attorneys' fees are reasonable, and a district court does not discharge that duty simply by taking at face value the word of the prevailing party's lawyer for the numbers of hours expended on the case. Rather, a district court must ensure that the winning attorneys have exercised billing judgment." Vogel v. Harbor Plaza Ctr., LLC, 893 F.3d 1152, 1160 (9th Cir. 2018) (emphasis in original and quotation marks and citations omitted). As in other contexts, the party seeking fees "bear[s] the burden of showing the time spent and that it was reasonably necessary to the successful prosecution of [the] claims." Frank Music Corp. v. Metro-Goldwyn-Mayer Inc., 886 F.2d 1545, 1557 (9th Cir. 1989); see also Webb v. Bd. of Educ. of Dyer Cty., Tenn., 471 U.S. 234, 242 (1985) ("[T]he party seeking an award of fees has the burden of submitting 'evidence supporting the hours worked and rates claimed.'" (quoting Hensley, 461 U.S. at 433)); Harris v. Maricopa Cty. Superior Court, 631 F.3d 963, 971-72 (9th Cir. 2011) ("[I]n cases involving attorneys fees generally, '[t]he burden of establishing entitlement to an attorneys fees award lies solely with the claimant.'" (citation omitted)).

At the Final Fairness Hearing, Class Counsel stated they have spent 40,047.40 hours on the litigation, which generated a total lodestar of $19,424,791. Yanchunis Decl. ¶ 45. Class Counsel then added to this total 1,500 "anticipated future hours yielding additional lodestar of $753,862." Id. That produced a total lodestar of $20,178,653. Id. However, the Court informed Class Counsel that the new lodestar figure included work that should have been excluded.

Specifically, in view of the Court's concerns with efficiency in the instant case, on February 1, 2018, the Court ordered that "[o]ther than the Plaintiffs' Executive Committee, no other law firms shall work on this MDL without prior approval of the Court." ECF No. 208. On May 7, 2018 and June 20, 2018, the Court then granted Plaintiffs permission to allow a total of seven attorneys from outside Plaintiffs' Executive Committee to "attend and help prepare their respective clients for their depositions by Defendants." ECF Nos. 233, 241. Plaintiffs have never sought the Court's approval for any additional billers or any additional work by the seven approved attorneys.

Notwithstanding this fact, Plaintiffs included in their lodestar calculation 264.90 hours of work performed after the Court's February 1, 2018 order but before the Court granted approval to any new biller. ECF No. 474-3 ¶ 2. These 264.90 hours produced a lodestar of $180,886.50. Id.

Moreover, Class Counsel billed an additional 106.74 hours for a lodestar of $73,834.00 for work by attorneys who were never authorized to work on the case and for unauthorized work by the seven approved attorneys. ECF Nos. 233, 241, 474-3 ¶ 3. Some of this unapproved work came after the Court's January 30, 2019 order denying preliminary approval, in which the Court specifically listed the attorneys that the Court had approved and admonished Plaintiffs that "Class counsel has not made any further motions for approval of additional counsel in the instant MDL case." ECF No. 357 at 14.

After the Final Fairness Hearing, Plaintiffs agreed to reduce the lodestar by the foregoing amounts, which resulted in a further reduction of 371.64 hours and $254,720.50, for a new total of roughly 39,675.76 hours and an updated lodestar of $19,170,070.50. The addition of Plaintiffs' 1,500-hour lodestar for anticipated future work, $753,862, would result in a total lodestar of $19,923,932.50.

Having reviewed the billing records for the attorneys, paralegals, and litigation support staff at each of the firms representing Plaintiffs in this case, the Court has some questions about the efficiency of time spent on this litigation. In the instant case, prior to the Settlement, Class Counsel filed two consolidated complaints that each alleged thirteen California law claims, withstood two substantially overlapping motions to dismiss, litigated two discovery motions, deposed seven percipient fact witnesses and corporate designees, and defended the depositions of nine named Plaintiffs and four experts. Mot. for Atty's Fees at 1. The parties settled before Plaintiffs filed an opposition to Defendants' Daubert motions or a reply in support of class certification. Plaintiffs did not depose Defendants' experts. The parties settled at least six months before the fact discovery cut-off, and thus significant discovery was not conducted in the case. Case Management Order. Plaintiffs then conducted three additional "confirmatory discovery depositions" after the Court denied preliminary approval of the first settlement, in order to support the new Settlement. Mot. for Atty's Fees at 1. For this work, Plaintiffs request attorneys' fees of $30 million.

Relative to other cases, this low volume of work raises questions about the efficiency of Plaintiffs' billing, particularly in light of recent filings. Indeed, Plaintiffs claim to have spent 409.20 hours from January 15, 2020 to May 31, 2020, for a total of total of $274,401.40. ECF No. 474-13 ¶ 7. At the Final Fairness Hearing, Class Counsel represented that this additional time was billed from February 1, 2020, the day after the motion for final approval and motion for attorneys' fees were filed, to June 16, 2020, the date of the Final Fairness Hearing. ECF No. 475 at 96:25-97:4. However, even including the amount of time spent in connection with the motion for final approval, 409.20 hours seems high. Moreover, the billing records raise questions about whether tasks performed by Class Counsel could have been performed more efficiently and at less cost to the Settlement Class. For example, lead partners and partners billed $800 to $900 per hour to assist Settlement Class Members with filing their Claim Forms. ECF No. 474-16 at 1-3. Plaintiffs do not explain why the Settlement Administrator or associates and paralegals could not provide such filing assistance. Another example is a senior attorney who billed $800 per hour to review privilege logs for 284.50 hours. ECF No. 474-14 at 6.

Moreover, Class Counsel spent hundreds of hours in connection with the first settlement and motion for preliminary approval, which the Court rejected as inadequate for many reasons, which the Court discusses later in this Order. As explained below, counsel should not have made such errors. Although the Court could consider reducing the lodestar for the inadequate first settlement, the Court does not.

In addition to the lodestar for past work, Plaintiffs also request that the Court include a 1,500-hour lodestar for anticipated future work for a total of $753,862. Mot. for Atty's Fees at 23. At the Final Fairness Hearing, the Court asked Plaintiffs to provide concrete details about the scope of this anticipated work. Plaintiffs have since done so, but in their submission to the Court, Plaintiffs have now inexplicably increased the requested future lodestar from $753,862 to $819,445 with no explanation. ECF No. 474-9.

In any event, the Court believes that the descriptions of future work are speculative and inappropriate. For instance, as in past billing records, lead partners at numerous law firms who will bill $850 to $900 per hour anticipate "[r]espond[ing] to class members and claimant inquiries and assist[ing] with claim filing as requested." Id. at 1; see also id. at 1, 2 (listing "[o]ngoing assistance to class members," "continuing communications with class members relating to claims filing issues," and "[c]ommunicate with clients and potential class members seeking information regarding settlement or to file a claim" as tasks to be performed by lead partners at firms). It is entirely unclear why lead partners, who will bill $850 to $900 per hour for what is apparently predicted to be over a hundred hours, must perform tasks of this nature, as opposed to the Settlement Administrator, associates, or paralegals. Further, the Claims Period ended yesterday, which should have limited the amount of additional work of this nature required by Class Counsel. Settlement Agmt. ¶ 1.9.

Additionally, Plaintiffs include in their estimate over 300 hours, billed mostly at a rate of $900 per hour, exclusively spent on "additional work with respect to any appeal(s) of the Court's final approval." See, e.g., ECF No. 474-9 at 2 (listing two partners at Robbins Geller Rudman & Dowd LLP who will bill 100 hours each at $900 per hour, exclusively consisting of appellate work); see also id. at 1 (listing lead partner at Casey Gerry who will bill 75 hours at $900 per hours in providing "[a]ssistance with appeals").

Still more attorneys, including more senior partners who bill at a rate of $850 or $900 per hour, seemingly anticipate spending even more time on appellate work, though the precise quantity is left unspecified. See id. at 1-2 (listing "[r]eview and edit any additional briefing required," "[w]ill perform additional work with respect to any appeal(s) of the Court's final approval of the proposed Settlement," "if applicable, contribute to appellate briefing" in block narrative entries). It is unclear at this juncture whether any appeals will follow, much less complex appeals that require this kind of time investment from senior partners. The Court has overruled all objections to the Settlement as unmeritorious as outlined in this Order.

The lodestar for anticipated future work consists overwhelmingly of claims filing assistance and appeals work billed at $850 to $900 per hour, which, as explained, is highly overstated. However, the Court acknowledges that certain tasks will continue to occupy Class Counsel following final approval. Indeed, pursuant to the Settlement Agreement, Class Counsel must work with a Third Party Assessor to review annual audits of Yahoo's information security program for four years. Settlement Agmt. ¶ 2.3. Accordingly, for the purposes of the lodestar calculation, the Court will reduce the anticipated future lodestar requested by Plaintiffs to $350,000, which the Court deems to be a more reasonable estimate of future fees. See In re Equifax, 2020 WL 256132, at *39 (including future lodestar because "[t]he Court finds that th[e] estimate is reasonable").

In sum, the Court has reviewed and approves Plaintiffs' total of 40,084.96 hours⁸ as reasonable, which, including the reduced future lodestar, corresponds to a lodestar total of $19,794,471.90.

8 This figure is the sum of the 39,675.76 hours Class Counsel spent up to and including January 15, 2020, and the 409.20 hours Class Counsel spent since then.

3. Multiplier

As noted above, the Court may "adjust" the lodestar figures "upward or downward by an appropriate positive or negative multiplier reflecting a host of 'reasonableness' factors, 'including the quality of representation, the benefit obtained for the class, the complexity and novelty of the issues presented, and the risk of nonpayment.'" In re Bluetooth, 654 F.3d at 941-42 (quoting Hanlon v. Chrysler Corp., 150 F.3d 1011, 1029 (9th Cir. 1998)). "Foremost among these considerations, however, is the benefit obtained for the class." Id. at 942. Plaintiffs request an attorneys' fee award of $30 million. Mot. for Atty's Fees at 1. This request would require payment of the lodestar plus an additional roughly $10.3 million, which is more than half the size of the lodestar, and would provide an unreasonable windfall to Class Counsel. For the reasons stated below, the Court instead concludes that a positive multiplier of 1.15 is appropriate for Class Counsel.⁹

9 In addition to the factors outlined below, the Court has also considered, to the extent relevant, the other factors listed in Kerr v. Screen Extras Guild, Inc., 526 F.2d 67, 70 (9th Cir. 1975), such as customary fees, the "undesirability" of the case, and the nature and length of the professional relationship with the client. Many of these factors are "subsumed within the initial calculation of hours reasonably expended at a reasonable rate." In re Bluetooth, 654 F.3d at 942 n.7 (internal quotation marks omitted).

a. The Results Achieved

First, the Court considers the overall result and benefit to the Settlement Class. This factor has been called "the most critical factor in granting a fee award." In re Omnivision Techs., Inc., 559 F. Supp. 2d 1036, 1046 (N.D. Cal. 2008); see also Hensley v. Eckerhart, 461 U.S. 424, 436 (1983) (noting that "the most critical factor" in determining the reasonableness of an attorneys' fees request is "the degree of success obtained"). Here, the Court finds that the result and benefit obtained for the Settlement Class are fair, reasonable, and adequate, but unexceptional.

As an initial matter, in terms of absolute numbers, Plaintiffs tout the fact that the Settlement Fund is $117.5 million, which makes it "the second largest fund in data breach history." Mot. for Atty's Fees at 6. Plaintiffs report that the size of the Equifax consumer settlement is $380.5 million, which puts the Yahoo Settlement Fund far below the Equifax consumer settlement. In re Equifax, 2020 WL 256132, at *2 ("Equifax will pay $380,500,000 into a fund for class benefits, attorneys' fees, expenses, service awards, and notice and administration costs . . . ."). However, the total size of the funds in Equifax will likely range from $386 million to $511 million, several times the size of the Settlement Fund in the instant case. Specifically, the $380.5 million awarded in Equifax to the consumer class is the "minimum settlement fund," and might increase by "up to an additional $125,000,000" depending on the out-of-pocket costs claimed in that case. Id. at *2, 31. Moreover, as discussed, the Equifax consumer settlement was separate from a pending settlement with financial institutions, which contemplates an additional payment of $5.5 million to the financial institutions. Financial Institutions' Memorandum of Law in Support of their Unopposed Motion for Preliminary Approval of Class Action Settlement at 19, 25, In re Equifax, No. 17-MD-2800-TWT (N.D. Ga. May 15, 2020), ECF No. 1107-1 (seeking preliminary approval of settlement of $5.5 million on behalf of "thousands of financial institutions").

Further, roughly two years ago, the Court approved a settlement fund of $115 million in Anthem, another data breach case, which was slightly below the $117.5 million Settlement Fund in the instant case, yet had only 79 million class members in contrast to the 194 million Settlement Class Members involved here. In re Anthem, 2018 WL 3960068, at *7 ("Here, the starting baseline is the $115 million Settlement Fund.").

Perhaps in light of the foregoing, Plaintiffs point to Home Depot and Target as additional comparators for the recovery in the instant case. Mot. for Atty's Fees at 6. In Home Depot, a consumer class of 52 million received a $27.2 million settlement fund,¹⁰ and in Target, a consumer class of 110 million received a $23.3 million settlement fund. In re Anthem, 2018 WL 3960068, at *10. However, the settlement figures Plaintiffs cite in Home Depot and Target represent only a small fraction of what Target and Home Depot ultimately paid as a result of the data breaches.

10 Plaintiffs assert that the amount achieved in Home Depot is $28.4 million, but the Home Depot court itself found the relevant figure to be "approximately $27 million." Order Granting Consumer Plaintiffs' Motion for Service Awards, Attorneys' Fees and Litigation Expense Reimbursement at 1, 4, In re The Home Depot, Inc., No. 14-MD-02583-TWT (N.D. Ga. Aug. 23, 2016), ECF No. 261.

The Court is unaware of the total number of settlements that Home Depot ultimately paid, but the combination of only the public settlements yields a total settlement amount of at least $192.2 million, far more than the $117.5 Settlement Fund here. Specifically, in Home Depot, in addition to the $27.2 million consumer class settlement, there was a separate settlement with a class of roughly 11,000 financial institutions for $25 million with the possibility of an additional $2.25 million. Final Order and Judgment, In re The Home Depot, No. 14-MD-02583-TWT (N.D. Ga. Sept. 22, 2017), ECF No. 343; see also id. ECF No. 337 at 1 (noting the existence of "roughly 11,000 class members"). Outside of court, Home Depot also negotiated settlement agreements with Visa and MasterCard, to whom Home Depot paid $134.5 million. Id. at 5. Further, pursuant to further settlements, "Home Depot paid still more to American Express and Discover." Id.; see also id. ECF No. 337-3 ¶ 7 (noting that Home Depot "significantly pare[d] down this litigation" by entering into separate settlements out of court). In total, based on public records, Home Depot paid "more than $140 million" in out-of-court settlements. Id. Because Home Depot settled with American Express, Discover, and other credit card companies off the public record, the Court does not know the total amount ultimately paid by Home Depot to individuals and entities affected by the data breach.

Similarly, a combination of only the public settlements in Target yields a total amount of at least $129.3 million, also more than the $117.5 Settlement Fund here. In Target, in addition to the $23.3 million consumer class settlement, there was a $39 million settlement with a separate class of roughly 6,510 financial institutions. Memorandum of Law in Support of Financial Institution Plaintiffs' Motion for Final Approval of Class Action Settlement at 2, In re Target, No. 14-MD-02522-PAM (D. Minn. Apr. 11, 2016), ECF No. 745. Further, Target separately settled out-of-court with credit card companies. For example, Target settled with Visa for $67 million. Id. ECF No. 562 (advising the court of settlement between Target and Visa for approximately $67 million). Like Home Depot, Target settled with other credit card companies off the public record, which again means that the Court's estimate is conservative.

Moreover, the foregoing data breach cases focused on one data breach, but the instant case involves multiple Data Breaches. Indeed, Yahoo's data was breached in 2012, 2013, 2014, 2015, and 2016, and Yahoo denied any knowledge of unauthorized access of personal data in its filings with the SEC and delayed notification to users even when it had contemporaneous knowledge of the breaches. See SACC ¶¶ 32-162 (outlining allegations). For example, on September 9, 2016, in an SEC filing regarding Verizon's purchase of Yahoo, Yahoo represented that Yahoo knew of no incidents of unauthorized access of personal data that might adversely affect the Verizon acquisition of Yahoo. Yahoo, Preliminary Proxy Statement (Schedule 14(A), at Exhibit A-18 (Sept. 9, 2016), available at https://www.altaba.com/static-files/ad5f11da-0a78-4f3e-90f8-dd204c1978fb. However, thirteen days later, on September 22, 2016, Yahoo publicly disclosed the 2014 data breach. ECF No. 196 ¶ 126. In the announcement, Yahoo claimed that it learned of the 2014 data breach during a "recent investigation." Yahoo Security Notice September 22, 2016, available at https://help.yahoo.com/kb/%20SLN28092.html. Six months later, Yahoo admitted on March 1, 2017 in its 10-K filing with the SEC that Yahoo had "contemporaneous knowledge" of the 2014 data breach. ECF No. 196 ¶ 129; Yahoo, 2016 Annual Report (Form 10- K), at 47 (Mar. 1, 2017). The fact that the instant case involves multiple Data Breaches, untimely disclosures, misleading public statements, and the sale of the breached Yahoo data on the dark web must be taken into account in evaluating the Settlement. Had Yahoo timely disclosed each of the Data Breaches, Yahoo could have been forced to pay settlements for each Data Breach.

Thus, the fact that the $117.5 million Settlement Fund is "the second largest fund in data breach history" is true in a technical sense. However, all but one of the foregoing cases involved significantly higher aggregate payments to smaller classes. Moreover, the foregoing cases each only involved one data breach, not the numerous Data Breaches at issue here. Of course, the Court does agree that the $117.5 million Settlement Fund is a significant sum in absolute terms.

However, the Settlement Fund here is less impressive in per-capita terms. Here, the parties assert that the Settlement Class consists of 194 million Settlement Class Members, which makes it far larger than any of the classes in the foregoing cases. As noted, this figure comes from an analysis crafted just for this Settlement that produced a "reasonably plausible" estimate based in large part on the operation of certain "heuristics." ECF No. 369-26 ¶¶ 6, 11. The actual size of the class has been an ever-shrinking target in the instant case, with Yahoo having previously represented that Yahoo reaches "a global audience of more than 1 billion monthly active users" and that Yahoo had "[m]ore than 650 million [] monthly users." Press Release, Verizon, Verizon to Acquire Yahoo's Operating Business (July 25, 2016), available at https://www.verizon.com/about/news/verizon-acquireyahoos-operating-business; Yahoo, 2016 Annual Report (Form 10-K), at 15 (Mar. 1, 2017). The parties' first settlement represented that the Settlement Class size was 200 million. By the second settlement, the Settlement Class size had shrunk to 194 million. At the Final Fairness Hearing, the parties represented that the 194 million number could be further "filtered down to 94 million." ECF No. 476 at 70:7-11.

By contrast to the undeniably large size of the Settlement Class, Anthem involved a class size of roughly 79 million, Home Depot involved a consumer class size of roughly 52 million, Target involved a consumer class size of 110 million, and Equifax involved a consumer class size of 147 million. Mot. for Atty's Fees at 6-7. The Court finds Anthem to be a particularly useful comparator. Indeed, as noted, the Anthem settlement is comparable to the instant Yahoo Settlement in many ways. See supra Section II. Moreover, Plaintiffs' own expert, Ian Ratner, surveyed recent settlements that "involved payments to users in exchange for compromised PII" in order to provide salient data points as to the value of the information compromised in the instant case. ECF No. 254-9 Ex. 96 ("Ratner Decl.") ¶ 31. Ratner explained that "[o]f the available settlements, the Anthem and Vtech settlements related to PII that is [sic] the most comparable to the Yahoo Data Breaches and indicate a range of $1.02 to $1.46" as the appropriate range for the value of each user's compromised account. Ratner Decl. ¶ 32. Thus, because the plaintiffs in Anthem achieved a $115 million settlement fund for only 79 million members, 40% of the 194 million Settlement Class here, the Anthem settlement resulted in a per-capita recovery of $1.46 per class member. Here, however, the $117.5 million Settlement Fund results in only $0.60 per-capita recovery for the 194 million Settlement Class Members. Although Yahoo separately settled claims brought against it by the SEC for $35 million and settled a securities class action for $80 million, these amounts concerned separate securities fraud allegations and did not provide compensation to the Settlement Class Members who had Personal Information compromised.

Similarly, application of the same analysis to the settlement in Equifax, which postdated Ratner's work, yields at least a per-capita recovery of $2.58 per class member.¹¹ Such a large disparity strongly suggests to the Court that the absolute size of the Settlement Fund is a function of the size of the Settlement Class, and not a result of any special efforts by Class Counsel, particularly because the instant case also involves multiple Data Breaches, untimely disclosures, misleading public statements, and the sale of the breached Yahoo data on the dark web. See In re Optical Disk Drive Prod. Antitrust Litig., 959 F.3d 922, 933 (9th Cir. 2020) (explaining the Ninth Circuit's frequent "observation that 'in many instances the increase in recovery is merely a factor of the size of the class and has no direct relationship to the efforts of counsel.'" (quoting In re Bluetooth, 654 F.3d at 943)).

11 $380.5 million for 147 million class members results in a per-capita recovery of $2.58.

Several other factors bear noting. First, like all data breach settlements, the Settlement Fund does not represent the entire value to the Settlement Class because the Settlement also offers nonmonetary benefits. Yahoo has agreed to implement concrete Business Practice Changes designed to rectify the harms suffered by Settlement Class Members. Settlement Agmt. ¶ 2. Specifically, Yahoo has committed to allocate at least $66 million per year to its information security budget in 2019-2022, which is roughly four times the size of Yahoo's average information security budget in 2013-2016. ECF No. 414 at 8. Yahoo will also employ 200 full-time security employees through the end of 2022, up from 48 in 2016. Id. Yahoo has pledged to align its information security program with the NIST Cybersecurity Framework, and Yahoo has also agreed to undertake annual third-party assessments to ensure compliance with that framework every year for four years beginning in 2019. Id. Yahoo has also agreed to strictly limit access to the UDB, enhance security training for employees, adopt industry standard anomaly and intrusion detection security tools, maintain event logs for three years, and engage in proactive penetration testing. Id. at 8-9. The Court considers the value of these benefits in assessing the proper multiplier.

Second, Plaintiffs point out that the Settlement Fund will purchase Credit Services for the Settlement Class with a lump sum payment of $24 million. Mot. for Atty's Fees at 7. Because the individual retail price of these Credit Services is $14.95, "once more than approximately 67,000 Settlement Class Members enroll in the Credit Services, additional value is being provided by th[e] negotiated bulk rate." Id. However, the Court previously rejected a similar argument in Anthem. There, the Court explained that "[a]lthough the credit monitoring services under the Settlement are tailored to the Settlement Class's injury . . . , the estimated retail price is at best an inexact match to the actual value." In re Anthem, 2018 WL 3960068, at *7. Instead, "compensation in kind is worth less than cash of the same nominal value." In re Mex. Money Transfer Litig., 267 F.3d 743, 748 (7th Cir. 2001). That observation has been underscored in the instant case. When Plaintiffs moved for preliminary approval, Plaintiffs expected a "one to two percent claims rate for Credit Monitoring Services." ECF No. 369 at 29. However, as of June 12, 2020, only 360,055 Claimants (i.e., 28%) of the 1,292,037 total Claimants selected Credit Services, which produces only a 0.3% claims rate, far lower than the proportion that Plaintiffs expected. Fenwick Decl. ¶ 11. If Settlement Class Members actually valued the Credit Services as equivalent to the retail cash value of the Credit Services, the low response rate would make no sense. Indeed, the retail value of two years' worth of Credit Services is $358.80, far higher than the predicted Alternative Compensation amount of $100. Mot. for Atty's Fees at 7 (noting that "[t]he AllClear Services have a monthly retail value of $14.95"); Settlement Agmt. ¶ 5.3 (explaining that subject to certain other adjustments, "each Settlement Class Member who submits a valid Claim Form selecting Alternative Compensation shall receive a payment equal to $100.00"). Yet as noted, most of the Settlement Class Members have opted for Alternative Compensation. Fenwick Decl. ¶ 11. The Court therefore declines to treat the Settlement Fund as larger because of the alleged surplus value created by Yahoo's lump sum purchase of the Credit Services.

In light of the foregoing, the $117.5 million Settlement Fund is fair, adequate, and reasonable, but unremarkable. Thus, the Court concludes that this reasonableness factor weighs in favor of a modest multiplier.

b. The Complexity and Novelty of the Issues Presented

Second, the Court concludes that the instant case did not present particularly complex issues. It is true, to be sure, that "data-breach litigation is an actively developing field of the law where much of the legal landscape is still shifting and unsettled." In re Anthem, 2018 WL 3960068, at *11. However, as the Court previously explained, many of the legal theories involved in the instant case were not particularly novel.

First, as the Court previously noted, although Plaintiffs filed two oppositions to motions to dismiss in the instant case, these two oppositions overlapped considerably. ECF No. 357 at 15. As Plaintiffs themselves explained in their opposition to Yahoo's second motion to dismiss, Yahoo simply "rehash[ed] old arguments" that the Court rejected in the first motion to dismiss. ECF No. 211 at 3. For instance, Plaintiffs' opposition noted the following. The second motion to dismiss argued that the California Unfair Competition Law ("UCL") did not confer standing for benefit-of-the-bargain losses related to data security, although "this Court already held that it does." Id. The second motion to dismiss also "again incorrectly argue[d] that Plaintiffs' PII is not covered under the California Customer Records Act." Id. Further, the second motion to dismiss "ignore[d] this Court's ruling that Plaintiffs sufficiently alleged damages as a result of Defendants' delay in notifying them of the Forged Cookie Breach." Id.

More importantly, the legal theories involved in the motions to dismiss were not particularly novel. In Adobe and Anthem, this Court previously addressed several of the legal theories that Plaintiffs relied on in the instant case. See In re Adobe Sys., Inc. Privacy Litig., 66 F. Supp. 3d 1197 (N.D. Cal. 2014); In re Anthem, Inc. Data Breach Litig., 162 F. Supp. 3d 953 (N.D. Cal. 2016); In re Anthem, Inc. Data Breach Litig., 2016 WL 3029783 (N.D. Cal. May 17, 2016).

As the Court previously explained, these precedents addressed key issues in the current case, including: (1) whether risk of future identify theft and loss of value of Personal Information constitute injury in fact to support Article III standing, see In re Adobe, 66 F. Supp. 3d at 1214-15; In re Anthem, 2016 WL 3029783, at *14; (2) whether Plaintiffs can adequately state a causal connection between a data breach and alleged harms, see In re Anthem, 162 F. Supp. 3d at 987; (3) whether benefit-of-the-bargain losses related to the value of reasonable data security are sufficient to support standing under the California UCL, In re Adobe, 66 F. Supp. 3d at 1224; In re Anthem, 2016 WL 3029783, at *30; (4) whether Plaintiffs can adequately allege a claim under the UCL for unlawful conduct where Plaintiffs allege an underlying California Customer Records Act ("CRA") violation, In re Adobe, 66 F. Supp. 3d at 1226; (5) whether Plaintiffs can adequately allege a claim under the UCL for unfair conduct under the balancing test where Plaintiffs allege that Defendant failed to adequately protect customer data, In re Adobe, 66 F. Supp. 3d at 1227; In re Anthem, 162 F. Supp. 3d at 990; and (6) whether contract language regarding "inherent limitations" in privacy safeguards "relieve[s] [Defendant] of the responsibility . . . to provide 'reasonable' security," see In re Adobe, 66 F. Supp. 3d at 1221. In addition, other courts in this district had addressed whether software could constitute a "service" under the California Consumers Legal Remedy Act when the software provider "continually updates" and supports the software. See Haskins v. Symantec Corp., No. 13-CV-01834-JST, 2013 WL 6234610, at *9 n.9 (N.D. Cal. Dec. 2, 2013).

In light of the foregoing, Plaintiffs rely primarily on the prospect of class certification to argue that the instant case was novel and risky. Plaintiffs correctly point out that class certification precedent in data breach cases is rare. The Court pauses to note, however, that unlike the plaintiffs in Anthem, Plaintiffs' motion for class certification post-dated a data breach case in which a federal district court certified a damages class, Smith v. Triad of Alabama, LLC, No. 1:14-CV-324-WKW, 2017 WL 1044692 (M.D. Ala. Mar. 17, 2017). See also In re Anthem, 2018 WL 3960068, at *12 (noting that "only one non-settlement data-breach class has been certified in federal court to date, and that case post-dates Plaintiffs' filing of their motion for class certification"). Unsurprisingly, Plaintiffs relied on Smith throughout their motion for class certification. See, e.g., ECF No. 246 at 31 ("While it is possible that a particular Damages Class member's claim for losses stemming from identity theft will require more individual determination, these instances are likely to be isolated and few and, therefore, do not defeat predominance." (citing Smith, 2017 WL 1044692, at *13)).

Moreover, Plaintiffs sought certification of an injunctive relief class, an alternative injunctive relief class, as well as a damages class comprised of four subclasses. ECF No. 246 at 1-2. Plaintiffs presented three different possible damages models, namely benefit-of-the-bargain, the lost value of personal information, and identity theft losses. Id. at 27-31. As to the second model, Plaintiffs also presented two separate proposed methods to calculate the lost value of personal information. Id. at 28. Of course, Defendants vigorously disputed the viability of these models. ECF No. 295 at 13-30. However, the number of proposed classes and models increased the chances that Plaintiffs would be able to achieve class certification of at least one class in some form.

Moreover, as the Court has previously noted, Yahoo's history of nondisclosure and lack of transparency related to the Data Breaches is egregious. To the extent that Plaintiffs may have faced novel legal issues regarding class certification, it is also clear that Plaintiffs wielded more leverage to achieve a favorable settlement here than plaintiffs in other data breach cases that did not involve multiple Data Breaches, untimely disclosures, misleading public statements, and the sale of the breached data on the dark web. Indeed, this is underscored by the fact that the instant case settled relatively early, before the parties had even finished briefing the motion for class certification or Plaintiffs had opposed Defendants' Daubert motions.

In light of the foregoing, the Court concludes that this reasonableness factor weighs in favor of a modest multiplier.

c. The Skill Required and the Quality of Work

Third, with respect to the quality of representation, Class Counsel includes lawyers who are experienced in litigating data breach and privacy class actions. Mot. for Atty's Fees at 13. The Court finds that Class Counsel demonstrated skillful work, but that the scope of the work was limited and the instant case was not without errors.

As an initial matter, the scope of Class Counsel's work in the instant case was substantially limited by the parties' agreement that California law governed; by the small number of counts in the complaint, many with overlapping elements; and by the fact that there were a limited number of named Plaintiffs in the MDL Case. See ECF No. 196 ¶ 175 (stipulation agreeing that "California common law and statutory law applies to all claims by members of the United States and Paid Users Classes"); id. ¶ 179 (contending that California law should apply to all claims for all classes).

Anthem involved more than 100 named plaintiffs and 43 defendants and asserted claims under all fifty states' laws. In re Anthem, 2018 WL 3960068, at *13. By contrast, the Consolidated Class Action Complaint ("CAC") in the instant case was filed by twelve named Plaintiffs and asserted only thirteen counts against Yahoo and its subsidiary. ECF No. 80. Specifically, on behalf of the United States and Israel Classes, the CAC alleged two California statutory violations (Unfair Competition Law and Consumer Legal Remedies Act). On behalf of the United States, Israel, and Small Business Classes, the CAC alleged two California statutory violations (Data Breach Notification Law and Online Privacy Protection Act), one federal statutory violation (Stored Communications Act), and three common law causes of action (Breach of Contract, Breach of Implied Contracts, and Breach of Implied Covenant of Good Faith and Fair Dealing). On behalf of the Small Business Class, the CAC alleged one California statutory violation (Unfair Competition Law) and two common law causes of action (Fraudulent Inducement and Negligent Misrepresentation). On behalf of users from Australia, Venezuela, and Spain, the CAC alleged one common law cause of action (Negligence). On behalf of all classes, the CAC alleged one claim for Declaratory Relief under 28 U.S.C. § 2201.

The First Amended Consolidated Class Action Complaint ("FAC") subsequently filed by nine named Plaintiffs also asserted thirteen counts, which substantially overlapped with the CAC, against Yahoo and its subsidiary. ECF No. 196. The FAC added one count for Deceit by Concealment under Cal. Civil Code §§ 1709, 1710; two counts for violations of the California Customer Records Act; and alleged separate violations of the California Unfair Competition Law for Unlawful Business Practice and Unfair Business Practice. Unlike the CAC, the FAC did not allege violations of the Data Breach Notification Law, Online Privacy Protection Act, Stored Communications Act, or allege Fraudulent Inducement.

Further, Plaintiffs took only seven percipient witness and Rule 30(b)(6) depositions. ECF No. 330 at 1; ECF No. 351 at 29. Defendants took three more depositions than Plaintiffs, including depositions of Plaintiffs' four experts. Plaintiffs never deposed Defendants' experts. Id. During Case Management Conferences, the Court had to encourage Class Counsel to actively litigate the case and take discovery. See, e.g., ECF No. 155 at 26 (instructing Class Counsel that "[y]ou need to get this discovery so that you can amend this complaint in time").

Moreover, the Court denied Plaintiffs' first motion for preliminary approval, which required Plaintiffs to renegotiate the Settlement and file a second motion for preliminary approval. ECF No. 357. Some of the errors that prompted the Court to deny preliminary approval should not have been made. For example, Plaintiffs sought to release claims related to Data Breaches that allegedly occurred in 2012, notwithstanding the fact that the notice failed to refer to the 2012 Data Breaches, and that "the CAC, FAC, settlement agreement, and motion for preliminary approval [did] not state what happened with Yahoo users' data in 2012 or identify any harm to any group of 2012 Yahoo users." Id. at 10. This proposed release thus violated both the Ninth Circuit's rules concerning adequate disclosure to class members and the Ninth Circuit's rules concerning the proper scope of release provisions in settlement agreements. Id. at 10-11. Plaintiffs also failed to disclose the total size of the proposed settlement fund, which rendered it impossible for class members to assess the reasonableness of the settlement. Id. at 12. Relatedly, Plaintiffs failed to adequately disclose the scope of proposed nonmonetary relief, and failed to accurately measure the size of the proposed class. Id. at 21-23.

The instant case involved technical subject matter and a substantial class size, both of which Class Counsel ably handled. However, Class Counsel ultimately prepared limited legal filings with numerous overlapping issues, Class Counsel completed limited discovery relative to the scope of the alleged claims, and Class Counsel erred with respect to the first motion for preliminary approval. In light of the foregoing, the Court concludes that this reasonableness factor weighs in favor of a modest multiplier.

d. The Risk of Nonpayment

Fourth, this case was conducted on a contingent-fee basis against well-represented Defendants. Hence, Class Counsel did face some level of uncertainty as to the recovery of fees expended. Class Counsel also states that "[e]ach firm was forced to forgo other employment in order to devote the time necessary to pursue this litigation," but Class Counsel provides no further detail. Yanchunis Decl. ¶ 58. Accordingly, the Court finds that the risk of nonpayment weighs in favor of a modest multiplier.

e. Conclusion

In sum, the Court concludes that all four factors outlined above suggest that the Court should apply a modest multiplier to the lodestar. Moreover, as discussed above, and in accordance with Plaintiffs' own expert, the Court finds Anthem to be a particularly useful comparator for the instant case. In Anthem, the Court awarded an attorneys' fees award that comprised a lodestar multiplier "slightly over 1.0." 2018 WL 3960068, at *27. However, before the application of the multiplier, the Court also cut the Anthem plaintiffs' lodestar from $37,993,566.50 to $35,663,309.00 due to overcharging for contract attorneys, and then by an additional 13%, from $35,663,309.00 to $31,027,078.83, due to inefficient billing. Id. Before the Court made these cuts, the Anthem lodestar multiplier would have been even lower. Indeed, before these cuts, the Anthem multiplier would have been a negative multiplier of roughly 0.82.

In view of all of these considerations, the Court opts to apply a 1.15 multiplier to the $19,794,471.90 lodestar. The 1.15 multiplier provides a modest increase over the lodestar to reflect the risk that Class Counsel took in the instant case, through the possibility of nonpayment and relative complexity of the MDL case. A 1.15 multiplier is within the range of multipliers typically awarded in the Ninth Circuit. See Vizcaino, 290 F.3d at 1051 n.6 (listing multipliers awarded in common fund cases and noting that "most" range from 1.0-4.0). Application of the multiplier to the lodestar results in an award of $22,763,642.70. This award in fact reflects a higher multiplier than plaintiffs in Anthem received, notwithstanding the fact that Anthem entailed significantly more work for counsel. For instance, although all of the claims in the instant case were governed by California law, the plaintiffs in Anthem pursued claims under all fifty States' laws. In re Anthem, 327 F.R.D. at 313 (noting that plaintiffs "concede that the laws of the fifty States apply"). Moreover, the volume of litigation activity in Anthem greatly exceeded that of the instant case. Indeed, in Anthem, counsel filed four consolidated complaints on behalf of over 100 named plaintiffs against 43 defendants, deposed 18 percipient fact witnesses, 62 corporate designees, and five experts, and plaintiffs also defended the depositions of more than 100 named plaintiffs and four experts. Plaintiffs also withstood two complex motions to dismiss, litigated fifteen discovery motions, and settled only after class certification and Daubert motions were fully briefed, and discovery had closed. Id. at 320.

By contrast, in the instant case, prior to the Settlement, Class Counsel filed two consolidated complaints that each alleged thirteen California law claims on behalf of a total of thirteen named Plaintiffs against Yahoo and its subsidiary, withstood two substantially overlapping motions to dismiss, litigated two discovery motions, deposed seven percipient fact witnesses and corporate designees, and defended the depositions of nine named Plaintiffs and four experts. Mot. for Atty's Fees at 1. The parties settled before Plaintiffs filed an opposition to Defendants' Daubert motions and a reply in support of class certification. Plaintiffs did not depose Defendants' experts. The parties settled at least six months before the fact discovery cut- off, and thus significant discovery was not conducted in the case. Case Management Order. Plaintiffs then conducted three additional "confirmatory discovery depositions" after the Court denied preliminary approval of the first settlement, in order to support the new Settlement. Mot. for Atty's Fees at 1. There were 1,048 docket entries when the Court granted the motion for attorney's fees in Anthem. See In re Anthem, No. 15-MD-2617, ECF No. 1049 (N.D. Cal.). In the instant case, there are only 493.

In sum, the comparison to Anthem thus underscores the reasonableness of a 1.15 multiplier here. The application of the 1.15 multiplier to the $19,794,471.90 lodestar yields an attorneys' fee award of $22,763,642.70. With that resulting $22,763,642.70 figure in hand, the Court next performs a percentage-of-recovery calculation as a means of cross-checking that result.

B. Percentage-of-Recovery Cross-Check

The determination of the percentage of recovery usually proceeds in two steps. First, courts must ascertain the size of the fund against which the percentage will be assessed. In re Online DVD-Rental, 779 F.3d at 953. Second, courts must examine relevant factors to determine the appropriate percentage of the fund that should be awarded to counsel. Vizcaino, 290 F.3d at 1048-50.

Here, Plaintiffs appear to assert that the size of the fund for the purposes of the analysis is $117.5 million, which is the gross amount of the Settlement Fund. Mot. for Atty's Fees at 1 ("Settlement Class Counsel seek 25.5% of the $117.5 million cash fund they achieved.").¹² The Court agrees. Although the Settlement resulted in concrete Business Practice Changes for Yahoo, the Ninth Circuit has held that "only in the unusual instance where the value to individual class members of benefits deriving from injunctive relief can be accurately ascertained may courts include such relief as part of the value of a common fund for purposes of applying the percentage method of determining fees." Staton, 327 F.3d at 974. Moreover, although the $117.5 million Settlement Fund will be reduced somewhat by administrative and litigation expenses, the Court "finds that including these non-excessive administrative costs and litigation expenses in the percentage fund is proper in this case." In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2018 WL 3960068, at *9 (N.D. Cal. Aug. 17, 2018).

12 To the extent Plaintiffs in fact argue that the size of the fund should be larger, the Court rejects those arguments. See infra Section V.A.1.

Application of the $22,763,642.70 attorneys' fee award to the $117.5 million Settlement Fund results in a percentage-of-recovery just below 19.4%. This percentage confirms the reasonableness of the proposed award.

The Ninth Circuit has characterized 25% as the "starting point" for the analysis but simultaneously noted that 25% may not be fitting in all cases. Vizcaino, 290 F.3d at 1048. For example, "where awarding 25% of a 'megafund' would yield windfall profits for class counsel in light of the hours spent on the case, courts should adjust the benchmark percentage." In re Bluetooth, 654 F.3d at 942. District courts may also depart from the 25% benchmark rate by "providing adequate explanation in the record of any 'special circumstances.'" Id. In the end, "[s]election of the benchmark or any other rate must be supported by findings that take into account all of the circumstances of the case." Vizcaino, 290 F.3d at 1048. The Ninth Circuit has identified five factors which may be probative: (1) the results achieved; (2) the risk of litigation; (3) the skill required and the quality of work; (4) the contingent nature of the fee and the financial burden carried by the plaintiffs; and (5) awards made in similar cases. Id. at 1048-50.

Here, circumstances warrant a departure below the 25% benchmark. Specifically, the size of the Settlement Fund appears to be due in part to the size of the Settlement Class and not the efforts of Class Counsel, which would generate an excessive windfall through rote application of the 25% benchmark. Indeed, if the Court awarded the 25% benchmark, Class Counsel would receive $29,375,000, which amounts to about $10,300,000 more than the $19,794,471.90 lodestar. "Although a percentage award in a megafund case can be 25% or even as high as 30-40%, typically the percentage award in such a case is substantially less than the 25% benchmark applicable to typical class settlements in this Circuit." Alexander v. FedEx Ground Package Sys., Inc., No. 05-cv-00038-EMC, 2016 WL 3351017, at *2 (N.D. Cal. June 15, 2016). This rule reflects the basic reality that, at some point, the increasing amount of a settlement may be a function of class size, not counsel's efforts. See In re NASDAQ Mkt.-Makers Antitrust Litig., 187 F.R.D. 465, 486 (S.D.N.Y. 1998). Moreover, for the reasons discussed above, the results achieved, risk of litigation, skill required and quality of the work also all support an award below the 25% benchmark, similar to the 19.4% award generated by the cross-check here. See supra Section V.A.3.

Percentage-of-recovery awards in similar cases strongly support the award. For instance, in Equifax, the district court ultimately granted an attorneys' fee award worth 20.36% "of the $380.5 million minimum settlement fund." In re Equifax, 2020 WL 256132, at *31. However, in Equifax, an additional $125 million was available to pay consumers' out-of-pocket claims; thus, the total settlement fund in the consumer class action was $505.5 million. Thus, the Equifax court noted that the attorneys' fees, depending on the total amount of consumer out-of-pocket claims, could constitute 15.3% of the total settlement fund. Id. The 19.4% figure generated by the percentage-of-recovery cross-check in the instant case sits between the two percentages considered by the Equifax court and is closer to the higher percentage.¹³

13 Plaintiffs cite dicta from the Equifax court stating in passing that "even if the Court considered only the $310 million fund created under the parties' term sheet, a 25% fee would be justified." In re Equifax, 2020 WL 256132, at *36. However, the operative inquiry under Ninth Circuit law is whether the attorneys' fee request is "within the range of fees awarded in settlements of comparable size." Vizcaino, 290 F.3d at 1050 n.4 (emphasis added).

In the past, this Court has also relied on a leading academic study conducted by Professors Theodore Eisenberg and Geoffrey Miller, in which the authors reviewed large common-fund settlements over a 16-year period, between 1993 and 2008. See In re High-Tech Emp. Antitrust Litig., No. 11-CV-02509-LHK, 2015 WL 5158730, at *13 (N.D. Cal. Sept. 2, 2015) (citing Theodore Eisenberg & Geoffrey P. Miller, Attorney Fees and Expenses in Class Action Settlements: 1993-2008, 7 J. Empirical Legal Stud. 248 (2010)). In High-Tech, the Court looked to the authors' analysis of common funds exceeding $175.5 million and concluded that a percentage recovery of 10.5% was appropriate for a fund of $435 million. Id. Similarly, in Anthem, the Court looked to the authors' analysis of a sample of 69 settlements ranging from $69.6-175.5 million and found that the median percentage was 19.9% and the mean percentage was 19.4% with a standard deviation of 8.4%. Eisenberg & Miller, supra, at 265 tbl.7. The instant case's Settlement Fund of $117.5 million falls within this $69.6-175 million range. Thus, the contemplated 19.4% award falls precisely on the mean percentage awarded in cases of this size. The contemplated award is therefore consistent with this study.

There is also a more recent academic study by Professors Eisenberg, Miller, and Roy Germano, which examined "458 cases reported in the five years from 2009-2013." Theodore Eisenberg, Geoffrey P. Miller & Roy Germano, Attorneys' Fees in Class Actions: 2009-2013, 92 N.Y.U. L. Rev. 937, 940 (2010). This updated study reiterates the conclusion that "as recovery amount increases, the ratio of the size of the attorneys' fee relative to the size of the recovery (i.e., the fee percentage) tends to decrease." Id. at 948. For the highest decile of cases that the study examined, which consisted of cases with settlements in which the class recovery was greater than $67.5 million, the average attorneys' fee award was roughly 22.3% of the recovery. Id. at 948 & fig.5. The study states that for cases "with recoveries larger than $100 million, . . . mean and median fee percentages varied from a low of 16.6% in 2009 to a high of 25.5% in 2011—variation that is probably due to the significantly smaller number of very large cases in our data set." Id. at 947. Again, the contemplated 19.4% award is close to the center of this reported range and therefore consistent with the study.

Here, Plaintiffs seek to rely on a declaration from Professor Miller that arrives at a different conclusion from Professor Miller's foregoing academic studies. ECF No. 416-1 ("Miller Decl."). Plaintiffs paid Professor Miller $67,580 for the declaration and for his attendance at the Final Fairness Hearing. ECF No. 474-13 ¶ 9 ("Professor Miller's billing to date totals $67,580.00."). In this declaration, which Professor Miller drafted specifically for the instant case, Professor Miller now seeks to use a subset of the above data "to more specifically examine fees in the range between $75 million and $150 million." Miller Decl. ¶ 37. According to Professor Miller, "[f]or 19 cases in the nation as a whole, the mean fee in this range was 24.9% and the median fee was 25%," and "[f]or cases in the Ninth Circuit, the mean fee in this range was 24.3% and the median was 24.6%." Id. Thus, Professor Miller asks this Court to award Plaintiffs a windfall of over $10 million even though Plaintiffs' lodestar was only $19,794,471.90.

Professor Miller's declaration provides only a few sentences of analysis. Professor Miller fails to explain why he cherry-picked a smaller range of settlements, the $75 million to $150 million range, from the broader range in his academic study. This new range accounts for fewer than half of the cases in the decile analyzed in the academic study. Eisenberg, Miller & Germano, supra at 947 (noting that the top decile analyzed by the authors consisted of "about 45 cases"). Moreover, the $117.5 million Settlement Fund does not actually sit at the center of the new range. Instead, the Settlement Fund sits closer to the top, which would likely skew the percentage-of-recovery upward by including a disproportionate number of less sizeable settlements. Professor Miller also fails to explain how many Ninth Circuit cases fall within the cherry-picked range and generate the mean percentage rate of 24.3% and the median percentage rate of 24.6%. In light of the foregoing, the Court is concerned that the range was constructed specifically to produce a high percentage rate, particularly in view of the $67,580 Plaintiffs paid to Professor Miller to undertake the analysis. Professor Miller's newly performed analysis must therefore be taken with a grain of salt. The Court finds Professor Miller's two published law review articles, which have no connection to the instant case, to be more reliable guides as to the average percentages of recovery awarded in similar cases.

The Court acknowledges that in Anthem, the Court granted attorneys' fees worth 27% of the settlement fund. In re Anthem, 2018 WL 3960068, at *16. However, the Court nevertheless specifically explained that the award was "at the high end" of a range of previous settlements, which was "representative of the exceptionality of this case in terms of both the results achieved and the risks incurred." Id. Moreover, the Court also cut the Anthem plaintiffs' lodestar from $37,993,566.50 to $31,027,078.83. 2018 WL 3960068, at *27. Thus, the 27% of the settlement fund in Anthem constituted a negative multiplier of 0.82 of the Anthem plaintiffs' proposed lodestar. Further, as discussed, Anthem was different, as it involved a far smaller class, more complex issues, and a much higher volume of litigation activity.

In light of all of the foregoing and the circumstances of the instant case, the Court finds that a 19.4% percentage of recovery is reasonable, which confirms the propriety of the application of the 1.15 multiplier and the $22,763,642.70 award.

C. Objections

Ten of the Settlement Class Members object to Plaintiffs' contemplated attorneys' fee award. Most of these objections provide little specificity as to the basis for the objection and simply state that Class Counsel will receive too high an award. See ECF No. 438-1 Ex. D (Objection of Mihail Seroka) (objecting because attorneys "will probably claim over 50 percent of the award"); ECF No. 438-1 Ex. G (Objection of Jeromy Carpenter) (objecting because "the attorneys for the class representative, and the class representative him or herself, will enjoy a windfall for having done very little work"); ECF No. 438-1 Ex. H (Objection of Mark Wagner) (lodging "moral objection" because attorneys "are making 30+ million off of this" lawsuit); ECF No. 438-2 Ex. L (Objection of Dennis Chong) (objecting because "[t]he attorney fees and cost[s] are excessive"); ECF No. 438-2 Ex. M (Objection of Leah Elliott) (objecting because settlement "simply enriches the lawyers"). The Court's calculation of the lodestar above belies this assertion. To the extent that these objectors raise more specific arguments as to the appropriate lodestar and percentage, the Court has already addressed these issues in the analysis above. Accordingly, these objections are overruled.

Objector James McCain challenges the existence of a so-called "quick-pay" provision in the Settlement Agreement. ECF No. 429 at 8. The quick-pay provision permits Class Counsel to receive attorneys' fees and expenses ten days after final approval and judgment, provided Class Counsel executes an agreement, subject to joint and several liability, to repay the fees and expenses in the event the Effective Date does not occur. Settlement Agmt. ¶ 12.2. At the Final Fairness Hearing, Class Counsel represented to the Court that such an agreement would include Yahoo as a signatory and also include repayment for reductions in attorneys' fees as well. McCain claims that quick-pay provisions of this nature are unnecessary following the 2018 amendments to Rule 23(e). ECF No. 429 at 8. The Court disagrees. As the Court explained at the Final Fairness Hearing, quick-pay provisions have long been accepted in the appropriate circumstances. See, e.g., In re TFT-LCD (Flat Panel) Antitrust Litig., No. MDL 3:07-MD-1827 SI, 2011 WL 7575004, at *1 (N.D. Cal. Dec. 27, 2011) ("With respect [to] the 'quick pay' provisions, Federal courts, including this Court and others in this District, routinely approve settlements that provide for payment of attorneys' fees prior to final disposition in complex class actions."). Nothing in the 2018 amendments prevents the Court from approving of such a quick-pay provision and, indeed, other courts have continued to do so. See, e.g., In re: Lumber Liquidators Chinese-Manufactured Flooring Prod. Mktg., Sales Practices & Prod. Liab. Litig., 952 F.3d 471, 487 (4th Cir. 2020) ("We discern no reason to buck that trend [of approving quick-pay provisions] in these proceedings."). This is especially so in light of the fact that in the instant case, at least one objector has sought a pay-off in exchange for withdrawal of an objection. ECF No. 442-1 Ex. C (email from objector to Class Counsel stating that objector is "open to negotiation an incentive fee pursuant to Rule 23 in return for my withdrawal of my objections," and that "in the event the objections are not sustained by the Honorable Court, I do plan on appealing to Circuit Court"). Quick-pay provisions help prevent gamesmanship of this nature, and the Court finds such a provision appropriate in the instant case. Further, to the extent that McCain argues that the inclusion of estimated future fees renders the quick-pay provision problematic, the Court disagrees. With or without the reduced estimated future fees that the Court included in the lodestar, "[t]he quick-pay provision does not harm the class members in any discernible way, as the size of the settlement fund available to the class will be the same regardless of when the attorneys get paid." Pelzer v. Vassalle, 655 F. App'x 352, 365 (6th Cir. 2016).

McCain also challenges the attorneys' fee amount. McCain initially contended that the attorneys' fee request "should be limited to 16.5% - 19.9% of the $117.5 million fund." ECF No. 429 at 20. In a filing after the Final Fairness Hearing, however, McCain now "urges the Court to limit class counsel to 16.5%." ECF No. 477 at 4. McCain provides no explanation for this shift in position. In support of this argument, McCain claims that the recovery in the instant case is "less than 1% of class damages based on Ian Ratner's valuation of the portfolio of PII at $1,200 per person." Id. at 5. Of course, Ratner never offered such a valuation. The unelaborated sentence in Ratner's declaration McCain cites simply reads, "[a]n individual's entire portfolio of PII has been valued as high as $1,200 per person." ECF No. 254-9 at 7. Ratner provided no explanation about the source of this valuation or its methodology, nor did Ratner purport to endorse it. Further, even in the abstract, the statement only has any conceivable relevance for those Settlement Class Members who had a Yahoo email account that was compromised and whose "entire portfolio of PII" (a phrase left undefined Ratner's declaration) was taken from that email account. Yet McCain's calculations seemingly apply the figure to the entire 194 million Settlement Class.

McCain also fixes on a sentence in the SACC in which Plaintiffs alleges that "the 2013 Norton Report, based on one of the largest consumer cybercrime studies ever conducted, estimated that the global price tag of cybercrime was around $113 billion at that time, with the average cost per victim being $298 dollars." SACC ¶ 56. From this statement, McCain seemingly leaps to the conclusion that Plaintiffs have offered an "estimated individual cost" of $298 damages for each of the Settlement Class Member. ECF No. 477 at 5. The SACC self-evidently does not make such an allegation.

McCain also argues that Plaintiffs "play a [] shell game with their lodestar." ECF No. 477 at 1. According to McCain, this is so because as outlined above, Plaintiffs agreed to exclude $255,038.50 that was unauthorized by the Court, but "class counsel offset it with a nearly identical $270,000 lodestar since January 2020." Id. McCain's argument makes little sense, however, because Plaintiffs informed the Court of the additional fees in a filing made on June 15, 2020, before the Court informed Plaintiffs about the unauthorized billing. ECF No. 463. The Court sees no bad intent on the part of Class Counsel.¹⁴

14 The Court also rejects McCain's request to file a third set of objections following the Court's ruling on Plaintiffs' motions to seal. The information available on the docket furnished McCain with sufficient information to challenge the attorneys' fee request and, in any event, the Court has already reduced the attorneys' fee award to an amount that McCain previously contended was reasonable. The Court has also closely scrutinized the billing entries and finds them to be reasonable.

Objectors Edward Orr and Darlene Orr argue that Class Counsel should be paid no more than "$70 - $130 (seventy dollars to one hundred thirty dollars) per hour." ECF No. 483 at 7. This is so, according to Edward and Darlene Orr, because "the Department of Justice . . . staff has actually performed, in place of Plaintiffs' attorneys, much of the bulk of the work" in the instant case. Id. at 2. The Court disagrees. Edward and Darlene Orr appear to rely on the fact that the United States government has prosecuted several hackers who accessed Yahoo accounts in connection with the Data Breaches. Id. Suffice it to say, criminal prosecution of individual hackers who exploited the Data Breaches is very different from conducting a civil class action lawsuit against Defendants for failure to safeguard data. The fact that the criminal prosecutions exist does not warrant an additional reduction of attorneys' fees, much less a reduction of the magnitude Edward and Darlene Orr request.

Edward and Darlene Orr separately argue that Plaintiffs committed numerous "very serious errors" that should result in a decrease in the attorneys' fee award. ECF No. 483 at 5. The errors that Edward Orr and Darlene Orr cite are erroneous citations contained within Plaintiffs' response to objections and accidentally publicly filing Class Counsel's own billing information on ECF in connection with a motion to seal. Id. at 3-7. The Court does not find these errors sufficiently serious to warrant an additional reduction of attorneys' fees.

Next, objector Aaron Miller argues that "a reasonable fee award should utilize sliding scale percentage to prevent a windfall for plaintiffs' attorneys at the expense of the class." ECF No. 432 at 13. The Ninth Circuit has consistently "declined to adopt a bright-line rule requiring the use of sliding-scale fee awards for class counsel in megafund cases." In re Optical Disk Drive Prods. Antitrust Litig., 959 F.3d 922, 933 (9th Cir. 2020). Of course, "where awarding 25% of a 'megafund' would yield windfall profits for class counsel in light of the hours spent on the case, courts should adjust the benchmark percentage or employ the lodestar method instead." In re Bluetooth, 654 F.3d at 942. The Court's analysis reflects these considerations. As explained above, the Court also agrees with Miller that the Business Practice Changes and the retail value of the Credit Services should not inflate the Settlement Fund for the purposes of the attorneys' fee analysis. To the extent Miller argues that the attorneys' fees should be reduced further, the Court disagrees in view of the foregoing analysis.

Finally, objector Ryan Bowman argues that "[t]he fee sought here by counsel far exceeds what is customarily awarded when applying the 'percentage of the fund' method in cases of this magnitude." ECF No. 424 at 12. Again, the Court agrees with Bowman, and the foregoing analysis reflects this fact. To the extent Bowman argues that the attorneys' fees should be reduced further, the Court disagrees in view of the foregoing analysis. The Court therefore overrules the foregoing objections.

VI.THE EXPENSES ARE REASONABLE.

In common-fund cases, the Ninth Circuit has stated that the reasonable expenses of acquiring the fund can be reimbursed to counsel who has incurred the expense. See Vincent v. Hughes Air W., Inc., 557 F.2d 759, 769 (9th Cir. 1977); Acosta v. Frito-Lay, Inc., No. 15-CV-02128-JSC, 2018 WL 646691, at *11 (N.D. Cal. Jan. 31, 2018) ("There is no doubt that an attorney who has created a common fund for the benefit of the class is entitled to reimbursement of reasonable litigation expenses from that fund.") (quoting Ontiveros v. Zamora, 303 F.R.D. 356, 375 (E.D. Cal. 2014)). Such expense awards comport with the notion that the district court may "spread the costs of the litigation among the recipients of the common benefit." Wininger v. SI Mgmt. L.P., 301 F.3d 1115, 1121 (9th Cir. 2002).

In the instant case, the Settlement Agreement authorizes Plaintiffs to request up to $2.5 million in costs and expenses. Settlement Agmt. ¶ 12.1. Plaintiffs initially requested $1,497,609.54 in litigation costs and expenses. Mot. for Atty's Fees at 24. This total amounted to $1,341,230.41 incurred in connection with the MDL Case and $156,379.13 incurred in connection with the JCCP Case. Id. At the Final Fairness Hearing, the Court requested additional information about expenses paid to Professor Miller for his work contradicting prior academic work. Plaintiffs have since withdrawn their request for reimbursement of Professor Miller's $20,000 retainer, and they have not billed any other expenses to the Settlement Class. ECF No. 474-13 ¶ 9. Hence, Plaintiffs' new request is for $1,477,609.54 in litigation costs and expenses. Id.

Having reviewed the submissions of Class Counsel, the Court finds that their requests for unreimbursed expenses are reasonable. Class Counsel submitted declarations and invoices reflecting the $1,477,609.54 in unreimbursed expenses that they incurred in this action.

These expenses include: (1) expert witness fees; (2) case-related travel; (3) transcript fees; (4) document management; (5) copying, mailing, and serving documents; (6) operation of a call center to respond to Settlement Class Member inquiries; (7) electronic research; and (8) filing and court fees. These expenses were necessary to the prosecution of this litigation, were the sort of expenses normally billed to paying clients, and were made for the benefit of the Settlement Class. This Court has previously approved the same general classes of expenses. In re Anthem, 2018 WL 3960068, at *29; In re High-Tech, 2015 WL 5158730, at *16. No Settlement Class Member has specifically objected to the amount of these expenses or to Class Counsel being reimbursed for these expenses. Accordingly, the Court awards Class Counsel $1,477,609.54 in unreimbursed costs and expenses.

In addition to the request for $1,477,609.54 in unreimbursed expenses, Class Counsel also requests a cost reserve of $60,000.00 for a cybersecurity expert to review Yahoo's annual cybersecurity reports. Mot. for Atty's Fees at 24 & n.55. The Court deems this request reasonable. Indeed, as discussed, Yahoo is required to increase its annual spending on cybersecurity and implement certain changes to its data-security processes as part of the Settlement. Settlement Agmt. Ex. 2. One such change is to retain a third-party security consultant to conduct an annual cybersecurity review and report the results to Class Counsel. Id. ¶¶ 7.2, 7.3. To ensure that "Yahoo is fulfilling its obligations under the Settlement," Class Counsel states that they "will necessarily engage a cybersecurity expert to review that report." Yanchunis Decl. ¶ 55. Class Counsel "expect the cost for these reviews to be a maximum of $60,000." Id.

The $60,000.00 cost reserve is a reasonable expense that would directly benefit the Settlement Class. See Vincent v. Hughes Air W., Inc., 557 F.2d 759, 769 (9th Cir. 1977) (explaining that "the [common-fund] doctrine is designed to spread litigation costs proportionately among all the beneficiaries so that the active beneficiary does not bear the entire burden alone and the 'stranger' beneficiaries do not receive their benefits at no cost to themselves"); cf. Staton, 327 F.3d at 975 (allowing inclusion of reasonable notice costs in "a putative common fund benefiting the plaintiffs for all purposes"). The Court has not received any objections to the reserve. Moreover, the Court previously approved a similar reserve in the settlement of another data breach case that required annual assessments. See In re Anthem, 2018 WL 3960068, at *29 ("Plaintiffs reasonably request a $60,000.00 cost reserve for retention of a cybersecurity expert."). Accordingly, the Court approves a cost reserve of $60,000.00.

In sum, and based on the foregoing, the Court approves $1,477,609.54 in unreimbursed costs and expenses to Class Counsel and a $60,000 cost reserve for retention of a cybersecurity expert.

VII. THE SERVICE AWARDS ARE REASONABLE.

Finally, Plaintiffs request that the Court approve the Service Awards in the amount of: (1) $7,500 for the eight Settlement Class Representatives who were both deposed and whose devices were forensically imaged; (2) $5,000 for the three Settlement Class Representatives who were only either deposed or whose devices were forensically imaged; and (3) $2,500 for the five Settlement Class Representatives who participated in the instant case without being deposed or subjected to forensic imaging. Mot. for Atty's Fees at 25.

Service awards for class representatives are routinely provided to encourage individuals to undertake the responsibilities and risks of representing the class and recognize the time and effort spent in the case. In the Ninth Circuit, service awards "compensate class representatives for work done on behalf of the class, to make up for financial or reputational risk undertaken in bringing the action, and, sometimes, to recognize their willingness to act as a private attorney general." Rodriguez v. W. Publ'g Corp., 563 F.3d 948, 958-59 (9th Cir. 2009). In evaluating whether class representatives are entitled to reasonable service awards, district courts "must evaluate their awards individually, using 'relevant factors including the actions the plaintiff has taken to protect the interests of the class, the degree to which the class has benefitted from those actions, the amount of time and effort the plaintiff expended in pursuing the litigation and reasonable fears of workplace retaliation.'" Staton, 327 F.3d at 977 (alterations omitted) (quoting Cook v. Niedert, 142 F.3d 1004, 1016 (7th Cir. 1998)).

Here, each of the Settlement Class Representatives devoted substantial time and effort to the litigation, which benefitted the Settlement Class. The seven Settlement Class Representatives that served as plaintiffs in the JCCP Case provided extensive information about the harms they suffered through the Data Breaches, assisted in the responses to approximately 46 requests for production and 20 interrogatories served on them by Yahoo, and assisted with the ongoing meet and confer efforts regarding these responses. ECF No. 412-13 ¶ 10. The Settlement Class Representatives that served as plaintiffs in the JCCP Case also remained in contact with Class Counsel throughout the JCCP Case and promptly responded to their inquiries for further information. Id. Further, two Settlement Class Representatives that served as plaintiffs in the JCCP Case had their computers forensically imaged. Id.

As for the Settlement Class Representatives that served as plaintiffs in the MDL Case, the Settlement Class Representatives worked closely with Class Counsel to provide information needed to draft the First Amended Consolidated Class Action Complaint and reviewed all allegations for accuracy. ECF No. 416-5 Ex. 5 ("Riebel Decl.") ¶ 2. Further, all but one of the Settlement Class Representatives that served as plaintiffs in the MDL Case had their computers forensically imaged, alongside their cell phones and other electronic devices. Id. Each of the Settlement Class Representatives that served as plaintiffs in the MDL case also prepared for and sat for depositions, two of whom traveled from Israel to the United States to do so. Id. ¶ 3.

The Court finds the requested Service Awards reasonable. The requested $2,500 and $5,000 payments for eight of the Settlement Class Representatives is set at or below the Ninth Circuit's benchmark award for representative plaintiffs. See In re Online DVD-Rental, 779 F.3d at 947-48; In re Mego Fin. Corp. Sec. Litig., 213 F.3d 454, 463 (9th Cir. 2000). Moreover, this Court has awarded the same amount to representative plaintiffs in similar circumstances. See In re Yahoo Mail Litig., No. 13-CV-4980-LHK, 2016 WL 4474612, at *11 (N.D. Cal. Aug. 25, 2016) (awarding $5,000 where the representative plaintiffs produced personal and work emails, responded to interrogatories, and testified at depositions).

For the remaining eight Settlement Class Representatives, the larger $7,500 figure is justified by the record. These eight Settlement Class Representatives were deposed and had their computers and electronic devices forensically imaged to produce an exact copy of their contents for Defendants' review. As to depositions, courts grant higher service awards to plaintiffs who have been deposed. See Garner v. State Farm Mut. Auto. Ins. Co., No. 08-CV-01365-CW, 2010 WL 1687832, at *17 (N.D. Cal. Apr. 22, 2010) (awarding $20,000 and taking into consideration that the named plaintiff "made herself available for deposition on two separate occasions, wherein she was subjected to questioning regarding her personal financial affairs and other sensitive subjects"). As to forensic imaging of personal devices, courts have recognized that intrusive discovery warrants a higher service award. See In re Anthem, 2018 WL 3960068, at *31 (awarding higher service awards to plaintiffs who "had their computers and electronic devices forensically examined to produce an exact copy of their contents").

Further, as discussed above, the requested Service Awards ($87,500 in total) represent less than .1% of the Settlement Fund. See In re Online DVD-Rental, 779 F.3d at 947-48 (holding that awards cumulatively representing 0.17% of the settlement fund were reasonable); Rhom v. Thumbtack, Inc., No. 16-CV-02008-HSG, 2017 WL 4642409, at *8 (N.D. Cal. Oct. 17, 2017) ("A $5,000 award also equals approximately 1-2% of the total settlement fund, which is consistent with other court-approved enhancements."); Perkins, 2016 WL 613255, at *17 (approving service awards of $1,500.00 to the nine named Plaintiffs, compared to a pro rata recovery of $20.00 for the unnamed Class Members, when the service awards represented merely 0.1% of the total settlement). This percentage does not approach the 6% of the settlement fund in Staton that went to service awards. 327 F.3d at 948-49, 976-77. Settlement Class Members receive a significant benefit, and the requested service awards represent only a small fraction of the Settlement. Thus, the Court finds the suggested award amounts to be reasonable.

Three objectors challenge the Service Awards. ECF Nos. 429; 424; 438-1 Ex. G. First, objector James McCain argues that the Service Awards render the Settlement Class Representatives inadequate under Rule 23. ECF No. 429 at 6-7. The Court has rejected that argument. See supra Section I.A.4.

Second, objector Jeromy Carpenter summarily argues that the Settlement Class Representatives "will enjoy a windfall for having done very little work." ECF No. 438-1 Ex. G. The Service Awards are not a "windfall" here. Instead, as outlined above, the Service Awards compensate the Settlement Class Representatives for their active participation in litigation and discovery on behalf of the Settlement Class. Moreover, the low "number of named plaintiffs receiving incentive payments" and the low "proportion of the payments relative to the settlement" also underscore the reasonableness of the Service Awards in the instant case. In re Online DVD-Rental, 779 F.3d at 947.

Third, and finally, objector Ryan Bowman argues that the Settlement should be rejected because the Settlement Class Representatives are in fact entitled to larger Service Awards of $75,000, $50,000, or $25,000, depending on each Settlement Class Representative's actions. ECF No. 424 at 15. Bowman believes that larger Service Awards are warranted because the Settlement Class Representatives gave up "their constitutional rights to privacy" in order to undertake the instant case. Id. To the extent that Bowman refers to the forensic imaging of certain Settlement Class Representatives' electronic devices, the Service Awards are in line with other awards in this district. See In re Anthem, 2018 WL 3960068, at *31 (awarding $7,500 to named plaintiffs because "named Plaintiffs had their computers and electronic devices forensically examined to produce an exact copy of their contents"). The Court declines to adjust the Service Awards upward in the instant case, as there is no evidence that any of the Settlement Class Representatives performed a role that would entitle them to such large awards. The Court therefore overrules the foregoing objections.

VIII. CONCLUSION

For the foregoing reasons, the Court GRANTS Plaintiffs' motion for final approval of the proposed class action Settlement, and GRANTS in part Class Counsel's motion for approval of attorneys' fees, costs, and expenses and incentive awards as follows:

• $22,763,642.70 in attorneys' fees to Class Counsel;

• $1,477,609.54 in unreimbursed costs and expenses to Class Counsel;

• $60,000 cost reserve for retention of a cybersecurity expert;

• $87,500 in Service Awards ($2,500 to Jana Brabcova, Reid Bracken, Hilary Gamache, Jared Pastor, and Brendan Quinn; $5,000 to Brian Neff, John Bell, and Michael Bouras; and $7,500 to Andrew Morensen, Mali Granot, Paul Dugas, Yaniv Rivlin, Matthew Ridolfo, Deana Ridolfo, Kimberly Heines, and Hashmatullah Essar).

IT IS SO ORDERED.

Dated: July 21, 2020

/s/_________

LUCY H. KOH

United States District Judge