Opinion · District Court, D. Maryland

In re Retina Group of Washington Data Security Incident Litigation

In re Retina Grp. of Wash. Data Sec. Incident Litig., No. 8:24-cv-00004, UP11104890 (District Court, D. Maryland July 21, 2025)

Type
Opinion
Court
District Court, D. Maryland
Jurisdiction
Maryland
Date
2025-07-21
Topic
litigation

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND : IN RE RETINA GROUP OF WASHINGTON DATA SECURITY : Consolidated No. DKC 24-0004 INCIDENT LITIGATION : MEMORANDUM OPINION Presently pending and ready for resolution in this data breach class action are the motions for attorney fees (ECF No. 38) and for final approval of the class action settlement filed by Jennifer Boehles, Kwame Dapaah-Siakwan, Natalia Girard, Sharon Jenkins, Desiree McCormick, David Puckett, Katherine Traynham, Shalane Vance, Mary Vandenbroucke (“Named Plaintiffs”). (ECF No. 42). Named Plaintiffs have also filed supplements to their motion for settlement approval. (ECF Nos. 46; 51).

Citator

UpLaw has not yet analyzed In re Retina Group of Washington Data Security Incident Litigation. The absence of a flag is not a finding that it is good law.

          IN THE UNITED STATES DISTRICT COURT                        
             FOR THE DISTRICT OF MARYLAND                            

                           :                                         
IN RE RETINA GROUP OF                                                     
WASHINGTON DATA SECURITY        :  Consolidated No. DKC 24-0004           
INCIDENT LITIGATION                                                       
                           :                                         

                  MEMORANDUM OPINION                                 
Presently pending and ready for resolution in this data breach       
class action are the motions for attorney fees (ECF No. 38) and           
for final approval of the class action settlement filed by Jennifer       
Boehles,  Kwame  Dapaah-Siakwan,  Natalia  Girard,  Sharon  Jenkins,      
Desiree  McCormick,  David  Puckett,  Katherine  Traynham,  Shalane       
Vance, Mary Vandenbroucke (“Named Plaintiffs”).  (ECF No. 42).            
Named Plaintiffs have also filed supplements to their motion for          
settlement  approval.    (ECF  Nos.  46;  51).    The  court  held        
a fairness hearing on July 15, 2025.  For the following reasons,          
the motions will be granted in part and the case dismissed.               
I.   Background                                                           
Defendant Retina Group of Washington, PLLC (“Defendant”) is          
a “healthcare company that provides ophthalmology and vision care         
services.”  (ECF No. 35-1, at 8).  On March 26, 2023, Defendant           
experienced a data breach (the “Data Breach” or “Data Incident”),         
potentially  exposing  the  personally  identifiable  information         
and/or personal health information of the Named Plaintiffs and            
approximately  450,000   individuals  (“Settlement  Class,”   and         
together with Named Plaintiffs, “Plaintiffs”).  (Id.).  Multiple          
lawsuits  were  filed  against  Defendant,  and  eventually,  the         
lawsuits were consolidated.  (ECF Nos. 35-1, at 9; 20).  On March         

18, 2024, Plaintiffs filed an amended consolidated class action           
complaint  (the  “Complaint”).    (ECF  No.  21).    On  May  2,  2024,   
Defendant filed a motion to dismiss for lack of jurisdiction and          
failure  to  state  a  claim.    (ECF  No.  29).    On  June  17,  2024,  
Plaintiffs filed a response in opposition.  (ECF No. 32).  On July        
1,  2024,  Defendant  filed  a  reply  in  support  of  its  motion  to   
dismiss.  (ECF No. 33).                                                   
On August 30, 2024, the case was reassigned to Judge Lisa W.         
Wang, Court of International Trade, sitting in the United States          
District    Court   for    the    District   of    Maryland    by         
designation.   Following  arms-length  negotiations  with  counsel,       
(ECF No. 35-3, at 3), Plaintiffs and Defendant (the “Parties”)            

reached  a  settlement  agreement  (“Settlement  Agreement”)  and         
notified the court on December 5, 2024.  (ECF No. 34).  On January        
21, 2025, Plaintiffs filed an unopposed motion for preliminary            
approval of the class action settlement. (ECF No. 35).  On February       
18, 2025, Judge Wang granted the motion, concluding that “[t]he           
terms of the Settlement Agreement are preliminarily approved as           
fair, reasonable, and adequate.”  (ECF No. 36, at 3).  Judge Wang         
also preliminarily certified the class; preliminarily approved the        
                           2                                         
settlement subject to further consideration at the final fairness         
hearing;   appointed  Named   Plaintiffs   to  serve   as   class         
representatives; appointed Ben Barrow, Gary M. Klinger, and Tyler         

J. Bean to serve as class counsel (“Class Counsel”); appointed            
Verita  Global,  LLC  to  serve  as  the  settlement  administrator       
(“Settlement Administrator”); approved the class notice, claim,           
and  exclusion  and   objection  process;  approved  the   notice         
protocols; and scheduled a final fairness hearing. (ECF No. 36, at        
1-11).                                                                    
The  preliminarily  approved  Settlement  Agreement  created  a      
Settlement Class of approximately 450,000 individuals consisting          
of residents of the United States identified on the Settlement            
Class List whose personal information may have been involved in           
the data security incident on or about March 26, 2023, and who do         
not meet an exclusion.  (ECF Nos. 36, at 1-2; 35-2, at 7; 42-1, at        

9).                                                                       
The  Settlement  Agreement  called  for  a  settlement  fund         
(“Settlement Fund”) of $3,600,000 to be used for notice and claims        
administration  costs,  any  taxes  owed,  service  awards  to  Named     
Plaintiffs,  attorneys’  fees  and  costs,  and  benefits  to  the        
Settlement Class Members, with any remaining amount to be donated         
to the Maryland Bar Foundation, Inc.  (ECF No. 35-2, at 8, 14).           
In exchange, the Settlement Class would agree to release all claims       
                           3                                         
arising out of the Data Incident. (ECF Nos. 35-2, at 36; 35-3, at         
4).                                                                       
The notice was mailed to 449,129 Settlement Class members.           

(ECF No. 42-1, at 14).  Verita estimates that the notices reached         
91% of the Class.  (Id.).  Approximately 39,869 notices came back         
as undeliverable for which a search turned up no other updated            
address.    (Id.).    The  Settlement  Administrator also  created  a     
settlement website and a toll-free call line.  As of May 20, 2025,        
there were 1,253 calls made to the call line.  (Id. at 15).               
On  May  9,  2025,  Plaintiffs  filed  an  unopposed  motion  for    
attorneys’ fees, reimbursement of expenses, and service awards for        
the Named Plaintiffs.  (ECF No. 38).  On May 23, 2025, Plaintiffs         
filed  an  unopposed  motion  for  final  approval  of  class  action     
settlement.  (ECF  No.  42).    On  June  10,  2025,  the  case  was      
reassigned to the undersigned, and a fairness hearing was scheduled       

for  July  15,  2025.    (ECF  No.  44).    On  June  13,  2025,  after   
consulting counsel, the court denied Defendant’s motion to dismiss        
as moot in light of the Parties’ settlement.  (ECF No. 45).  On           
June 30, 2025, Plaintiffs filed a supplement to their motion for          
final approval of class action settlement.  (ECF No. 46).  The            
supplement stated that twenty-three class members opted out of the        
Settlement Agreement, and two class members filed a joint objection       
to the Settlement Agreement. (ECF No. 46, at 2-3).  No objectors          
                           4                                         
appeared at the July 15, 2025 fairness hearing.  After the hearing,       
Plaintiffs  filed  a   Second  Supplement,  updating  the   claim         
information and clarifying the expected amount of costs for notice        

and administration expenses. (ECF No. 51).                                
II.  Analysis                                                             
After considering the terms of the Settlement Agreement; the         
motion  for  attorneys’  fees,  reimbursement  of  expenses,  service     
awards for Named Plaintiffs, final approval of the settlement, and        
final certification of the class; and the statements of counsel           
for both Parties at the final fairness hearing held on July 15,           
2025,  the  court  concludes  that  Plaintiffs  have  sufficiently        
demonstrated standing, the Settlement Class should receive final          
certification; the Settlement Agreement is fair, reasonable, and          
adequate;  and  Class  Counsel’s  request  for  attorneys’  fees  and     
expenses,  as  well  as  service  awards  for  the  Named  Plaintiffs,    

should be granted in part.                                                
A.   Standing                                                        
Defendant’s initial response to the Complaint was to move to         
dismiss, both for lack of standing and for failure to state a             
claim.  (ECF No. 29, at 1).  After the Parties reached a settlement,      
Defendant stated that the motion was moot, and the court denied           
Defendant’s motion on that ground. (ECF No. 45).  Later, however,         

                           5                                         
the court directed the Parties to address the standing issue at           
the fairness hearing.1  (ECF No. 49).                                     
 “[T]o establish standing, a plaintiff must show (i) that he         

suffered an injury in fact that is concrete, particularized, and          
actual or imminent; (ii) that the injury was likely caused by the         
defendant; and (iii) that the injury would likely be redressed by         
judicial relief.”  TransUnion LLC v. Ramirez, 
594 U.S. 413, 423
           
(2021) (citing Lujan v. Defenders of Wildlife, 
504 U.S. 555
, 560–         
561 (1992)).                                                              
     In evaluating a class action complaint, “we                     
     analyze standing based on the allegations of                    
     personal injury made by the named plaintiffs.”                  
     See Beck [v. McDonald], 848 F.3d [262,] [] 269                  
     [(4th Cir. 2017)] (citing Doe v. Obama, 
631 F.3d 157, 160
  (4th  Cir.  2011)).  And  class                
     plaintiffs  cannot   meet  their  burden   to                   
     establish  standing  “[w]ithout  a  sufficient                  
     allegation of harm to the named plaintiff in                    
     particular.”  
Id.
  (quoting  Doe,  
631 F.3d at 160
).  When  a  complaint  is  evaluated  at  the               
     pleading  stage,  however,  “general  factual                   
     allegations  of  injury  resulting  from  the                   
     defendant’s  conduct  may  suffice,  for  on  a                 
     motion  to  dismiss  we  presume  that  general                 
     allegations embrace those specific facts that                   
     are necessary to support the claim.” See Lujan                  
     v. Defenders of Wildlife, 
504 U.S. 555, 561
,                    
     
112 S.Ct. 2130
,  
119 L.Ed.2d 351
   (1992)                   
     (internal  quotation  marks  and  alterations                   
     omitted). Accordingly, “we accept as true” the                  
     “allegations  for  which  there  is  sufficient                 

1 Even if the Parties no longer dispute standing, the court          
must ensure Plaintiffs have standing.  See Frank v. Gaos, 
586 U.S. 485, 492
  (2019)  (per  curiam)  (finding  that  a  federal  court’s     
obligation  to  ensure  standing  “extends  to  court  approval  of       
proposed class action settlements”).                                      
                           6                                         
     ‘factual matter’ to render them ‘plausible on                   
     [their]  face.’”  See  Beck,  848  F.3d  at  270                
     (quoting Ashcroft v. Iqbal, 
556 U.S. 662, 678
,                  
     
129 S.Ct. 1937
, 
173 L.Ed.2d 868
 (2009)).                        

Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc., 
892 F.3d 613, 619-20
 (4th Cir. 2018).                                                   
     Additionally,  “when  the  actions  of  a  third                
     party are involved, ‘[t]he case or controversy                  
     limitation of Art. III still requires that a                    
     federal court act only to redress injury that                   
     fairly can be traced to the challenged action                   
     of the defendant, and not injury that results                   
     from  the  independent  action  of  some  third                 
     party not before the court.’” Springmeyer v.                    
     Marriott Int’l, Inc., No. 20-cv-867-PWG, 
2021 WL 809894
,   at    *2   (D.Md.   Mar.    3,                   
     2021) (alteration  in  original)  (quoting Doe                  
     v. Obama, 
631 F.3d 157, 161
 (4th Cir. 2011)).                   

Gordon v. Zeroed-In Technologies, LLC, No. 23-CV-3284-BAH, 
2025 WL 936415
, at *4 (D.Md. Mar. 26, 2025).                                      
Standing  analysis  differs  depending  on  the  stage  of  the      
litigation: pleading, summary judgment, or trial.  Beck, 848 F.3d         
at 270; Lujan, 
504 U.S. at 561
.  Ultimately, “every class member          
must  have  Article  III  standing  in  order  to  recover  individual    
damages.”    TransUnion,  
594 U.S. at 431
.    In  the  class  action   
settlement context, however, “federal courts lack jurisdiction if         
no named plaintiff has standing.”  Frank, 
586 U.S. at 492
 (citing         
Simon  v.  Eastern  Ky.  Welfare  Rts.  Org.,  
426 U.S. 26
,  40  n.20   
(1976)).  This case settled at the pleading stage, before the court       
had addressed Defendant’s motion to dismiss.  The Parties assume          
                           7                                         
that Plaintiffs must only meet the pleading standard to secure            
federal  court  jurisdiction  necessary  for  approval  of  their         
Settlement Agreement.  Thus, Plaintiffs must clearly allege facts         

demonstrating each element of Article III standing.                       
1.   Injury in Fact                                                  
“To establish injury in fact, a plaintiff must show that he          
or she suffered ‘an invasion of a legally-protected interest’ that        
is  ‘concrete  and  particularized’  and  ‘actual  or  imminent,  not     
conjectural or hypothetical.’” Spokeo, Inc. v. Robins, 
578 U.S. 330, 339
 (2016) (quoting Lujan, 
504 U.S. at 560
 (1991)).                  
     [W]hile it is true that threatened rather than                  
     actual injury can satisfy Article III standing                  
     requirements, . . . not    all     threatened                   
     injuries   constitute   an    injury-in-fact.                   
     Rather, as the Supreme Court has emphasized                     
     repeatedly, an injury-in-fact must be concrete                  
     in both a qualitative and temporal sense. The                   
     complainant must allege an injury to himself                    
     that is distinct and palpable, as opposed to                    
     merely abstract.                                                

Hutton, 
892 F.3d at 621
  (quoting Beck,  848  F.3d  at  271).  As        
recently discussed by Judge Hurson in Gordon, 
2025 WL 936415
, at          
*5, two cases from the United States Court of Appeals for the             
Fourth Circuit guide the standing analysis in data breach cases.          
See Beck, 848 F.3d at 274-75 (holding that a threat of future risk        
of identity theft alone is not sufficient for standing); Hutton,          
892 F.3d at 622
 (distinguishing Beck and holding that allegations         
of actual misuse such as identity theft and credit card fraud are         
                           8                                         
enough  for  injury  in  fact).    Judge  Hurson  found  that  the        
allegations in his case were more like those in Hutton, because           
“all Plaintiffs except two set forth allegations of actual misuse.”       
Gordon, 
2025 WL 936415
, at *5.  Judge Hurson detailed the various         

allegations of the plaintiffs, including specific allegations of          
“loss  of  privacy,  diminished  value  of  [personally  identifying      
information], fraud and identity theft, imminent threat of fraud          
and  identity  theft,  out-of-pocket  expenses  and  lost  time  and      
productivity  spent  remedying  or  mitigating  the  Data  Breach’s       
impacts, and emotional harm.”  Id. at *4-5.  Additionally, several        
plaintiffs alleged that their information was found on the dark           
web.    Id.  at  *5.    Accordingly,  Judge  Hurson  found  that  the     
plaintiffs had alleged injury in fact sufficient for standing.            
Id. at *5-6.                                                              
Similarly, Plaintiffs allege that because of the Data Breach,        

Plaintiffs are at increased risk of identity theft, (ECF No. 21 ¶¶        
68-71), they lost time mitigating the risk of identity theft and          
fraud (Id. ¶¶ 72-73), the value of their private information was          
diminished (Id. ¶¶ 74-76), they will incur future costs of credit         
and identity theft monitoring (Id. ¶¶ 77-78), they experienced a          
loss of the benefit of the bargain of Defendant’s medical services        
(Id. ¶ 79), and they suffered fear, anxiety, and stress.  (Id. ¶          
82).                                                                      
                           9                                         
Additionally, seven of the nine Named Plaintiffs have alleged        
separate  additional  injuries.    Named  Plaintiff  Kwame  Dapaah-       
Siakwan “contact[ed] financial institutions to sort out fraudulent        

activity on their accounts,” “replac[ed] impacted debit cards,”           
“suffered injury in the form of experiencing fraudulent charges,          
for approximately $20, to his Wells Fargo debit card, in or about         
November 2023, which, upon information and belief, was caused by          
the Data Breach,” experienced “his credit score being damaged,            
which, upon information and belief, was caused by the Data Breach,”       
and he “experience[ed] an increase in spam calls, texts, and/or           
emails, which, upon information and belief, was caused by the Data        
Breach.”  (Id. ¶¶ 95-102).                                                
“Soon  after  the  Data  Breach,”  Named  Plaintiff  Jennifer        
Boehles “received notices from several financial institutions with        
which she has accounts, including Chase Bank, Discover, and Bank          

of America, that her account information may have been tampered           
with  and/or  otherwise  compromised,”  and  she  “received  multiple     
targeted  phishing  emails  attempting  to  further  misuse  her          
[p]rivate  [i]nformation.”    (Id.  ¶¶  107-108).    Named  Plaintiff     
Shalane Vance “suffered injury in the form of her credit score            
being damaged, which, upon information and belief, was caused by          
the  Data  Breach,”  and  she  “experience[ed]  an  increase  in  spam    
calls, texts, and/or emails, which, upon information and belief,          
                          10                                         
was caused by the Data Breach.”  (Id. ¶¶ 115-116).  Named Plaintiff       
Sharon Jenkins “experience[ed] an increase in spam calls, texts,          
and/or emails, which, upon information and belief, was caused by          
the Data Breach.”  (Id. ¶ 122).                                           

Named Plaintiff Natalia Girard “suffered injury in the form          
of her Private Information being disseminated on the dark web,            
according to CreditWise, which, upon information and belief, was          
caused by the Data Breach.”  (Id. ¶ 128).  Named Plaintiff David          
Puckett “experience[ed] an increase in spam calls, texts, and/or          
emails, which, upon information and belief, was caused by the Data        
Breach.  (Id. ¶ 134).  Lastly, Named Plaintiff Desiree McCormick          
also  “experience[ed]  an  increase  in  spam  calls,  texts,  and/or     
emails, which, upon information and belief, was caused by the Data        
Breach.”  (Id. ¶ 140).  Therefore, these Named Plaintiffs have            
alleged actual misuse of their personal information.                      

Additionally, Judge Hurson found that the two plaintiffs who         
had  not  alleged  actual  misuse  still  “adequately  pled  imminent     
threat of identity theft” because “[t]he allegations about the            
targeting  of  personal  information  in  the  cyberattack  and  the      
allegations of identity theft by other plaintiffs whose personal          
information was stolen makes the threatened injury sufficiently           
imminent.”  Gordon, 
2025 WL 936415
, at *6 (quoting In re Marriott         

                          11                                         
Int’l, Inc., Customer Data Sec. Breach Litig., 
440 F.Supp.3d 447
,         
460 (D.Md. 2020)).                                                        
Similarly,  Named  Plaintiffs  Katherine  Traynham  and  Mary        

Vandenbroucke who have not alleged actual misuse have still alleged       
“imminent  threat  of   identity  theft”  because  the   specific         
allegations of actual misuse by the other Named Plaintiffs make           
“the  threatened  injury  sufficiently  imminent.”    Accordingly,        
Plaintiffs have sufficiently alleged injuries in fact sufficient          
for standing at the pleading stage.                                       
2.   Traceability                                                    
The “fairly traceable” requirement of standing “ensures that         
there  is  a  genuine  nexus  between  a  plaintiff’s  injury  and  a     
defendant’s alleged illegal conduct.”  Gordon, 
2025 WL 936415
, at         
*9 (quoting Friends of the Earth, Inc. v. Gaston Copper Recycling         
Corp., 
204 F.3d 149, 161
 (4th Cir. 2000)).  At the same time, “[t]he      
fairly traceable standard is not equivalent to a requirement of           
tort causation.”  
Id.
 at *10 (quoting Friends of the Earth, Inc.,         
204 F.3d at 161
) (citation modified).  “It must simply be plausible       

that the [] data breach was the cause of [plaintiff’s] injury.”           
Id.
 (quoting Bank of La. v. Marriott Int’l, Inc., 
438 F.Supp.3d 433
, 441 (D.Md. 2020)). “In data breach cases, traceability is            
satisfied   where    the   complaint   ‘contain[s]    allegations         
demonstrating that it is both plausible and likely that a breach          
                          12                                         
of  the  []  database  resulted  in  the  fraudulent  use  of  the        
[p]laintiffs’ personal information.’”  
Id.
 at *9 (quoting Hutton,         
892 F.3d at 623
).    Specifically,  “Fourth  Circuit  courts  have     

routine[ly] found traceability in the data breach context where           
plaintiffs  provided  defendants  with  [personally   identifying         
information] and those defendants subsequently fell victim to a           
targeted data breach resulting in the disclosure and misuse of            
plaintiffs’ [personally identifying information].”  
Id.
 (quoting          
Capiau v. Ascendum Mach., Inc., No. 3:24-CV-00142-MOC-SCR, 
2024 WL 3747191
, at *7 (W.D.N.C. Aug. 9, 2024)).                                  
As the plaintiffs in Gordon, Plaintiffs have alleged that            
they gave their personally identifying information and personal           
health  information  to  Defendant,  and  Defendant  experienced  the     
Data  Breach  that  involved  Plaintiffs’  personally  identifying        
information and personal health information.  (ECF No. 21 ¶¶ 19,          

28).  As discussed above, Named Plaintiffs have alleged that their        
personally identifying information has been misused following the         
data breach.  (Id. ¶¶ 100-102, 107-108, 115-116, 122, 128, 134,           
140).    Therefore,  accepting  these  allegations  as  true,  the        
Complaint alleges sufficiently that it is plausible and likely            
that Defendant’s data breach “resulted in the fraudulent use of           
the Plaintiffs’ personal information.”                                    

                          13                                         
3.   Redressability                                                  
In their Complaint, Plaintiffs seek damages and injunctive           
relief.  (ECF No. 21, at 38).  For an injury to be redressable,           
“it must be ‘likely,’ as opposed to merely ‘speculative,’ that the        
injury will be ‘redressed by a favorable decision.’”  Lujan, 
504 U.S. at 560
 (1991) (quoting Simon, 
426 U.S. at 38, 43
).  “[I]n a          

breach of data case, ‘there is no reason to believe that monetary         
compensation will not return plaintiffs to their original position        
completely.’”  Hutton, 
892 F.3d at 621
 n.8 (quoting Beck, 848 F.3d        
at 274 n.5).  Plaintiffs seek damages, among other relief, in their       
Complaint.                                                                
Plaintiffs sufficiently alleged all three standing elements          
for  the  pleading  stage;  accordingly,  Plaintiffs  satisfy  the        
threshold requirement to demonstrate standing.                            
B.   Rule 23 Class Certification                                     
For a class action to be certified pursuant to Federal Rule          

of  Civil  Procedure  23,  the  class  must  meet  each  of  the  four    
prerequisites identified in Rule 23(a) and fit within one of the          
three  categories  identified  in  Rule  23(b).  Fed.R.Civ.P.  23.        
District courts must pay “undiluted, even heightened, attention”          
to these requirements when certifying a class for the purpose of          
settlement.  Amchem  Prod.,  Inc.  v.  Windsor,  
521 U.S. 591, 620
     
(1997); see also Grice v. PNC Mortg. Corp. of Am., No. 97-cv–3084-        
                          14                                         
PJM, 
1998 WL 350581
, at *2 (D.Md. May 21, 1998) (“Despite the             
parties’  agreement,  class   certification  must  be   carefully         
scrutinized.”).                                                           
1.   Rule 23(a) Prerequisites                                        

Under Rule 23(a), a group of plaintiffs may sue in a class           
action if:                                                                
     (1) the class is so numerous that joinder of                    
     all members is impracticable;                                   
     (2) there are questions of law or fact common                   
     to the class;                                                   
     (3)   the   claims   or   defenses   of   the                   
     representative  parties  are  typical  of  the                  
     claims or defenses of the class; and                            
     (4) the representative parties will fairly and                  
     adequately protect the interests of the class.                  

The  Settlement  Class  meets  the  numerosity,  commonality,        
typicality, and adequacy requirements.  First, the class contains         
approximately 450,000 people, a number that far exceeds that which        
has met the numerosity requirement in other cases, and joinder            
would certainly be impracticable.  CASA de Md., Inc. v. Arbor             
Realty Tr., Inc., No. 21-CV-1778-DKC, 
2024 WL 1051120
, at *3 (D.Md.       
Mar. 11, 2024) (“A class consisting of as few as 25 to 30 members         
raises  the  presumption  that  joinder  would  be  impractical.”         
(quoting Dameron v. Sinai Hosp. of Balt., Inc., 
595 F.Supp. 1404, 1408
 (D.Md. 1984))).                                                      
Second, there are multiple questions of law and fact that are        
common to all of the class members, such as:                              
                          15                                         
     1. Whether Defendant failed to implement and                    
     maintain  reasonable  security  procedures  and                 
     practices appropriate to the nature and scope                   
     of  the  PHI/PII  compromised  in  the   Data                   
     Incident;                                                       
     2. Whether Defendant’s data security systems                    
     prior to and during the Data Incident complied                  
     with  applicable   data  security  laws   and                   
     regulations;                                                    
     3. Whether Defendant’s data security systems                    
     prior  to  and  during  the  Data  Incident  were               
     consistent with industry standards;                             
     4. Whether Defendant owed a duty to Settlement                  
     Class Members to safeguard their PHI/PII;                       
     5.  Whether  Defendant  breached  its  duty  to                 
     Settlement Class Members to safeguard their                     
     PHI/PII;                                                        
     6. Whether Defendant knew or should have known                  
     that its data security systems and monitoring                   
     processes were deficient;                                       
     7.  What  damages  Plaintiffs  and  Settlement                  
     Class  Members  suffered   as  a  result   of                   
     Defendant’s misconduct; and                                     
     8.  Whether  Plaintiffs  and  Settlement  Class                 
     Members  are   entitled  to   actual   and/or                   
     statutory damages.                                              

(ECF No. 35-1, at 21).  These questions are “capable of classwide         
resolution—which  means  that  determination  of  [their]  truth  or      
falsity will resolve an issue that is central to the validity of          
each one of the claims in one stroke.”  See CASA de Md., Inc.,            
2024 WL 1051120
, at *3 (quoting Wal-Mart Stores, Inc. v. Dukes,           
564 U.S. 338, 350
 (2011)).                                                
Third, the Named Plaintiffs’ claims are typical of the claims        
of the Settlement Class.  As Plaintiffs point out, all the claims         
“arise from the same Data Incident,” and Plaintiffs allege that           
the  private  information  of  the  Named  Plaintiffs  and  the  other    
                          16                                         
members  of  the  Settlement  Class  was  compromised  in  the  Data      
Incident.  (ECF Nos. 35-1, at 22; 21, at 28).  Although the Named         
Plaintiffs  may  have  suffered  different  impacts  from  the  Data      

Incident than every member of the Settlement Class, “a sufficient         
relationship exists between the injury to the named plaintiff[s]          
and the conduct affecting the class, so that the court may properly       
attribute a collective nature to the challenged conduct.”  
Id.
            
(quoting Hewlett v. Premier Salons Int’l, Inc., 
185 F.R.D. 211, 217
 (D.Md. 1997)).  Named Plaintiffs allege that they and all other       
class members were injured in the same Data Incident; therefore,          
they have met the typicality requirement.                                 
Lastly, Named Plaintiffs and Class Counsel are adequate class        
representatives.  “Representation is adequate if: (1) the named           
plaintiff’s  interests  are  not  opposed  to  those  of  other  class    
members,  and  (2)  the  plaintiff’s  attorneys  are   qualified,         
experienced, and capable.”  
Id.
 (quoting Graham v. Famous Dave’s          
of Am., Inc., No. 19-cv-0486-DKC, 
2022 WL 17584274
, at *5 (D.Md.          

Dec.  12,  2022)).    Plaintiffs  assert  that  “[n]either  [Named        
Plaintiffs] nor their counsel have any interests antagonistic to          
the  proposed  Settlement  Class.”    (ECF  No.  35-1,  at   22).         
Additionally,  Class  Counsel  are  “qualified,  experienced,  and        
capable.”    Class  Counsel  assert  that  they  are  “experienced  in    
leading  class  cases  efficiently  and  effectively  and  have  the      
                          17                                         
support of all counsel of record.”  (Id.).  Class Counsel declare         
that they “have adequately represented the Settlement Class by            
fully  investigating  the  facts  and  legal  claims;  preparing  the     

complaints; researching, analyzing, and responding to Defendant’s         
motion to dismiss, and negotiating and reaching a Settlement at           
arm’s length, in good faith, and without collusion.”  (ECF No. 35-        
3, at 5).  Additionally, Class Counsel has “decades of combined           
experience as vigorous class action litigators.”  (Id., at 7).            
Accordingly,   the    four   requirements    set   out   in          
Fed.R.Civ.P.23(a) have been met.                                          
2.   Rule 23(b) Requirements                                         
Additionally, a class must meet the requirements of one of           
the three categories in Federal Rule of Civil Procedure 23(b).            
This case falls into Rule 23(b)(3), which applies when “the court         
finds that the questions of law or fact common to class members           
predominate over any questions affecting only individual members,         

and that a class action is superior to other available methods for        
fairly and efficiently adjudicating the controversy.”  Under Rule         
23(b)(3):                                                                 
     The  matters  pertinent  to  these   findings                   
     include:                                                        

     (A) the   class    members’   interests    in                   
     individually  controlling  the  prosecution  or                 
     defense of separate actions;                                    
                          18                                         
     (B) the extent and nature of any litigation                     
     concerning the controversy already begun by or                  
     against class members; [and]                                    
     (C) the  desirability  or  undesirability  of                   
     concentrating the litigation of the claims in                   
     the particular forum[.]                                         

CASA de Md., Inc., 
2024 WL 1051120
, at *4 (quoting Amchem, 
521 U.S. at 620
) (stating that district courts do not need to analyze         
the fourth factor of “the likely difficulties in managing a class         
action,” when deciding whether to certify a class for settlement          
purposes only).                                                           
As discussed above, there are common questions of law and            
fact among the class members, specifically, that the claims all           
stem from the same Data Incident and whether Defendant’s security         
measures were adequate.  (ECF No. 35-1, at 23).  Additionally,            
there is no indication that any other class members are litigating        
claims  on  their  own.    Further,  a  class  action  is  superior  to   
individual litigation because litigating similar claims of around         
450,000  people  would  be  inefficient.    (ECF  No.  35-1,  at  24).    
Therefore, the requirements under Rule 23(a) and Rule 23(b)(3) are        
met, and the court will grant final certification of the Settlement       
Class.                                                                    
C.   Final Approval of the Settlement Agreement                      
Under Rule 23(e), the claims of a certified class can only be        
settled  with  the  court’s  approval.   The  court  must  conduct  a     
hearing  and  make  a  “finding  that  it  is  fair,  reasonable,  and    
                          19                                         
adequate” prior to approving a settlement agreement that binds the        
class.  Fed.R.Civ.P. 23(e)(2).  “In doing so, the court’s ‘primary        
concern . . . is the protection of class members whose rights may         

not have been given adequate consideration during the settlement          
negotiations.’”  CASA de Md., Inc., 
2024 WL 1051120
, at *4 (quoting       
In re Jiffy Lube Sec. Litig., 
927 F.2d 155, 158
 (4th Cir. 1991)).         
1.   Fairness and Reasonableness                                     
When evaluating the fairness and reasonableness of a proposed        
settlement  agreement,  courts  consider:  “(1)  the  presence  or        
absence of collusion among the parties; (2) the posture of the            
case  at  the  time  settlement  is  proposed;  (3)  the  extent  of      
discovery  that  has  been  conducted;  and  (4)  the  circumstances      
surrounding the negotiations and the experience of counsel.”  
Id.
         
(quoting Graham, 
2022 WL 17584274
, at *7).  “The purpose of this          
inquiry is to protect against the danger that counsel might agree         
to settle for an inadequate amount to secure a fee.”  
Id.
 (quoting        
Graham, 
2022 WL 17584274
, at *7).                                         

The fairness factors weigh in favor of final approval.  There        
is no indication of collusion among the Parties.  Class Counsel           
declared  that  the   Settlement  Agreement  was  reached   after         
“protracted and intense arm’s-length negotiations that took place         
over  an  extended  period  of  time.”    (ECF  No.  42-1,  at  26).      
Additionally,  before  discussing   a  settlement,  the   Parties         
                          20                                         
“completed  an  extensive  investigation  and  exchanged  informal        
discovery.”    (Id.)    The  Parties  had  also  already  briefed         
Defendant’s motion to dismiss.  (ECF Nos. 29, 32, 33).2  Both             

Parties were represented by “highly experienced attorneys familiar        
with class action litigation-and data breach class actions, in            
particular” and were familiar with the legal and factual issues of        
data breach cases.  (ECF No. 42-1, at 26).                                
2.   Adequacy                                                        
     When evaluating whether a proposed settlement                   
     is  adequate,   courts  consider:  “(1)   the                   
     relative strength of the plaintiff’s case on                    
     the  merits  and  probability  of  success  at                  
     trial;  (2)  the  anticipated  duration   and                   
     expense  of  additional  litigation;  (3)  the                  
     solvency of the defendants and the likelihood                   
     of recovery on a litigated judgment; and (4)                    
     the    degree   of    opposition    to    the                   
     settlement.” Graham,  
2022 WL 17584274
,  at                   
     *7 (quoting Singleton  [v.  Domino’s   Pizza,                   
     LLC], 976 F.Supp.2d [665] [] [,] 679 [(D.Md.                    
     2013)]). “The purpose of this inquiry is to                     
     ‘weigh  the  likelihood  of  the  plaintiff’s                   
     recovery  on  the  merits  against  the  amount                 
     offered  in  settlement.’” 
Id.
 (quoting In  re                  
     Mid–Atl. Toyota Antitrust Litig., 564 F.Supp.                   
     at 1384).                                                       

CASA de Md., Inc., 
2024 WL 1051120
, at *5.                                
Overall,  the  adequacy  factors  weigh  in  favor  of  final        
approval.  Defendant moved to dismiss Plaintiffs’ Complaint for           

2 As discussed above, although that motion was denied as moot        
(ECF  No.  45),  the  court  directed  the  Parties  to  address  the     
standing issue at the fairness hearing. (ECF No. 49).                     
                          21                                         
standing and failure to state a claim; however, the court denied          
as moot Defendant’s motion to dismiss in light of the Parties’            
settlement.  (ECF No. 45).  Therefore, at this stage it is not            

even certain Plaintiffs would have survived a motion to dismiss,          
let alone succeed at trial.  Plaintiffs acknowledge that “[d]ata          
breach cases, in particular, face substantial hurdles in surviving        
past  the  pleading  stage  and  are  among  the  riskiest  and  most     
uncertain types of litigation.”  (ECF No. 42-1, at 22).  Plaintiffs       
also point to “the developing nature of this area of law,” as             
contributing to the uncertainty of their success on the merits.           
(Id. at 23).                                                              
In contrast, Plaintiffs assert that the Settlement allows the        
Settlement  Class  to  receive  benefits  now,  including  mitigation     
benefits  through  credit  monitoring,  instead  of  waiting  for         
uncertain benefits that may materialize years down the line.  (ECF        

No.  42-1,  at  23-24).    Plaintiffs  also  contend  that  continued     
litigation would incur significant costs and delay from “costly           
discovery involving experts regarding damages, motions for summary        
judgment,  a  motion  for  class  certification,  and  one  or  more      
interlocutory appeals.”  (Id. at 24).  Instead, the Settlement            
Fund of $3,600,000 would allow Settlement Class members to make a         
claim for:                                                                
     (1)  reimbursement  for  ordinary  documented                   
     losses up to $300.00; (2) compensation for up                   
                          22                                         
     to four hours of lost time compensated at a                     
     rate of $25 per hour; (3) reimbursement for                     
     extraordinary   documented   losses   up   to                   
     $5,000.00; (4) twenty-four months of three-                     
     bureau credit monitoring and identity theft                     
     monitoring  services;  [or]  (5)  a  pro  rata                  
     Alternative Cash Payment estimated to be $100.                  

(Id.).  The Settlement Agreement also benefits Settlement Class           
members  by  creating  “certain  business  practice  changes  and         
remedial measures” by Defendant to protect against future data            
breaches.  (Id.).                                                         
According  to  Plaintiffs’  supplemental  filing,  as  of  the       
postmarked deadline to opt out or object to the Settlement, out of        
approximately  410,000  Settlement  Class  members  who  received         
notice, only twenty-three members opted out, and two have filed a         
joint objection.  (ECF Nos. 42-1, at 25; 46, at 2).  Plaintiffs           
assert that “[t]he small number of opt-outs do not undercut the           
conclusion   that   the   Settlement   satisfies   the   adequacy         
requirement.”  (ECF No. 42-1, at 25).  In light of the large number       
of people who received notice, twenty-three opt-outs does not weigh       
against the adequacy of the Settlement Agreement.                         
Plaintiffs contend that the court should overrule the joint          
objection because it does not provide a reason to deny the final          
approval of the Settlement.  (ECF No. 46, at 3).  In relevant part,       
the joint objection states that:                                          
     First, we have neither observed or do we find                   
     any credible evidence or arguments presented                    
                          23                                         
     that [Defendant] has been or is negligible in                   
     the  secure  protection  of  our  medical  and                  
     personal  records.   Second,  it  is   common                   
     knowledge that clever teams of hackers using                    
     today’s  technology  and  computers  can  break                 
     into  almost   any  system.     Third,   this                   
     settlement will help drive up medical costs                     
     for us all.  And fourth, the payout to any                      
     given patient is a pittance and the primary                     
     benefit will be to the law firms involved.                      

(ECF Nos. 46-1, at 19; 46-2, at 2).                                       
As Plaintiffs note, the joint objection does not attack the          
Settlement Agreement itself; rather, it objects to the lawsuit            
overall.    The  objection  does  not  assert  that  the  Settlement      
Agreement  itself   is  unfair,   inadequate,  or   unreasonable.         
Plaintiffs argue that the attorneys’ fees are reasonable and in           
line with attorneys’ fees awarded in similar cases.  (ECF No. 46,         
at 4).  As will be discussed below, the attorneys’ fees will be           
reduced slightly.  Therefore, the joint objection is not a strong         
“degree of opposition,” and it does not weigh strongly against            
finding that the Settlement Agreement is adequate.  The objection         
is, in effect, overruled.                                                 
Additionally,  Plaintiffs  assert  that  there  is  no  evidence     
that Defendant is in danger of insolvency, and therefore, this            
factor is neutral and does not weigh against granting approval of         
the final settlement.  (Id.).  Overall, given the uncertainty of          
Plaintiffs’  success  in  litigation,  and  the  delay  and  expense      
involved  in  continued  litigation,  the  amount  offered  in  the       
                          24                                         
Settlement Agreement is a positive result for the Settlement Class        
members.  Therefore, the Settlement Agreement will be approved.           
D.   Attorneys’ Fees, Expenses, and Service Awards                   
Under Rule 23, a court may “award reasonable attorney’s fees         

and nontaxable costs that are authorized by law or by the parties’        
agreement.” Fed.R.Civ.P. 23(h). Plaintiffs request attorneys’ fees        
of $1,200,000, which is 33.33% of the Settlement Fund, as set out         
in the Settlement Agreement.  (ECF No. 38, at 1, 6).  Plaintiffs          
also request reimbursement of litigation expenses of $2,637.20,           
and service awards of $2,000 for each of the nine Named Plaintiffs.       
(Id. at 1, 13).                                                           
1.   Attorneys’ Fees                                                 
     “In  determining  whether  an  attorney’s  fee                  
     award is reasonable, courts generally take two                  
     approaches: (1) the ‘percentage of recovery’                    
     or ‘percentage of the fund’ method; or (2) the                  
     ‘lodestar’ method.”  Graham, 
2022 WL 17584274
,                  
     at *10 (quoting Singleton, 976 F.Supp.2d at                     
     681).  “Although this circuit has not decided                   
     which approach to adopt, the ‘current trend                     
     among the courts of appeal favors the use of                    
     a percentage method to calculate an award of                    
     attorneys’ fees in common fund cases.’”  Id.                    
     (quoting  Singleton,  976  F.Supp.2d  at  681).                 
     When  the  percentage  of  the  fund  method  is                
     used,  it  is  supplemented  with  a  lodestar                  
     cross-check.                                                    

CASA de Md., Inc., 
2024 WL 1051120
, at *6.                                
a.   “Percentage of the Fund” Method                                 
     “Under the percentage of the fund method, the                   
     court awards attorneys’ fees as a percentage                    
                          25                                         
     of the common fund used to pay class members.”                  
     Graham, 
2022 WL 17584274
, at *10 (first citing                  
     Blum  v.  Stenson,  
465 U.S. 886
,  900  n.16                  
     (1984); then citing Singleton, 976 F.Supp.2d                    
     at 681).  When using the percentage of the                      
     fund method, district courts in this circuit                    
     typically analyze: “(1) the results obtained                    
     for  the  class; (2)  the  quality,  skill,  and                
     efficiency of the attorneys involved; (3) the                   
     risk of nonpayment; (4) objections by members                   
     of the class to the settlement terms and/or                     
     fees  requested  by  counsel;  (5)  awards  in                  
     similar cases; (6) the complexity and duration                  
     of  the  case;  and  (7)  public  policy.”    Id.               
     (quoting  Singleton,  976  F.Supp.2d  at  682).                 
     “The  factors  ‘need  not  be  applied  in  a                   
     formulaic  way,’   and  no   one  factor   is                   
     necessarily  dispositive.”     Id.   (quoting                   
     Singleton, 976 F.Supp.2d at 682).                               

CASA de Md., Inc., 
2024 WL 1051120
, at *6.                                
i.   Results Obtained for the Class                                  
Class counsel negotiated a non-reversionary Settlement Fund          
of  $3.6  million,  which  allows  for  Settlement  Class  members  to    
receive either “(1) reimbursement for ordinary documented losses          
up to $300.00; (2) compensation for up to four hours of lost time         
compensated  at  a  rate  of  $25  per  hour;  (3)  reimbursement  for    
extraordinary documented losses up to $5,000.00; [and] (4) twenty-        
four months of three-bureau credit monitoring and identity theft          
monitoring  services,”  or  “a  pro  rata  Alternative  Cash  Payment     
estimated to be $100.”  (ECF No. 42-1, at 24).  The claims deadline       
was  June  23,  2025,  and  it  is  not  clear  how  many  claims  for    
reimbursement  for  ordinary  losses,  lost  time,  or  extraordinary     
                          26                                         
losses will receive final approval.  As of Plaintiffs’ supplemental       
filing on July 18, 2025, 14 out of 43 claims for ordinary losses          
were approved, none of the 13 claims for extraordinary losses were        

approved, all of the 764 claims for lost time were approved, all          
of the 1,832 claims for credit monitoring were approved, and all          
of the 12,810 claims for the pro rata cash payment were approved.         
(ECF No. 51, at 2).  Plaintiffs now estimate that the pro rata            
cash payment will be approximately $143.16 per eligible claimant.         
(Id., at 3).                                                              
Given  the  uncertainty  of  Plaintiffs’  success  had  they         
litigated this lawsuit, this is a positive and beneficial result          
for the Settlement Class.                                                 
Additionally, the Settlement Class members received a benefit        
in  the  form  of  Defendant  agreeing  to  “implement  enhanced  data    
security  measures  that  will  protect  Settlement  Class  Members’      

personal information that is still in its possession.”  (ECF No.          
38, at 7).                                                                
ii.  Quality, Skill, and Efficiency of the Attorneys                 
Involved                                                             
Settlement  Class  Counsel  are  experienced  data  breach  and      
class action litigators.  Counsel briefed a motion to dismiss,            
participated  in informal  discovery,  and  negotiated  a  favorable      
deal with a motion to dismiss still pending. (ECF Nos. 38, at 8;          
29;  32;  33).    “Settlement  Class  Counsel’s  collective  history      
                          27                                         
provided them with sufficient leverage to negotiate an excellent          
result for the Settlement Class.”  (ECF No. 38, at 8).                    
iii.  Risk of Nonpayment                                             
     “In  determining  the  reasonableness  of  an                   
     attorneys’  fee  award,  courts  consider  the                  
     relative  risk  involved  in  litigating  the                   
     specific matter compared to the general risks                   
     incurred by attorneys taking on class actions                   
     on  a  contingency  basis.” Boyd  [v.  Coventry                 
     Health  Care  Inc.],  299  F.R.D.  [451,]  []                   
     464 [(D.Md. 2014)] (quoting Jones v. Dominion                   
     Res.  Servs.,  Inc.,  
601 F.Supp.2d 756, 762
                 
     (S.D.W.Va. 2009)).  “The risk undertaken by                     
     class  counsel  is  evaluated  by,  among  other                
     things,  the  presence  of  government  action                  
     preceding the suit, the ease of proving claims                  
     and  damages,  and,  if  the  case  resulted  in                
     settlement, the relative speed at which the                     
     case was settled.”  
Id.
 (first citing Jones,                    
     
601 F.Supp.2d at 762
; then citing Strang v.                     
     JHM Mortg. Sec. Ltd. P’ship, 
890 F.Supp. 499, 503
  (E.D.Va.  1995) (finding  that  risks  to                  
     plaintiffs’   counsel   were   minimized   by                   
     settlement within six-months from the filing                    
     of the complaint and consequently reducing the                  
     percentage  award  from  30%  to  25%  of  the                  
     Settlement Fund)).                                              

CASA de Md., Inc., 
2024 WL 1051120
, at *7 (finding that litigating        
a case for over two years before settling further showed the risk         
to counsel).  This case posed a meaningful risk of nonpayment             
because  Class  Counsel  litigated  the  case  on  a  contingency  fee    
basis, “risking their own time and resources in litigation in a           
relatively new area of law.”  (ECF No. 38, at 8).  Additionally,          
it was far from clear they would have been able ultimately to             
prevail in litigation had they not reached a settlement.  Counsel,        
                          28                                         
however, litigated the case for around one year before settling.          
The initial complaint was filed on January 2, 2024 (ECF No. 1),           
and on December 5, 2024, Class Counsel notified the court that a          

settlement had been reached.  (ECF No. 34).  This length of time          
minimizes  the  risk  to  Class  Counsel,  and  accordingly,  it  is      
appropriate to reduce the percentage award from 33.33% to 30%.            
iv.  Objections                                                      
Settlement Class members were notified by mail of the proposed       
settlement, including the requested attorneys’ fees.  (ECF No. 38,        
at 9).  Only two Settlement Class members objected, and they filed        
a joint objection.  (ECF Nos. 46-1, at 19; 46-2, at 2).  The joint        
objection opposed the litigation overall, and while they mentioned        
the benefit to the law firm, they did not specifically object to          
the amount of attorneys’ fees requested.  (Id.).  Instead, they           
objected in general that “the payout to any given patient is a            
pittance[,]  and  the  primary  benefit  will  be  to  the  law  firms    

involved.”    (Id.).    Additionally,  no  Settlement  Class  members     
objected at the fairness hearing on July 15, 2025.  The lack of           
objections to the specific amount of attorneys’ fees “tends to            
show  that  at  least  from  the  class  members’  perspective,  the      
requested  fee  is  reasonable  for  the  services  provided  and  the    
benefits achieved by class counsel.”  CASA de Md., Inc., 
2024 WL 1051120
, at *7.                                                           
                          29                                         
v.   Awards in Similar Cases                                         
In Boyd, which also involved a $3.6 million settlement fund,         
this court determined that:                                               
     In considering awards in similar cases, courts                  
     look  to  cases  of  similar  size,  rather  than               
     similar  subject  matter. See In  re  Cendant                   
     Corp.  PRIDES  Litig.,  
243 F.3d 722
,   737                   
     (3[]d Cir. 2001); [In re] The Mills Corp. [Sec.                 
     Litig.], 265 F.R.D. [246,] [] 263–64 (E.D.Va.                   
     2009)  (“comparing  the  size  of  the  fund  and               
     percentage of the award in other cases to the                   
     present case . . . provides a valuable point                    
     of  reference.”).  Fees  awarded  under  “the                   
     percentage-of-recovery” method in settlements                   
     under  $100  million  have  ranged  from  15%  to               
     40%. See Stoner v. CBA Information Services,                    
     
352 F.Supp.2d 549, 553
 (E.D.Pa. 2005). Cases                    
     in   this   circuit   involving    settlement                   
     comparable to the $3.6 million settlement fund                  
     here  have  resulted  in  awards  of  attorneys’                
     fees in the ranges of 25% to 28% of the common                  
     fund. See    In   re    SPX    Corp.    ERISA                   
     Litig. (W.D.N.C. 2007)  (28%   of  the   fund                   
     awarded,   where    the   fund    was    $3.6                   
     million); Smith  v.  Krispy  Kreme   Doughnut                   
     Corp., 
2007 WL 119157
,  at  *3   (M.D.N.C.                   
     2007) (26% of the fund awarded where the fund                   
     was     $4,750,000); Mason      v.      Abbot                   
     Labs. (N.D.W.Va.  2001)  (25%  of  the   fund                   
     awarded where the fund was $1,705,200); Braun                   
     v. Culp, Inc. (M.D.N.C. 1985) (25% of the fund                  
     awarded  where  the  fund  was  $1.5  million).                 
     Furthermore, a recent study in the Journal of                   
     Empirical   Studies found  that   for   class                   
     recoveries  in  the  range  of  $2.8  to  $5.3                  
     million, the mean attorneys’ fee percentage                     
     award from 1993–2008 was approximately 26.4%,                   
     and   the  median   was   25.0%. See Theodore                   
     Eisenberg & Geoffrey P. Miller, Attorney Fees                   
     and  Expenses  in  Class  Action  Settlements:                  
     1993–2008, 7  J.Emp.L.Studies  248,  265  T.7                   
     (June 2010).                                                    
                          30                                         
Boyd, 299 F.R.D. at 465 (finding that attorneys’ fees of 28% of           
the settlement fund was an appropriate balance given the range of         
awards); see also CASA de Md., Inc., 
2024 WL 1051120
, at *7 (citing       
Boyd more recently to compare awards in similar cases and finding         

that attorneys’ fees of 30% of the settlement fund is reasonable).        
Additionally, in CASA de Maryland, Inc., this court found it         
useful also to compare attorneys’ fees awards in similar class            
actions.    
2024 WL 1051120
,  at  *7.    In  two  other  data  breach   
settlement  cases  in  this  district,  courts  have  found  that         
attorneys’ fees of 25% and 30% were appropriate.  Brent v. Advanced       
Med. Mgmt., LLC, No. 23-CV-3254-JKB, 
2024 WL 5118528
, at *9 (D.Md.        
Dec.  16,  2024)  (finding  that  a  reduced  award  of  25%  of  the     
settlement fund was appropriate given the short timeline of the           
case and lack of complexity, as well as low risk due to an early          
settlement); Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc.,           

No. 16-CV-3025-JKB, 
2019 WL 3183651
 at *7 (D.Md. July 15, 2019)           
(finding that class counsel’s request of 30% of the settlement            
fund  was  reasonable  in  light  of  all  the  relevant  factors  and    
specifically the length and complexity of the case, including an          
appeal to the Fourth Circuit).  Accordingly, compared to attorneys’       
fees approved in cases of similar fund sizes and similar litigation       
subjects, the reduced fee of 30% of the $3,600,000 Settlement Fund,       
or $1,080,000 is reasonable.                                              
                          31                                         
vi.  Complexity and Duration of the Litigation                       
     “In evaluating the complexity and duration of                   
     the litigation, courts consider not only the                    
     time between filing the complaint and reaching                  
     settlement,  but  also  the  amount  of  motions                
     practice prior to settlement, and the amount                    
     and  nature  of  discovery.”    Graham,  
2022 WL 1758427
,  at  *11  (quoting  Singleton,   976                   
     F.Supp.2d  at  686).  “Additionally,  ‘courts                   
     consider  whether   negotiations  were   hard                   
     fought, complex, or arduous.’” Id. (quoting                     
     Singleton, 976 F.Supp.2d at 686).                               

CASA de Md., Inc., 
2024 WL 1051120
, at *7.  As noted above, there         
was around one year from the time Plaintiffs filed the initial            
complaint until the time they reached a settlement.  (ECF Nos. 1;         
34).    Class  Counsel  acknowledge  that  the  “case  settled  at  a     
relatively early stage[;]” nevertheless, they contend that “it did        
so only after extensive briefing by the Parties on Defendant’s            
[m]otion  to  [d]ismiss,  substantive  informal  discussion,  and  a      
vigorous, arms-length negotiation.”  (ECF No. 38, at 10).  As Class       
Counsel point out elsewhere, data breach litigation is a developing       
area  of  law,   creating  additional  uncertainty  and   perhaps         
complexity in the litigation and negotiations.  (ECF No. 42-1, at         
22-23).  In light of both the relatively short duration and the           
complexity  of  the  case  the  slightly  reduced  fee  award  is         
appropriate.                                                              
vii.  Public Policy                                                  
     “[I]n  assessing  the  reasonableness  of  the                  
     requested  attorneys’  fees,  the  court  must                  
                          32                                         
     strike   the  appropriate   balance   between                   
     promoting  the  important  public  policy  that                 
     attorneys  continue  litigating  class  action                  
     cases  that   vindicate  rights  that   might                   
     otherwise go unprotected, and perpetuating the                  
     public   perception    that   class    action                   
     plaintiffs’  lawyers  are  overcompensated  for                 
     the work that they do.” Boyd, 299 F.R.D. at                     
     466. Here, while litigating data breach cases                   
     is  undoubtedly  important,  a  large  award  in                
     this  case   could   perpetuate  the   public                   
     perception  that   plaintiffs’  lawyers   are                   
     overcompensated,  given  how  short-lived  the                  
     litigation was.                                                 

Brent, 
2024 WL 5118528
, at *8.  In Brent, Judge Bredar found that         
a reduced fee of 25% of the settlement fund was appropriate, in           
part because of the short duration of the litigation.  
Id.
  There,        
the complaint was filed in state court in July 2023, removed to           
federal court in November 2023, stayed on December 6, 2023, the           
parties reached a settlement in principle on December 18, 2023,           
and they finalized the settlement agreement in April 2024.  
Id.
           
It  furthers  public  policy  to  incentivize  attorneys  to         
litigate  data  breach  cases  and  ensure  that  companies  protect      
consumers’ data.  Additionally, Class Counsel worked on this case         
for a year before reaching a settlement, which was longer than the        
class counsel in Brent took to reach their preliminary settlement.        
Therefore, the slightly reduced fee of 30% strikes the appropriate        
balance.                                                                  
                          33                                         
b.   Lodestar Cross-Check                                            
     The purpose of a lodestar cross-check is to                     
     determine  whether  a  proposed  fee  award  is                 
     excessive  relative  to  the  hours  reportedly                 
     worked  by  counsel,  or  whether  the  fee  is                 
     within  some  reasonable  multiplier  of  the                   
     lodestar.  In re Rite Aid Corp. Sec. Litig.,                    
     396  F.3d   [294,  306  (3d  Cir.   2005), as                   
     amended (Feb. 25, 2005)] (“The lodestar cross-                  
     check serves the purpose of alerting the trial                  
     judge that when the multiplier is too great,                    
     the court should reconsider its calculation                     
     under  the  percentage-of-recovery  method”);                   
     Vizcaino v. Microsoft Corp., 
290 F.3d 1043, 1050
  (9th  Cir.  2002)(“[T]he  lodestar  may                   
     provide   a   useful   perspective   on   the                   
     reasonableness of a given percentage award.”).                  
     Importantly, “where the lodestar fee is used                    
     ‘as  a  mere  cross-check’  to  the  percentage                 
     method  of  determining  reasonable  attorneys’                 
     fees, ‘the hours documented by counsel need                     
     not  be   exhaustively  scrutinized  by   the                   
     district  court.’”    In  re  Royal  Ahold  N.V.                
     Securities,  461  F.Supp.2d  at  385  (quoting                  
     Goldberger  [v.  Integrated  Res.,  Inc.],  209                 
     F.3d [43, 50 (2d Cir. 2000)]).                                  

CASA de Md., Inc., 
2024 WL 1051120
, at *9 (quoting Singleton, 976         
F.Supp.2d at 688).  “When performing a lodestar cross-check, courts       
may ‘accept as reasonable counsel’s estimate of the hours they            
have spent working on the case.’”  Id. (quoting Decohen v. Abbasi,        
LLC, 
299 F.R.D. 469, 482-83
 (D.Md. 2014)).                                
Counsel represent that they spend a total of 627 hours on the        
case, for a total of $439,568.20 in attorneys’ fees.  (ECF No. 38-        
1, at 8).  Counsel multiplied each attorney or staff member’s hours       
spent by that person’s billable rates, and employed a multiplier          
                          34                                         
of 2.7 to reach their requested $1,200,000.00,3 or 33.33% of the          
Settlement Fund. (ECF Nos. 38-1, at 8, 11-12, 38-3, at 5; 38-4, at        
5; 38-5, at 2; 38-6, at 2; 38-7, at 2; 38-8, at 2).  This number,         

however, includes work from counsel who were not approved as Class        
Counsel in the preliminary approval of the class action settlement.       
(ECF No. 36, at 3-4).  Judge Wang appointed Ben Barnow from Barnow        
and Associates, P.C., Gary M. Klinger from Milberg Coleman Bryson         
Phillips Grossman PLLC, and Tyler J. Bean from Siri & Glimstad            
LLP.    (Id.)    Accordingly,  only  appointed  Class  Counsel  and       
attorneys and staff from their respective firms will be considered        
for the lodestar cross-check.                                             
Class Counsel’s firm has spent a total of 496.6 hours,4 for          
a combined fee of $348,292.70.5  “Courts have generally held that         
lodestar  multipliers  falling  between  2  and  4.5  demonstrate  a      
reasonable attorneys’ fee.”  CASA de Md., Inc., 
2024 WL 1051120
,          

at  *9  (quoting  Boyd,  
299 F.R.D. at 467
).    Using  Plaintiffs’     


3 It appears that this number is rounded up slightly, because        
$439,568.20 x 2.7 is $1,186,834.10.                                       

4 208.3 (Barnow and Associates, P.C.) + 112.7 (Siri & Glimstad       
LLP)  +  175.6  (Milberg  Coleman  Bryson  Phillips  Grossman  PLLC)      
= 496.6.  (ECF No. 38-1, at 8).                                           

5 $157,312.50 (Barnow and Associates, P.C.) + $62,110.00 (Siri       
& Glimstad LLP) + $128,870.20 (Milberg Coleman Bryson Phillips            
Grossman PLLC) = $348,292.70 (ECF No. 38-1, at 8).                        

                          35                                         
lodestar multiplier of 2.7, the total comes to $940,390.30.6  This        
amount is more consistent with the slightly reduced 30% of the            
Settlement Fund, or $1,080,000, instead of the 33.33% Plaintiffs          

requested.  Therefore, the slightly reduced fee award is reasonable       
in this case.                                                             
2.   Reimbursement for Litigation Expenses                           
     “It is well-established that plaintiffs who                     
     are entitled to recover attorneys’ fees are                     
     also   entitled    to   recover    reasonable                   
     litigation-related expenses as part of their                    
     overall  award.”  Boyd,  
299 F.R.D. at 468
                   
     (quoting Kabore v. Anchor Staffing, Inc., No.                   
     L–10–cv-3204-BEL,  
2012 WL 5077636
,  at  *10                  
     (D.Md. Oct. 17, 2012)). “The Fourth Circuit                     
     has stated that such costs may include ‘those                   
     reasonable out-of-pocket expenses incurred by                   
     the attorney which are normally charged to a                    
     fee-paying client, in the course of providing                   
     legal  services.’”  
Id.
  (quoting  Spell   v.                   
     McDaniel,  
852 F.2d 762, 771
   (4th  Cir.                   
     1988) (internal     quotations     omitted)).                   
     “Examples  of  costs  that  have  been  charged                 
     include  necessary  travel,  depositions  and                   
     transcripts,  computer   research,   postage,                   
     court costs, and photocopying.” 
Id.
 (citing                     
     Almendarez v. J.T.T. Enters. Corp., No. 06–                     
     cv-68-JKS, 
2010 WL 3385362
, at *7 (D.Md. Aug.                   
     25, 2010)).                                                     

CASA de Md., Inc., 
2024 WL 1051120
, at *9.  Plaintiffs request            
reimbursement of $2,637.20 for litigation expenses, for research,         
travel, and filing fees.  (ECF Nos. 38, at 12; 38-1, at 9; 38-3,          
at 6; 38-4, at 5).  This appears reasonable and on the low end            

6 $348,292.70 x 2.7 = $940,390.30                                    
                          36                                         
compared to litigation expenses in similar cases.  See, e.g., Brent       
2024 WL 5118528
,  at  *10  (approving  $25,273.37  in  costs  and       
expenses, with $19,172.50 of that stemming from mediation costs).         

Plaintiffs’ request, however, again includes expenses from counsel        
who were not approved as Class Counsel.  Accordingly, the court           
will grant $2,274.227 in litigation expenses for the approved Class       
Counsel.                                                                  
3.   Settlement Administration Expenses                              
After  the  fairness  hearing,  Plaintiffs  filed  a  second         
supplemental  filing  in  support  of  final  approval  of  the  class    
action settlement.  (ECF No. 51).  Plaintiffs clarified that the          
Settlement  Administrator’s  confirmed  total  costs  of  notice  and     
administration  to  completion  will  be  $395,000.00,  assuming  no      
supplemental  distribution  is  needed.  (ECF  No.  51,  at  2).          
Accordingly, the court will approve the Settlement Administrator’s        
expenses.                                                                 
4.   Reasonableness of the Service Awards                            

Plaintiffs request service awards of a total of $18,000 for          
the nine Named Plaintiffs, meaning $2,000 for each Named Plaintiff.       
(ECF  No.  38,  at  13).    “Incentive  payments  are  ‘often  awarded    


7 $355.50 (Barnow and Associates, P.C.) + $716.37 (Siri &            
Glimstad  LLP)  +  $1,202.35  (Milberg  Coleman  Bryson  Phillips         
Grossman PLLC) = $2,274.22 (ECF Nos. 38-1, at 12; 38-3, at 6; 38-         
4, at 5).                                                                 
                          37                                         
in Rule 23 class actions.’”  CASA de Md., Inc., 
2024 WL 1051120
,          
at *9 (quoting Graham, 
2022 WL 17584274
, at *12). “In determining         
whether an incentive payment is warranted, courts consider the            

actions the plaintiff has taken to protect the interests of the           
class, the degree to which the class has benefited from those             
actions, and the amount of time and effort the plaintiff expended         
in  pursuing  the  litigation.”   
Id.
   (quoting Graham,  
2022 WL 17584274
, at *12) (citation modified).                                    
Plaintiffs  assert   that  the  average   award  per   class         
representative  is  around  $16,000,  and  this  is  far  below  that     
average.    (ECF  No.  38,  at  14).    Plaintiffs  state  that  Named    
Plaintiffs  “took  active  roles  in  the  litigation,  including         
reviewing pleadings, staying in regular contact with Settlement           
Class Counsel about [the] status of the case, remaining informed          
about  settlement  discussions,  being  available  for  consultation      

during the negotiation period, and reviewing and approving the            
settlement agreement.”  (Id. at 13).  In light of Named Plaintiffs’       
participation  and  the   relatively  modest  amount  per   Named         
Plaintiff, the court finds that the service awards are reasonable         
and approves the award of $2,000 to each Named Plaintiff.                 
5.   Maryland Bar Foundation, Inc. as the Non-profit                 
Residual Recipient                                                   
Plaintiffs request that pursuant to the Settlement Agreement,        
the court should approve the Maryland Bar Foundation, Inc. as the         
                          38                                         
non-profit residual recipient.  (ECF No. 42-1, at 27).  “Courts           
commonly approve cy pres distributions for unclaimed funds, such          
as the residue of a class settlement fund.”  Curry v. Money One           
Fed.  Credit  Union,  No.  19-CV-3467-DKC,  
2021 WL 5839432
,  at  *3    
(D.Md. Dec. 9, 2021) (citing McDaniels v. Westlake Servs., LLC,           

No.  11-cv-1837-ELH,  
2014 WL 556288
,  at  *11  (D.Md.  Feb.  7,        
2014)).  “The distribution is designed to put the funds ‘to their         
next best compensation use, e.g., for the aggregate, indirect,            
prospective benefit of the class.’”  
Id.
 (quoting Klier v. Elf            
Atochem, 
658 F.3d 468, 474
 (5th Cir. 2011)).                              
Plaintiffs assert that the Maryland Bar Foundation works to          
“[i]mprove and facilitate the administration of justice,” and it          
provides grants to non-profit organizations in Maryland.  (ECF No.        
42-1, at 27).  Plaintiffs assert that many of the Settlement Class        
members live in or near Maryland, and the potential distribution          

to the Maryland Bar Foundation will benefit the Settlement Class          
members.    (Id.  at  27-28).    Accordingly,  the  Maryland  Bar         
Foundation, Inc. will be approved as the cy pres recipient.               
III.  Conclusion                                                          
For the foregoing reasons, Plaintiffs’ motion for attorneys’         
fees, reimbursement of expenses, and service awards (ECF No. 38),         
will be granted in part and denied in part, and Plaintiffs’ motion        

                          39                                         
for  final  approval  of  class  settlement  (ECF  No.  42),  will  be    
granted.  A separate order will follow.                                   


                                        /s/                          
                              DEBORAH K. CHASANOW                    
                              United States District Judge           


















                          40