Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 1 of 14. PageID #: 24448
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF OHIO
`
`
`
`CASE NO. 1:17-md-2807
`MDL No. 2807
`
`ORDER
`
`
`[Resolving Doc. 522; Doc. 524]
`
`IN RE: SONIC CORP. CUSTOMER
`DATA SECURITY BREACH
`LITIGATION
`
`(FINANCIAL INSTITUTIONS)
`
`
`
`:
`:
`:
`:
`:
`:
`:
`:
`
`
`
`JAMES S. GWIN, UNITED STATES DISTRICT JUDGE:
`
`The parties seek the Court’s approval of their proposed class settlement and attorney’s
`
`fee request.1 On October 6, 2022, the Court held a fairness hearing on the proposed class
`
`settlement and fee request. At that hearing, class counsel and defense counsel both argued
`
`in favor of approving the settlement. No class members have objected to the terms of the
`
`settlement or to the attorney’s fee request.
`
`For the following reasons, the Court APPROVES the class settlement and GRANTS
`
`the attorney’s fee and expenses request. The Court also APPROVES reduced incentive
`
`awards for named class members.
`
`I. Background
`
`a. Litigation History
`
`In 2017, a data breach compromised Sonic customer payment data.2 Impacted
`
`consumers sued Sonic Defendants in multiple lawsuits.3 After the MDL Court consolidated
`
`pretrial proceedings, those consumer lawsuits settled.4
`
`
`1 Doc. 522 (motion for attorney fees); Doc. 524 (motion for class settlement approval).
`2 Doc. 174.
`3 Id.
`4 Id.
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 2 of 14. PageID #: 24449
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`In the current case, Plaintiff Financial Institutions make similar claims. The Financial
`
`Institutions sue for negligence related to insecure systems that arguably allowed the data
`
`breach.5 Plaintiffs allege that Sonic’s negligence required financial institutions to spend
`
`resources to respond to the breach.6
`
`This litigation has spanned more than three years.7 In that time, the parties engaged
`
`in extensive discovery: exchanged “hundreds of thousands of documents”; retained six
`
`experts who served reports; and deposed corporate representatives, class members, third-
`
`party representatives, and experts.8
`
`Over the course of the three years, this Court ruled on numerous motions. The Court
`
`partially granted and partially denied Sonic Defendants’ motion to dismiss.9 The Court
`
`granted Plaintiffs’ motion for class certification.10 The Court denied Sonic Defendants’
`
`summary-judgment motion.11
`
`Before reaching a settlement agreement, the parties also began pretrial motions
`
`practice. The Court granted Sonic’s motion to exclude Plaintiffs’ expert witness on damages
`
`and denied Sonic’s motion to exclude a liability expert witness.12 Three pretrial motions
`
`remain pending: Sonic’s motion to decertify the class, Sonic’s motion for a suggestion of
`
`remand, and Plaintiffs’ motion to bifurcate the trial.13
`
`
`
`5 Doc. 453.
`6 Id. at 1–4.
`7 Doc. 514-1 at 3.
`8 Id. at 6–7.
`9 Doc. 304; Doc. 357.
`10 Doc. 348.
`11 Doc. 453.
`12 Doc. 498.
`13 Doc. 477; Doc. 481; Doc. 503.
`
`
`
`
`-2-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 3 of 14. PageID #: 24450
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`b. Class Certification
`
` In November 2020, the Court certified a class action.14 The Court defined the
`
`certified class as:
`
`All banks, credit unions, and financial institutions in the United States that
`received notice and took action to reissue credit cards or debit cards or
`reimbursed a compromised account from any card brand in the Sonic Data
`Breach.15
`
`In its class-certification decision, the Court found that the Plaintiffs met the Rule 23(a)
`
`requirements for going ahead with a class action. First, the Court found that the class
`
`included thousands of financial institutions, meeting the numerosity requirement.16 Second,
`
`the Court found class members’ claims involved common questions of law and fact,
`
`including whether Sonic Defendants owed a duty to financial institutions and whether Sonic
`
`Defendants acted negligently through their data-security practices.17 Third, the Court found
`
`that the named Plaintiffs presented typical class claims because their negligence claims
`
`centered on Sonic Defendants’ alleged data-security failures.18 Fourth, the Court found that
`
`the named Plaintiffs provided adequate representation.19
`
`In addition to finding that Plaintiffs met the Rule 23(a) prerequisites, the Court also
`
`found that the Plaintiffs met the Rule 23(b) class-action requirements. The Court found that
`
`shared questions predominated over individual questions.20 Additionally, the Court found
`
`that a class action would be superior to individual actions because of the number of financial
`
`
`14 Doc. 343; Doc. 348. The Sixth Circuit denied Sonic Defendants permission to appeal the class certification decision.
`Doc. 447.
`15 Doc. 348 at 1.
`16 Id. at 4.
`17 Id. at 5–6.
`18 Id. at 6–7.
`19 Id. at 8.
`20 Id. at 10–11.
`
`
`
`
`-3-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 4 of 14. PageID #: 24451
`
`Case No. 17-md-2807
`Gwin, J.
`
`institutions affected and because of their claims’ similarity.21
`
`The Court appointed Financial Institution Plaintiffs as the class representatives for the
`
`certified class. The class representatives have diligently prosecuted this litigation.
`
`The Court appointed the following attorneys as Class Counsel in November 2020:
`
`Brian Gudmundson, Zimmerman Reed LLP; and Charles Van Horn, Berman Fink Van Horn
`
`P.C. The Court found that these attorneys could fairly and adequately represent the certified
`
`class. Class counsel have competently represented the class representatives and certified
`
`class in this litigation.
`
`c. Proposed Settlement Agreement
`
`Now, the parties seek final approval of their proposed settlement agreement.
`
`To reach the proposed settlement, the parties negotiated for months.22 The parties
`
`negotiated in at least three full-day mediation sessions with Magistrate Judge Jonathan D.
`
`Greenberg in January and February 2022.23
`
`Under the settlement agreement, Sonic would pay under a per-card formula up to
`
`$5.73 million to resolve class members’ claims.24 This total would include up to $3 million
`
`to pay class members’ claims. Class members may recover $1.00 per card the class member
`
`reissued or $1.50 per card the class member reimbursed for fraud within four weeks of the
`
`breach.25 Sonic also agreed to pay up to $500,000 for settlement administration, up to
`
`$30,000 for class-representative incentive awards, and up to $2.2 million for attorney’s fees
`
`
`
`and expenses.26
`
`21 Id. at 12.
`22 Doc. 514-1 at 12.
`23 Id.
`24 Doc. 514-3 at 14–15.
`25 Id. at 15.
`26 Id.
`
`
`
`
`-4-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 5 of 14. PageID #: 24452
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`d. Class Response to the Settlement
`
`
`
`The claims administrator notified 5,085 potential-class-member
`
`financial
`
`institutions.27 The administrator’s website, which provides information to potential class
`
`members, received 4,056 visits as of September 15, 2022.28
`
`By the end of the claims period, class members had filed 360 claims.29
`
`
`
`Only two class members asked for exclusion from the class settlement.30 No class
`
`members objected to the proposed settlement.31
`
`II. Legal Standard
`
`
`
`Courts in the Sixth Circuit reviewing a proposed class action settlement evaluate
`
`seven factors to determine whether the settlement is “fair, reasonable, and adequate.”32
`
`These factors are:
`
`(1) the risk of fraud or collusion;
`
`(2) the complexity, expense and likely duration of the litigation;
`
`(3) the amount of discovery engaged in by the parties;
`
`(4) the likelihood of success on the merits;
`
`(5) the opinions of class counsel and class representatives;
`
`(6) the reaction of absent class members; and
`
`(7) the public interest.33
`
`
`
`27 Doc. 524-2 at 4.
`28 Id.
`29 Doc. 147 at 1–2.
`30 Doc. 135-1 at 14.
`31 Id.
`32 FED. R. CIV. P. 23(e)(1)(C).
`33 Int’l Union, United Auto., Aerospace, & Agr. Implement Workers of Am. v. Gen. Motors Corp., 497 F.3d 615, 631 (6th
`Cir. 2007) (hereinafter “UAW”).
`
`
`
`
`-5-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 6 of 14. PageID #: 24453
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`The proponents of a settlement bear the burden of proving that the settlement is fair,
`
`adequate, and reasonable.34
`
`Similarly, when determining whether to approve an attorney’s fee request, the
`
`Court’s ultimate inquiry is whether that fee request is reasonable under the circumstances.
`
`Factors relevant to that reasonableness inquiry include:
`
`(1) the value of the benefit to the class;
`
`(2) the value of the services on an hourly basis;
`
`(3) whether attorneys took the case on contingency;
`
`(4) rewarding attorneys who produce societal benefits in order to maintain an
`incentive for others;
`
`(5) the litigation’s complexity; and
`
`(6) the professional skill and standing of class and defense counsel.35
`
`III. Discussion
`
`a. Proposed Settlement
`
`
`
`The Court finds that the proposed settlement is fair, reasonable, and adequate to
`
`compensate the class.
`
`
`
`The seven factors that the Sixth Circuit has recognized as relevant to determining a
`
`class settlement’s fairness all weigh in favor of approving this settlement.
`
`Complexity and Amount of Discovery Favors the Settlement
`
`
`
`This case was highly complex. Plaintiffs brought negligence claims for a nationwide
`
`class of financial institutions. Unlike consumer class actions, this litigation involved legally
`
`sophisticated parties on both sides.
`
`
`34 In re Dry Max Pampers Litig., 724 F.3d 713, 719 (6th Cir. 2013).
`35 Bowling v. Pfizer, Inc., 102 F.3d 777, 780 (6th Cir. 1996); see also Gascho v. Global Fitness Holdings, LLC, 822 F.3d
`269, 280 (6th Cir. 2016) (quoting Moulton v. U.S. Steel Corp., 581 F.3d 344, 352 (6th Cir. 2009)).
`
`
`
`
`-6-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 7 of 14. PageID #: 24454
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`Plaintiffs sought recovery for damages they incurred after Sonic’s data breach
`
`compromised millions of credit and debit cards. Plaintiffs alleged damages for the cost of
`
`reissuing cards and reimbursing fraud that alerted accounts suffered.
`
`Plaintiffs faced a difficult battle in proving that Sonic’s affirmative acts, rather than the
`
`hack, proximately caused their injuries.
`
`This case was both expensive to litigate and potentially exposed Sonic to hundreds of
`
`millions of dollars in potential liability.36 Perhaps because of the high potential liability,
`
`Sonic Defendants vigorously opposed all of Plaintiff’s efforts. Similarly, the parties engaged
`
`in extensive discovery involving both Plaintiffs’ underlying factual claims and experts.
`
`To summarize, Plaintiffs faced a significant risk that they would lose. However,
`
`Defendant Sonic faced extremely large damages exposure if Plaintiffs won.
`
`The Opinions of Class Counsel, Reactions of Class Representatives, and Reactions
`of Absent Class Members Factors Favor Approval
`
`
`
` Both class and defense counsel argued in support of the settlement. No class
`
`representative has objected. Of over 5,000 potential class members, only two opted out of
`
`the settlement, and none objected.37 Further, the class members are sophisticated financial
`
`institutions that can reliably determine whether a settlement furthers their best interests. The
`
`class members’ positive reaction to the settlement therefore favors approval.
`
`Likelihood of Success on the Merits Favors the Settlement
`
`
`
`This case’s merits were uncertain. To establish liability at trial, Plaintiffs would have
`
`to prove that Sonic’s actions, rather than a large transaction processor or the hacker,
`
`
`36 Plaintiff Redstone Federal Credit Union alone alleged over $1 million in damages from the breach. Doc. 197 at 11.
`And around 5,000 institutions received card brand alerts. Doc. 524-2 at 2.
`37 Doc. 524-2 at 14.
`
`
`
`
`-7-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 8 of 14. PageID #: 24455
`
`Case No. 17-md-2807
`Gwin, J.
`
`proximately caused their injuries. Because proximate causation presents a factual jury
`
`question, Plaintiffs’ success was nowhere guaranteed.
`
`
`
`Further, even assuming Plaintiffs succeeded, they still faced an appellate attack on
`
`their success up to and through trial. Inevitably, Defendant would have challenged the
`
`Court’s class certification, the Court’s denial of Defendant’s motion to exclude a liability
`
`expert witness, and numerous evidentiary issues that were bound to arise at trial.
`
`
`
`So, by settling, Plaintiffs avoided the real possibility that the class would be left with
`
`zero recovery. The likelihood of success on the merits (or the uncertainty of success), favors
`
`approving the settlement.
`
`Risk of Fraud or Collusion
`
`
`
`The Court does not find any improper behavior on class counsel’s part. First and
`
`foremost, the parties reached this settlement on the doorstep of trial and after facing
`
`significant defenses at every stage. Magistrate Judge Greenberg mediated the settlement
`
`discussions, which lasted three full days. The combination of the late stage of this litigation
`
`and a neutral and detached magistrate’s involvement in settlement negotiations weighs
`
`against the possibility of fraud or collusion.
`
`Finally, as the Court will discuss in further depth below, class counsel here have not
`
`requested an exorbitant fee amount. In fact, although class counsel sometimes request
`
`lodestar multipliers, 38 the fee counsel requests here is a significant discount from its lodestar
`
`calculations.
`
`
`38 See, e.g., In re Oral Sodium Phosphate Solution-Based Prods. Liability Action, No. MDL 2066, 2010 WL 5058454, at
`*4–5 (N.D. Ohio Dec. 6, 2010).
`
`
`
`
`-8-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 9 of 14. PageID #: 24456
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`For those reasons, the Court finds that the facts discussed above weigh against any
`
`finding that there was fraud or collusion in this settlement’s formation.
`
`Public Interest
`
`The final UAW factor—whether the settlement is in the public interest—also weighs
`
`in favor of approval.
`
`The public interest strongly favors settling class actions.39 Further, the public interest
`
`favors compensating attorneys for bearing the risk and expense of litigating class actions
`
`when necessary, instead of simply settling those cases at the first opportunity or not bringing
`
`those cases at all. As such, the public interest factors favor the proposed settlement.
`
`For those reasons, the Court finds that the proposed settlement is fair, reasonable, and
`
`adequately compensates the class. The Court therefore APPROVES the proposed settlement.
`
`b. Attorney’s Fee and Expenses
`
`
`
`Class counsel propose using the lodestar method to calculate a reasonable fee in this
`
`case. Class counsel also argues that its proposed attorney’s fee remains reasonable when
`
`cross-checked as a percentage of the total settlement.
`
`1. Lodestar Calculation
`
`
`
`The Court finds that class counsel’s requested rates and number of hours are
`
`reasonable.
`
`Class counsel calculates its lodestar using hourly rates between $295.00 and
`
`$1,295.00 for attorney work and rates between $170.00 and $350.00 for non-attorney
`
`
`39 See UAW, 497 F.3d at 632 (noting the “federal policy favoring settlement of class actions”).
`
`
`
`
`-9-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 10 of 14. PageID #: 24457
`
`Case No. 17-md-2807
`Gwin, J.
`
`work.40 The five law firms that have served as class counsel worked a total of 10,262.3 hours
`
`on this case, yielding a lodestar total of $6,095,072.50.
`
`Despite its calculated lodestar, class counsel seeks only $1,639,000.54 in attorney’s
`
`fees. This amounts to approximately 27% of the lodestar total. Applying this discount, class
`
`counsel essentially requests hourly rates between $79.65 and $349.65 for attorney work and
`
`rates between $45.90 and $94.50 for non-attorney work.
`
`
`
`After consulting the LSI-adjusted Laffey Matrix41 and considering the length and
`
`complexity of this case, as well as class counsel’s performance during this litigation, the
`
`Court finds that all of class counsel’s substantially discounted hourly rates and hours spent
`
`for this litigation are reasonable.42
`
`2. Fund-Percentage Crosscheck
`
`
`
`Cross-checking the $1.64 million requested fee against the fund-percentage
`
`calculation supports class counsel’s request.
`
`
`
`Defendant Sonic has agreed to pay up to $3 million to compensate class members’
`
`valid and timely claims. Defendant Sonic has also agreed to pay $500,000 in claims-
`
`administration costs and up to $30,000 in class-representative incentive awards.
`
`
`
`Along with the $1.64 million in fees, class counsel seeks $560,999.46 in expenses.
`
`
`
`40 Doc. 522-2 at 14–18.
`41 See See the Matrix, LAFFEY MATRIX, http://www.laffeymatrix.com/see.html (last visited Oct. 13, 2022) (approving hourly
`rates between $343 and $997 for attorneys during this litigation’s five-year pendency, based on an attorney’s years of
`experience).
`42 See Gascho v. Global Fitness Holdings, LLC, 822 F.3d 269, 280-81 (6th Cir. 2016). The Court is satisfied that the hours
`provided are reasonable based on class counsel’s monthly reports, as well as its past experience calculating attorney’s
`fees, the length and complexity of this case, and class counsel’s affidavits which were averred under penalty of perjury.
`
`
`
`
`-10-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 11 of 14. PageID #: 24458
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`The total hypothetical common fund in this case is therefore $5.73 million. Class
`
`counsel’s requested fee accounts for approximately 29% of the hypothetical common fund.
`
`This is within the ordinary attorney’s fee range.43
`
`3. Reasonable Fee
`
`
`
`The Court finds that class counsel’s hours and fee rates are reasonable. Further, the
`
`fund-percentage crosscheck shows that class counsel requests a reasonable portion of a
`
`hypothetical common fund.
`
`
`
`
`
`For those reasons, the Court APPROVES $1,639,000.54 for class counsel’s fee.
`
`c. Incentive Awards
`
`The Court will approve reduced incentive awards for the named Plaintiffs. Each of
`
`the named Plaintiffs had extensive involvement in this litigation, including responding to
`
`discovery, reviewing filings, and depositions.
`
`However, the Court believes that $10,000 is excessive to adequately compensate the
`
`named Plaintiffs for their role in recovering benefits for the class.44 Incentive awards are most
`
`appropriate “when the award represents a fraction of a class representative’s likely damages”
`
`to ensure that named and unnamed class members’ incentives are aligned.45
`
`Here, a $10,000 incentive exceeds an appropriate fraction of two of the three named
`
`plaintiffs’ likely recovery under the settlement. The three class representatives, American
`
`Airlines Federal Credit Union, Redstone Federal Credit Union, and Arkansas Federal Credit
`
`
`43 See In re Polyurethane Foam Antitrust Litig., 168 F. Supp. 3d 985, 1013 (N.D. Ohio 2016) (“[T]wenty-five percent has
`traditionally been the benchmark standard [for percentage-of-the-fund fee awards], with the ordinary range for attorney’s
`fees between 20–30%.” (internal quotation marks and text modifications omitted)).
`44 See, e.g., Hadix v. Johnson, 322 F.3d 895, 898–99 (6th Cir. 2003) (“[I]ncentive awards are usually viewed as
`extensions of the common-fund doctrine, a doctrine that holds that a litigant who recovers a common fund for the benefit
`of persons other than himself is entitled to recover some of his litigation expenses from the fund as a whole.”).
`45 In re Dry Max Pampers Litig., 724 F.3d 713, 722 (6th Cir. 2013).
`
`
`
`
`-11-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 12 of 14. PageID #: 24459
`
`Case No. 17-md-2807
`Gwin, J.
`
`Union allege that they received Sonic-related alerts for about 7,000, 50,000, and 6,300
`
`cards, respectively.46 Even assuming every alerted-on card qualified for the $1.50 fraud
`
`compensation under the settlement,47 American Airlines would recover $10,500 and
`
`Arkansas would recover $9,450. A $10,000 incentive award would essentially double these
`
`representatives’ recovery.
`
`Plaintiff Redstone, however, could theoretically recover up to $75,000 under the
`
`settlement. But class counsel does not say that Redstone deserves a greater award than the
`
`other named plaintiffs.
`
`The Court therefore APPROVES reduced incentive awards of $7,500 each for Plaintiff
`
`American Airlines Federal Credit Union, Plaintiff Redstone Federal Credit Union, and
`
`Plaintiff Arkansas Federal Credit Union.
`
`d. Costs
`
`
`
`Class counsel also seeks $560,999.46 in costs. The Court finds this amount
`
`reasonable given the length and complexity of this litigation. Further, class counsel provided
`
`the Court with detailed hours and expense reports each month.48
`
`
`
`Because class counsel’s costs were reasonable and well documented, the Court
`
`GRANTS class counsel’s request for costs.
`
`e. Rule 23 Class Certification
`
`
`
`Finally, the Court must ensure that the settlement’s proposed class comports with
`
`Federal Rule of Civil Procedure 23’s requirements for class certification. Here, the parties
`
`
`
`46 Doc. 197.
`47 American Airlines and Arkansas would realistically recover significantly less. Not all alerted-on cards required
`reissuance or fraud mitigation. See Doc. 293 at 5–6.
`48 The Court received monthly expense reports from January 31, 2020 to September 30, 2022.
`
`
`
`
`-12-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 13 of 14. PageID #: 24460
`
`Case No. 17-md-2807
`Gwin, J.
`
`propose to settle a nationwide class comprising all the putative nationwide class’s claims
`
`arising from the data breach.49
`
`The Court previously certified a class of:
`
`All banks, credit unions, and financial institutions in the United States that
`received notice and took action to reissue credit cards or debit cards or
`reimbursed a compromised account from any card brand involved with the
`Sonic Data Breach.50
`
`The Court reaffirms its previous reasoning for granting class certification under Rule 23(a)
`
`and Rule 23(b)(3).51
`
`
`
` The Court thus finds that certifying a nationwide settlement class is appropriate for
`
`settlement.
`
`
`
`49 See Doc. 514-3 at 21.
`50 Doc. 348.
`51 See Doc. 69.
`
`
`
`
`
`
`
`
`-13-
`
`

`

`Case: 1:17-md-02807-JSG Doc #: 527 Filed: 10/17/22 14 of 14. PageID #: 24461
`
`Case No. 17-md-2807
`Gwin, J.
`
`
`IV. Conclusion
`
`
`
`For those reasons, the Court GRANTS the parties’ motion to approve the proposed
`
`settlement. The Court CERTIFIES the nationwide class as defined in the proposed settlement.
`
`The Court also APPROVES incentive awards of $7,500 each for Plaintiff American Airlines
`
`Federal Credit Union, Plaintiff Redstone Federal Credit Union, and Plaintiff Arkansas Federal
`
`Credit Union.
`
`Finally, the Court GRANTS class counsel’s motion for attorney’s fees and costs.
`
`
`
`IT IS SO ORDERED.
`
`
`
`
`
`Dated: October 17, 2022
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`s/ James S. Gwin
` JAMES S. GWIN
` UNITED STATES DISTRICT JUDGE
`
`
`
`
`
`
`-14-
`
`