Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 1 of 49 PageID# 48918

EXHIBIT 1

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 2 of 49 PageID# 48919

UNITED STATES DISTRICT COURTFOR THE EASTERN DISTRICT OF VIRGINIAALEXANDRIA DIVISIONIN RE: CAPITAL ONE CONSUMER)DATA SECURITY BREACH LITIGATION)__________________________________________)MDL No. 1:19md2915 (AJT/JFA)This Document Relates to CONSUMER Cases__________________________________________SETTLEMENT AGREEMENT AND RELEASE

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 3 of 49 PageID# 48920

TABLE OF CONTENTS
1.

RECITALS ................................................................................................................... 1

2.

DEFINITIONS.............................................................................................................. 43.

SETTLEMENT FUND ............................................................................................... 114.

SETTLEMENT FUND ACCOUNT........................................................................... 125.

BUSINESS PRACTICE CHANGES ......................................................................... 146.

PRESENTATION OF SETTLEMENT TO THE COURT ........................................ 14

7.

EFFECTIVE DATE AND TERMINATION ............................................................. 15

8.

CONSUMER SETTLEMENT BENEFITS PLAN .................................................... 17

9.

DUTIES OF SETTLEMENT ADMINISTRATOR ................................................... 17

10.

NOTICE PLAN .......................................................................................................... 19

11.

CAFA NOTICE .......................................................................................................... 21

12.

COVENANTS NOT TO SUE .................................................................................... 21

13.

REPRESENTATIONS AND WARRANTIES........................................................... 21

14.

RELEASES ................................................................................................................. 22

15.

NO ADMISSION OF WRONGDOING .................................................................... 23

16.

OPT-OUTS ................................................................................................................. 26

17.

OBJECTIONS............................................................................................................. 27

18.

SERVICE AWARDS.................................................................................................. 28

19.

ATTORNEYS’ FEES AND EXPENSES................................................................... 28

20.

CONFIDENTIALITY................................................................................................. 29

21.

NOTICES .................................................................................................................... 29

22.

MISCELLANEOUS PROVISIONS........................................................................... 31iCase 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 4 of 49 PageID# 48921

EXHIBITS
1. List of Actions
2. Business Practice ChangesiiCase 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 5 of 49 PageID# 48922

SETTLEMENT AGREEMENT AND RELEASE
This Settlement Agreement and Release is made as of January 31, 2022 by and between,
as hereinafter defined, (a) the Settlement Class Representatives,1 on behalf of themselves and theSettlement Class, and (b) Capital One. This Agreement fully and finally compromises and settles
any and all claims that are, were, or could have been asserted in the litigation styled In re: Capital
One Consumer Data Security Breach Litigation, No. 1:19-md-02915-AJT-JFA (E.D. Va.).
1.

Recitals
1.1.

On July 29, 2019, Capital One announced that it had been the victim of a criminal

cyberattack in which the attacker was able to gain unauthorized access to information relating toapproximately 98 million individuals in the United States stored in Capital One’s cloudenvironment hosted by Amazon.
1.2.

After the announcement of the Data Breach, multiple putative class action lawsuits

were filed against Capital One and Amazon, alleging that Capital One had breached contracts it
had with consumers and that both Capital One and Amazon were negligent, had failed to properly
protect personal information in accordance with their duties, had inadequate data security, were
unjustly enriched by the use of personal data of the impacted individuals, violated certain state
consumer statutes and other laws, and improperly delayed notifying potentially impacted
individuals.
1.3.

On October 2, 2019, the U.S. Judicial Panel on Multidistrict Litigation transferredmore than 20 putative class action lawsuits related to the Data Breach to the Honorable Anthony
J. Trenga in the Alexandria Division of the United States District Court for the Eastern District ofVirginia for coordinated pretrial proceedings.

1 All capitalized terms are defined in Section 2 below.
1Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 6 of 49 PageID# 48923

1.4.

Additional lawsuits against Capital One and Amazon were also transferred to, filedin, or otherwise assigned to the Court and included in coordinated pretrial proceedings as part ofIn re: Capital One Consumer Data Security Breach Litigation, No. 1:19-md-02915-AJT-JFA(E.D. Va.).
1.5.

On December 2, 2019, the Court appointed Class Counsel and authorized them tolitigate all pretrial proceedings and to conduct settlement negotiations on behalf of plaintiffs andabsent putative class members that now comprise the Settlement Class.
1.6.

On March 2, 2020, Class Counsel filed a representative consumer class action

complaint in the Action. Capital One and Amazon each moved to dismiss that complaint, and the
Court granted in part and denied in part those motions by order dated September 18, 2020.2 ClassCounsel amended the representative complaint on September 7, 2020 and October 23, 2020 tosubstitute certain of the Settlement Class Representatives.

Each of the Settlement Class

Representatives is named in the operative Complaint. Defendants denied all wrongdoing, that the
Settlement Class Representatives had suffered the damages they claimed, and that the Actions
were suitable for class treatment.
1.7.

Throughout 2020 and into 2021, Defendants and the Settlement Class

Representatives engaged in far-reaching fact discovery. Such discovery included extensive written
discovery, more than 60 depositions, and the production of hundreds of thousands of documents
spanning millions of pages. Defendants and the Settlement Class Representatives litigatednumerous discovery motions.

2 Though GitHub, Inc. was named as a defendant in certain of the Actions, only Capital One andAmazon were named as Defendants in the operative Complaint.
2

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 7 of 49 PageID# 48924

1.8.

In the early months of 2021, the Parties engaged in expert discovery. Capital One,

Amazon, and the Settlement Class Representatives served four, two, and five expert reports,
respectively, and each disclosed testifying expert sat for a deposition.
1.9.

Expert discovery was followed by comprehensive class certification, dispositive,and Daubert motions practice, and those motions were heard by the Court over several days oforal argument.
1.10.

Parallel to their litigation of the Action, the Parties engaged in arm’s-length

settlement negotiations beginning in March 2020. The negotiations were first overseen by former
United States District Court Judge Layn R. Phillips and later overseen by United States District
Court Judge Leonie M. Brinkema. The Parties engaged in four mediation sessions, on March 21,
2020, November 18, 2020, April 16, 2021, and August 3, 2021, with Judge Brinkema presiding
over the last three conferences.

Informal settlement discussions between the Parties wereconducted in addition to these mediation sessions. The Parties engaged in private and joint
communications with Judge Brinkema to assist on particular issues that arose in these negotiations,and, on December 17, 2021, the Parties executed a binding term sheet, to be superseded by thisAgreement.
1.11.

The Parties recognize the expense and length of proceedings necessary to continue

litigation of the Action through further motion practice, trial, and any possible appeals. The Parties
have taken into account the uncertainty and risk of the outcome of further litigation, and the
difficulties and delays inherent in such litigation. The Parties are also aware of the burdens of
proof necessary to establish liability and damages for the claims alleged in the Action and thedefenses thereto. Based upon their investigation, discovery, and motion practice, as set forth
above, the Parties have determined that the settlement set forth in this Agreement is in their

3

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 8 of 49 PageID# 48925

respective best interests and that the Agreement is fair, adequate, and reasonable. The Parties havetherefore agreed to settle the claims asserted in the Action pursuant to the terms and provisions of
this Agreement.
1.12.

It is the intention of the Parties to resolve the disputes and claims which they have

between them on the terms set forth below.
NOW, THEREFORE, in consideration of the promises, covenants, and agreements herein
described and for other good and valuable consideration acknowledged by each of the Parties tobe satisfactory and adequate, and intending to be legally bound, the Parties do hereby mutuallyagree as follows:2.

Definitions
As used in all parts of this Agreement, including the recitals above, and the exhibits hereto,the following terms have the meanings specified below:
2.1.

“Action” or “Actions” means all the actions listed in Exhibit 1, which are cases thathave been filed in, transferred to, or otherwise assigned to the Court and included in multidistrict
litigation proceeding captioned In re: Capital One Customer Data Security Breach Litigation,
Case No. 1:19-md-02915-AJT-JFA. The definition of “Action” or “Actions” does not include thecase styled Minsky v. Capital One Financial Corporation et al., Case No. 1:19-cv-01472 (AJT)(E.D. Va.).
2.2.

“Administrative Costs” means all reasonable costs and expenses incurred by the

Settlement Administrator in carrying out its duties under this Agreement.
2.3.

“Affiliate” means, with respect to any Entity, any other Entity that directly or

indirectly controls or is controlled by, or is under common control with, such Entity. For purposesof this definition, “control” when used with respect to any Entity means an ownership interest of
at least twenty-five percent (25%) and/or the power to direct the management and policies of such4

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 9 of 49 PageID# 48926

Entity, directly or indirectly, whether through the ownership of voting securities, by contract, orotherwise.
2.4.

“Agreement” or “Settlement Agreement” means this Settlement Agreement andRelease and all of its attachments and exhibits, which the Parties understand and agree set forth allmaterial terms and conditions of the Settlement of the Action between them and which is subject
to approval by the Court.
2.5.

“Amazon” means Amazon.com, Inc. and Amazon Web Services, Inc.

2.6.

“Attorneys’ Fees” means the attorneys’ fees that Class Counsel request the Court

to approve for payment from the Settlement Fund as compensation for Class Counsel’s work inprosecuting and settling the Action.
2.7.

“Business Days” means Monday, Tuesday, Wednesday, Thursday, and Friday,

excluding holidays observed by the U.S. federal government.
2.8.

“Business Practice Changes” means the measures provided for in Exhibit 2 to thisAgreement.
2.9.

“Capital One” means Capital One Financial Corporation, Capital One Bank (USA),

National Association, and Capital One, National Association.
2.10.

“Capital One’s Counsel” means Capital One’s counsel of record in the Action fromthe law firms of King & Spalding LLP and Troutman Pepper Hamilton Sanders LLP.
2.11.

“Class Counsel” means Norman E. Siegel of Stueve Siegel Hanson LLP, Karen

Hanson Riebel of Lockridge Grindal Nauen P.L.L.P., and John A. Yanchunis of Morgan &Morgan Complex Litigation Group.

5

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 10 of 49 PageID#
48927

2.12.

“Class List” means the list of individuals in the United States whose information

Capital One determined was stored in Capital One’s cloud environment hosted by Amazon andthen unlawfully accessed during the Data Breach.
2.13.

“Complaint” means the Second Amended Representative Consumer Class Action

Complaint, at Docket Entry Number 971, filed in the Action on October 23, 2020.
2.14.

“Consumer Settlement Benefits Plan” means the plan for processing claims for anddistributing Settlement benefits to Settlement Class Members, which shall be presented by ClassCounsel to the Court for approval in connection with a motion seeking a Preliminary Approval
Order.
2.15.

“Court” means the Alexandria Division of the United States District Court for the

Eastern District of Virginia, where the Action is pending.
2.16.

“Data Breach” means the cybersecurity incident announced by Capital One on July29, 2019 which Capital One determined compromised the personal information of approximately
98 million U.S. consumers.
2.17.

“Defendants” means Capital One and Amazon.

2.18.

“Effective Date” means the date when all of the conditions set forth in Section 7.1of this Agreement have occurred, provided, however, that Capital One has not exercised its rightof termination under Section 7.2 of this Agreement.
2.19.

“Entity” means any corporation, partnership, limited liability company, association,

trust, or other organization of any type.
2.20.

“Expenses” means the reasonable costs and expenses incurred in litigating the

Action that Class Counsel request the Court to approve for payment from the Settlement Fund.
2.21.

“Final Approval” means entry of a Final Approval Order and Judgment.

6Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 11 of 49 PageID#
48928

2.22.

“Final Approval Hearing” means the hearing to be conducted before the Court todetermine the fairness, adequacy, and reasonableness of the Agreement pursuant to Federal Ruleof Civil Procedure 23 and whether to enter a Final Approval Order and Judgment.
2.23.

“Final Approval Order and Judgment” means an order and judgment that the Court

enters after the Final Approval Hearing, which finally approves the Agreement, certifies the
Settlement Class, dismisses the Defendants with prejudice, and otherwise satisfies the settlementrelated provisions of Federal Rule of Civil Procedure 23 in all respects.
2.24.

“Judgment” means the Final Approval Order and Judgment.

2.25.

“Notice Costs” means all reasonable costs and expenses incurred in connection with

implementing and executing the Notice Plan.
2.26.

“Notice Date” means the date by which notice will be completed, which shall be

one hundred and five (105) days after the Court enters the Preliminary Approval Order.
2.27.

“Notice Plan” means the Settlement notice program to be presented by ClassCounsel to the Court for approval in connection with a motion seeking a Preliminary Approval
Order.
2.28.

“Objection Deadline” means the deadline by which written objections to theSettlement must be filed with the Court. Such deadline shall be forty-five (45) days after the
Notice Date.
2.29.

“Opt-Out Deadline” means the deadline by which written requests for exclusionfrom the Settlement must be postmarked as set forth in the Preliminary Approval Order. Suchdeadline shall be forty-five (45) days after the Notice Date.
2.30.

“Parent” means, with respect to any Entity, any other Entity that owns or controls,

directly or indirectly, at least a majority of the securities or other interests that have by their terms

7Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 12 of 49 PageID#
48929

ordinary voting power to elect a majority of the board of directors, or a majority of others
performing similar function, of such Entity.
2.31.

“Parties” means the Settlement Class Representatives, on behalf of themselves andthe Settlement Class, and Capital One.
2.32.

“Parties’ Counsel” means Class Counsel and Capital One’s Counsel.

2.33.

“Preliminary Approval Order” means an order finding that the Court has Article III

jurisdiction over the Action, determining that the Court will likely be able to approve theSettlement under Federal Rule of Civil Procedure 23(e)(2), and concluding that the Court will
likely be able to certify the Settlement Class for purposes of entering a Judgment. The Preliminary
Approval Order will include, among other things, (i) a procedure for Settlement Class Members
to object to or request exclusion from the Settlement (along with the applicable Objection and OptOut Deadlines), (ii) the date and time of the Final Approval Hearing, and (iii) pertinent informationfrom the Notice Plan and Consumer Settlement Benefits Plan.
2.34.

“Released Claims” means any and all claims, defenses, demands, actions, causesof action, rights, offsets, setoffs, suits, damages, lawsuits, costs, relief for contempt, losses,
attorneys’ fees, expenses, or liabilities of any kind whatsoever, in law or in equity, for any relief
whatsoever, including monetary sanctions or damage for contempt, injunctive or declaratory relief,
rescission, general, compensatory, special, liquidated, indirect, incidental, consequential, or
punitive damages, as well as any and all claims for treble damages, penalties, interest, attorneys’
fees, costs, or expenses, whether a known or Unknown Claim, suspected or unsuspected,
contingent or vested, accrued or not accrued, liquidated or unliquidated, matured or unmatured,that in any way concern, arise out of, or relate to the Data Breach, the facts alleged in the Actions,or any theories of recovery that were, or could have been, raised at any point in the Actions.

8Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 13 of 49 PageID#
48930

2.35.

“Released Parties” means Capital One, Amazon, and any of their current, former,

and future Affiliates, Parents, Subsidiaries, representatives, officers, agents, directors, employees,
contractors, vendors, insurers, Successors, assigns, and attorneys.
2.36.

“Service Awards” means any payments made, subject to Court approval, to (i)Settlement Class Representatives and (ii) any other Settlement Class Member who was deposed in
the Action in recognition of his or her role in litigating this Action.
2.37.

“Settlement” means the settlement of the Action by and between the Parties, andthe terms and conditions thereof as stated in this Agreement.
2.38.

“Settlement Administrator” means Epiq Class Action & Claims Solutions, Inc. A

different Settlement Administrator may be substituted if approved by order of the Court.
2.39.

“Settlement Class” means the approximately 98 million U.S. residents identified by

Capital One whose information was compromised in the Data Breach that Capital One announced
on July 29, 2019, as reflected in the Class List. Excluded from the Settlement Class are (i) Capital
One, any entity in which Capital One has a controlling interest, and Capital One’s officers,
directors, legal representatives, Successors, Subsidiaries, and assigns; (ii) any judge, justice, or
judicial officer presiding over the Action and the members of their immediate families and judicial
staff; and (iii) any individual who timely and validly opts out of the Settlement Class.
2.40.

“Settlement Class Member” or “Member of the Settlement Class” means any

person who is a member of the Settlement Class.
2.41.

“Settlement Class Representatives” means the following plaintiffs and proposedclass representatives named in the Complaint filed in the Action: Brandon Hausauer, Carolyn
Tada, Emily Behar, Gary Zielicke, Emily Gershen, Brandi Edmondson, John Spacek, and Sara
Sharp.

9Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 14 of 49 PageID#
48931

2.42.

“Settlement Fund” means the one hundred ninety million United States Dollars($190,000,000) that Capital One shall pay pursuant to Section 3 of this Agreement.
2.43.

“Settlement Fund Account” means the account described in Section 4 of thisAgreement.
2.44.

“Subsidiary” means, with respect to any Entity, any other Entity of which the first

Entity owns or controls, directly or indirectly, at least a majority of the securities or other intereststhat have by their terms ordinary voting power to elect a majority of the board of directors, orothers performing similar functions, of the other Entity.
2.45.

“Successor” means, with respect to a natural person, that person’s heirs, successors,

and assigns, and, with respect to an Entity, any other Entity that through merger, buyout,
assignment, or any other means or transaction, acquires all of the first Entity’s duties, rights,
obligations, shares, debts, or assets.
2.46.

“Taxes” means (i) any applicable taxes, duties, and similar charges imposed by agovernment authority (including any estimated taxes, interest, or penalties) arising in any
jurisdiction with respect to the income or gains earned by or in respect of the Settlement Fund,
including, without limitation, any taxes that may be imposed upon the Parties or the Parties’Counsel with respect to any income or gains earned by or in respect of the Settlement Fund; (ii)any other taxes, duties, and similar charges imposed by a government authority (including any
estimated taxes, interest, or penalties) relating to the Settlement Fund that the Settlement
Administrator determines are or will become due and owing, if any; and (iii) any and all expenses,
liabilities, and costs incurred in connection with the taxation of the Settlement Fund (including
without limitation, expenses of tax attorneys and accountants).

10

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 15 of 49 PageID#
48932

2.47.

“Unknown Claims” means any and all Released Claims that any Settlement Class

Representative or Settlement Class Member does not know or suspect to exist in his or her favor
as of the Effective Date and which, if known by him or her, might have affected his or her
decision(s) with respect to the Settlement. With respect to any and all Released Claims, the Parties
stipulate and agree that upon the Effective Date, Settlement Class Representatives and Settlement
Class Members shall have waived any and all provisions, rights, and benefits conferred by any lawof any state or territory of the United States, the District of Columbia, or principle of common law
or otherwise, which includes or is similar, comparable, or equivalent to Cal. Civ. Code § 1542,
which provides:
A GENERAL RELEASE DOES NOT EXTEND TO CLAIMSTHAT THE CREDITOR OR RELEASING PARTY DOES NOTKNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT
THE TIME OF EXECUTING THE RELEASE AND THAT, IF
KNOWN BY HIM OR HER, WOULD HAVE MATERIALLY
AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOROR RELEASED PARTY.
The Settlement Class Representatives and Class Counsel acknowledge, and each Settlement Class
Member by operation of law shall be deemed to have acknowledged, that the inclusion of“Unknown Claims” in the definition of Released Claims was separately bargained for and was a
key element of the Settlement Agreement.
3.

Settlement Fund
3.1.

Capital One agrees to make a non-reversionary settlement payment of one hundred

ninety million United States Dollars ($190,000,000) and deposit that settlement payment into theSettlement Fund as follows: (i) within ten (10) Business Days of the Court entering a Preliminary
Approval Order, Capital One shall pay fifteen million United States Dollars ($15,000,000) into theSettlement Fund to pay for Notice Costs and Administrative Costs; and (ii) within ten (10)11Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 16 of 49 PageID#
48933

Business Days of the Effective Date of the Settlement, Capital One shall fund the remainingbalance of the Settlement Fund (i.e., $175,000,000).
3.2.

The Settlement Fund shall be used to pay for (i) Notice Costs; (ii) Administrative

Costs; (iii) Service Awards approved by the Court; (iv) Attorneys’ Fees and Expenses approvedby the Court; and (v) Settlement benefits for the Settlement Class as provided for in the Consumer
Settlement Benefits Plan to be filed by Class Counsel and approved by the Court. In no event shall
Capital One be obligated to pay more than one hundred ninety million United States Dollars($190,000,000) in connection with the Settlement of the Action, including with respect to all
Notice Costs and Administrative Costs. In no event shall any funds revert to Capital One.
4.

Settlement Fund Account
4.1.

The Settlement Fund monies shall be held in the Settlement Fund Account, whichshall be an account established at Huntington Bank.
4.2.

All funds held in the Settlement Fund Account shall be deemed to be in the custodyof the Court until such time as the funds shall be disbursed pursuant to this Agreement or further
order of the Court.
4.3.

No amounts may be withdrawn from the Settlement Fund Account unless (i)authorized by this Agreement; (ii) authorized by the Consumer Settlement Benefits Plan or Notice
Plan, after approval by the Court; or (iii) otherwise approved by the Court.
4.4.

The Parties agree that the Settlement Fund Account is intended to constitute a“qualified settlement fund” within the meaning of Treasury Regulation § 1.468B-1, et seq., andthat the Settlement Administrator shall be the “administrator” within the meaning of Treasury
Regulation § 1.468B-2(k)(3). The Parties further agree that the Settlement Fund Account shall betreated as a qualified settlement fund from the earliest date possible and agree to any relation-back12

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 17 of 49 PageID#
48934

election required to treat the Settlement Fund Account as a qualified settlement fund from theearliest date possible.
4.5.

Upon or before establishment of the Settlement Fund Account, the Settlement

Administrator shall apply for an employer identification number for the Settlement Fund Accountutilizing IRS Form SS-4 and in accordance with Treasury Regulation § 1.468B-2(k)(4), and shallprovide Capital One with that employer identification number on a properly completed and signed
IRS Form W-9.
4.6.

The Settlement Administrator shall file or cause to be filed, on behalf of theSettlement Fund Account, all required federal, state, and local tax returns, information returns,
including, but not limited to, any Form 1099-series return, and tax withholdings statements, inaccordance with the provisions of Treasury Regulation § 1.468B-2(k)(l) and Treasury Regulation§ l.468B-2(1)(2). Any contract, agreement, or understanding with the Settlement Administrator
relating to the Settlement Fund Account shall require the Settlement Administrator or its agent tofile or cause to be filed, on behalf of the Settlement Fund Account, all required federal, state, andlocal tax returns, information returns, including, but not limited to any Form 1099-series return,and tax withholdings statements, in accordance with the provisions of Treasury Regulation§ 1.468B-2(k)(1) and Treasury Regulation § l.468B-2(1)(2). The Settlement Administrator may,
if necessary, secure the advice of a certified public accounting firm in connection with its duties
and tax issues arising hereunder.
4.7.

All Taxes relating to the Settlement Fund Account shall be paid out of theSettlement Fund Account, shall be considered to be an Administrative Cost of the Settlement, andshall be timely paid by the Settlement Administrator without prior order of the Court. Further, theSettlement Fund Account shall indemnify and hold harmless the Parties and the Parties’ Counsel

13Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 18 of 49 PageID#
48935

for Taxes (including, without limitation, taxes payable by reason of any such indemnification
payments).
4.8.

Following its payment of the Settlement Fund monies as described in Section 3.1of this Agreement, Capital One shall have no responsibility, financial obligation, or liability
whatsoever with respect to investment of Settlement Fund Account funds, payment of federal,state, and local income, employment, unemployment, excise, and any other Taxes, penalties,
interest, or other charges related to Taxes imposed on the Settlement Fund Account or its
disbursements, payment of the administrative, legal, accounting, or other costs occasioned by theuse or administration of the Settlement Fund Account.
5.

Business Practice Changes
5.1.

In addition to the monetary relief provided by the Settlement Fund as contemplated

in the Consumer Settlement Benefits Plan to be filed with and approved by the Court, Capital One
has agreed to implement and/or continue the Business Practice Changes described in Exhibit 2 tothis Agreement for a minimum period of two (2) years from the date of Final Approval of theSettlement, except where specifically noted otherwise in Exhibit 2.
6.

Presentation of Settlement to the Court
6.1.

No later than January 31, 2022, the Settlement Class Representatives and ClassCounsel shall file this Agreement along with a motion seeking a Preliminary Approval Orderpursuant to the requirements of Federal Rule of Civil Procedure 23(e)(1). Such motion shall also
include and seek approval of the Notice Plan and Consumer Settlement Benefits Plan.
6.2.

After entry by the Court of a Preliminary Approval Order, and no later than fourteen(14) days before the Final Approval Hearing, Settlement Class Representatives shall file a motion
seeking final approval of the Settlement and entry of a Final Approval Order and Judgment,

14

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 19 of 49 PageID#
48936

including a request that the preliminary certification of the Settlement Class for settlement
purposes be made final.
7.

Effective Date and Termination
7.1.

The Effective Date of the Settlement shall be the first Business Day after all of thefollowing conditions have occurred:
7.1.1. The Parties execute this Agreement;
7.1.2. The Court enters a Preliminary Approval Order, which shall include
approval of the Notice Plan and Consumer Settlement Benefits Plan to be proposed byClass Counsel;
7.1.3. Notice is provided to the Settlement Class in accordance with thePreliminary Approval Order and Notice Plan;
7.1.4. The Court enters a Final Approval Order and Judgment; and7.1.5. The Final Approval Order and Judgment have become final because (i) thetime for appeal, petition, rehearing, or other review has expired; (ii) if any appeal, petition,or request for rehearing or other review has been filed, the Final Approval Order andJudgment are affirmed without material change, or the appeal is dismissed or otherwise
disposed of, and no other appeal, petition, rehearing or other review is pending, and thetime for further appeals, petitions, and requests for rehearing or other review has expired.
7.2.

Capital One may, in its sole discretion, terminate this Agreement upon five (5)Business Days written notice to Class Counsel if:(i)

The Parties fail to obtain and maintain Preliminary Approval consistent withthe material provisions of this Settlement Agreement, and after negotiatingin good faith, the Parties are unable to modify the Settlement in a manner toobtain and maintain Preliminary Approval;

15

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 20 of 49 PageID#
48937

7.3.

(ii)

More than a specified number of individuals submit valid and timely
requests to exclude themselves from the Settlement Class, as agreed to by
the Parties and submitted to the Court for in camera review.

(iii)

The Court fails to enter a Final Approval Order and Judgment under theprovisions of this Settlement Agreement;(iv)

The settlement of the Settlement Class claims, or the Final Approval Orderand Judgment, is not upheld on appeal; or(v)

The Effective Date does not occur for any reason, including but not limited
to the entry of an order by any court that would require either material
modification or termination of the Settlement Agreement.

If this Agreement is terminated under Section 7.2 above, the following shall occur:
7.3.1. Within ten (10) Business Days of receiving notice of a termination eventfrom Capital One’s Counsel, the Settlement Administrator shall pay to Capital One anamount equal to the Settlement Fund, together with any interest or other income earned
thereon, less (i) any Taxes paid or due with respect to such income and (ii) any reasonable
and necessary Administrative Costs or Notice Costs already actually incurred and paid or
payable from the Settlement Fund pursuant to the terms of this Agreement;
7.3.2. The Parties shall return to the status quo in the Action as if the Parties had
not entered into this Agreement;
7.3.3. Any Court orders approving certification of the Settlement Class and anyother orders entered pursuant to this Agreement shall be null and void and vacated, andshall not be used in or cited by any person or entity in support of claims or defenses or insupport or in opposition to a future class certification motion in connection with any further
proceedings in the Action or in any other action, lawsuit, arbitration, or other proceeding
involving a Released Claim; and7.3.4. This Agreement shall become null and void, and the fact of this Settlement
and that Capital One did not oppose certification of a Settlement Class shall not be used or16Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 21 of 49 PageID#
48938

cited by any person or entity in support of claims or defenses or in support of or in
opposition to a future class certification motion in connection with any further proceedingsin the Action or in any other action, lawsuit, arbitration, or other proceeding involving a
Released Claim.
8.

Consumer Settlement Benefits Plan
8.1.

In connection with a motion seeking a Preliminary Approval Order, Class Counsel

shall present to the Court for approval the Consumer Settlement Benefits Plan, which shall describe
in detail, among other things, (i) the benefits available to Settlement Class Members and (ii) theprocess and timing for submitting claims for such benefits.
8.2.

The Settlement Administrator shall be responsible for implementing and executing

the Consumer Settlement Benefits Plan.
8.3.

As specified in Section 3.2, the costs associated with any benefits provided toSettlement Class Members under the Consumer Settlement Benefits Plan shall be paid from theSettlement Fund. For the avoidance of doubt, other than funding the Settlement Fund, Capital One
shall not under any circumstances be responsible for the costs associated with any benefits
provided for under the Consumer Settlement Benefits Plan.
9.

Duties of Settlement Administrator
9.1.

The Parties agree that Class Counsel will retain, subject to Court approval, an

independent Settlement Administrator. The Settlement Administrator shall perform the functions
specified in this Agreement, any functions specified in the Notice Plan or Consumer Settlement
Benefits Plan after Court approval, and any other functions approved by the Court. In addition toother responsibilities that are described elsewhere in this Agreement (and in the Notice Plan andConsumer Settlement Benefits Plan, once approved by the Court), the duties of the Settlement
Administrator shall include:17

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 22 of 49 PageID#
48939

9.1.1. Reviewing, determining the validity of, and processing all claims submitted
by Settlement Class Members;
9.1.2. Establishing a reasonably practical procedure, using information obtained
from Capital One pursuant to Section 10.2, to verify that claimants are Settlement Class
Members.
9.1.3. Establishing and maintaining a post office box for receiving requests for
exclusion from the Settlement Class;9.1.4. Establishing and maintaining a Settlement website;
9.1.5. Responding to Settlement Class Member inquiries via U.S. mail, email, andtelephone;
9.1.6. Establishing a toll-free telephone line for Settlement Class Members to callwith Settlement-related inquiries, and answering the questions of Settlement Class
members who call with or otherwise communicate such inquiries;
9.1.7. Paying Taxes;
9.1.8. Receiving and processing all written requests for exclusion from theSettlement Class and providing copies thereof to the Parties’ Counsel. If the Settlement
Administrator receives any requests for exclusion or other requests after the Opt-Out
Deadline, the Settlement Administrator shall promptly provide copies thereof to theParties’ Counsel;
9.1.9. Within five (5) Business Days after the Opt-Out Deadline, providing a final
report to the Parties’ Counsel summarizing the number of written requests for exclusion
and any other information requested by the Parties’ Counsel;

18

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 23 of 49 PageID#
48940

9.1.10. After the Effective Date, processing and transmitting distributions to
Settlement Class Members;
9.1.11. Prior to the Final Approval Hearing, preparing and executing an affidavit tosubmit to the Court that identifies each Settlement Class Member who timely and validly
requested exclusion from the Settlement Class; and9.1.12. Performing any other functions that the Parties jointly agree are necessary
to accomplish administration of the Settlement.
9.2.

As specified in Section 3.2, all Administrative Costs incurred by the Settlement

Administrator or otherwise in connection with administering the Settlement shall be paid from theSettlement Fund. For the avoidance of doubt, Capital One shall not under any circumstances be
responsible for any Administrative Costs.
9.3.

Neither the Parties nor the Parties’ Counsel shall have any liability whatsoever withrespect to any act or omission of the Settlement Administrator, or any of its designees or agents,
in connection with its performance of its duties under this Agreement, or under the Notice Plan orConsumer Settlement Benefits Plan once approved by the Court.
9.4.

The Settlement Administrator shall indemnify and hold harmless the Parties andthe Parties’ Counsel for any liability arising from any act or omission of the Settlement
Administrator, or any of its designees or agents, in connection with its performance of its duties
under this Agreement, or under the Notice Plan or Consumer Settlement Benefits Plan once
approved by the Court.
10.

Notice Plan
10.1.

In connection with a motion seeking a Preliminary Approval Order, Class Counsel

shall present the Notice Plan to the Court for approval, which shall describe in detail the process
for implementing and executing a plan to notify Settlement Class Members of, among other things,
19

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 24 of 49 PageID#
48941(i) the Settlement, (ii) the availability and process for claiming benefits under the Consumer
Settlement Benefits Plan, and (iii) the procedure for Settlement Class Members to object to theSettlement and request exclusion from the Settlement.
10.2.

The Settlement Administrator shall be responsible for implementing and executing

the Notice Plan. Within thirty (30) days after the Court’s entry of a Preliminary Approval Order,
Capital One shall provide to the Settlement Administrator a Class List, which shall include
Settlement Class Members’ full names, current addresses, and email addresses (to the extent
available) as reflected in Capital One’s records.
10.2.1. The Parties agree that the Class List shall be provided to the Settlement
Administrator solely for the purpose of effecting the terms of this Settlement Agreement,
and that such information shall not be used, disseminated, or disclosed by or to any otherperson for any other purpose.
10.2.2. Capital One’s inclusion of an individual’s information on the Class List isin no way an admission of liability by Capital One with respect to that individual nor is it
an admission that a litigation class could be certified under Federal Rule of Civil Procedure
23 in the Actions.
10.2.3. Should the Settlement be terminated for any of the reasons identified in
Section 7.2, the Settlement Class Representatives, the Settlement Administrator, and ClassCounsel shall immediately destroy any and all copies of the Class List described in Section
10.2.
10.2.4. The provisions regarding the compilation and treatment of the Class List
described in Section 10.2 and its subsections are material terms of this Settlement
Agreement.

20

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 25 of 49 PageID#
48942

10.3.

As specified in Section 3.2, all Notice Costs incurred by the Settlement

Administrator or otherwise in connection with implementing and executing the Notice Plan shallbe paid from the Settlement Fund.
11.

CAFA Notice
11.1.

Capital One will serve the notice required by the Class Action Fairness Act of 2005,

28 U.S.C. § 1715, not later than ten (10) days after this Agreement is filed with the Court.
12.

Covenants Not to Sue
12.1.

The Class Representatives covenant and agree: (i) not to file, commence, prosecute,intervene in, or participate in (as class members or otherwise) any action in any jurisdiction basedon or relating to any Released Claim, or the facts and circumstances relating thereto, against anyof the Released Parties; (ii) not to organize or solicit the participation of Settlement Class
Members, or persons who would otherwise fall within the definition of the Settlement Class but
who requested to be excluded from the Settlement Class, in a separate class for purposes of
pursuing any action based on or relating to any Released Claim or the facts and circumstances
relating thereto, against any of the Released Parties; and (iii) that the foregoing covenants and thisAgreement shall be a complete defense to any Released Claim against any of the Released Parties.
13.

Representations and Warranties
13.1.

Each Party represents that:(i)such Party has the full legal right, power, and authority to enter into andperform this Agreement, subject to Court approval;(ii)such Party is voluntarily entering into the Agreement as a result of arm’slength negotiations conducted by its counsel;(iii)

such Party is relying solely upon its own judgment, belief, and knowledge,
and the advice and recommendations of its own independently selected
counsel, concerning the nature, extent, and duration of their rights andclaims hereunder and regarding all matters which relate in any way to thesubject matter hereof;
21

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 26 of 49 PageID#
48943

13.2.

(iv)

such Party has been represented by, and has consulted with, the counsel of
its choice regarding the provisions, obligations, rights, risks, and legal
effects of this Agreement and has been given the opportunity to review
independently this Agreement with such legal counsel and agree to theparticular language of the provisions herein;(v)

the execution and delivery of this Agreement by such Party and theconsummation by such Party of the transactions contemplated by thisAgreement have been duly authorized by such Party;(vi)

except as provided herein, such Party has not been influenced to any extent
whatsoever in executing the Agreement by representations, statements, oromissions pertaining to any of the foregoing matters by any Party or by any
person representing any party to the Agreement;(vii)

each of the Parties assumes the risk of mistake as to facts or law;(viii)

this Agreement constitutes a valid, binding, and enforceable agreement; and(ix)

no consent or approval of any person or entity is necessary for such Party
to enter into this Agreement.

The Settlement Class Representatives represent and warrant that they have notassigned or otherwise transferred any interest in any of the Released Claims against any of theReleased Parties, and further covenant that they will not assign or otherwise transfer any interest
in any of the Released Claims against any of the Released Parties.
13.3.

The Settlement Class Representatives represent and warrant that they have nosurviving claim or cause of action against any of the Released Parties with respect to any of theReleased Claims.
14.

Releases
14.1.

As of the Effective Date, all Settlement Class Members and all Settlement Class

Representatives, on behalf of themselves, their heirs, assigns, executors, administrators,
predecessors, and Successors, and any other person purporting to claim on their behalf, hereby
expressly, generally, absolutely, and unconditionally release and discharge any and all Released
Claims against the Released Parties (including Amazon, which is an intended third-party
22

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 27 of 49 PageID#
48944

beneficiary of the release in this Section), and any of their current, former, and future Affiliates,
Parents, Subsidiaries, representatives, officers, agents, directors, employees, contractors, vendors,
insurers, Successors, assigns, and attorneys, except for claims relating to the enforcement of theSettlement or this Agreement.
14.2.

The Parties understand that if the facts upon which this Agreement is based arefound hereafter to be different from the facts now believed to be true, each Party expressly assumes
the risk of such possible difference in facts, and agrees that this Agreement, including the releases
contained herein, shall remain effective notwithstanding such difference in facts. The Parties agree
that in entering this Agreement, it is understood and agreed that each Party relies wholly upon its
own judgment, belief, and knowledge and that each Party does not rely on inducements, promises,or representations made by anyone other than those embodied herein. Notwithstanding any otherprovision of this Agreement (including, without limitation, this Section), nothing in thisAgreement shall be deemed to in any way impair, limit, or preclude the Parties’ rights to enforce
any provision of this Agreement, or any court order implementing this Agreement, in a mannerconsistent with the terms of this Agreement.
14.3.

The Parties agree that the Released Parties will suffer irreparable harm if any

Settlement Class Member takes action inconsistent with Section 14, and that in that event, theReleased Parties may seek an injunction as to such action without further showing of irreparable
harm in this or any other forum.
14.4.

Promptly after the Effective Date, Class Counsel and the Settlement Class

Representatives shall dismiss with prejudice all claims, actions, or proceedings that are released
pursuant to this Agreement.
15.

No Admission of Wrongdoing23

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 28 of 49 PageID#
48945

15.1.

This Agreement is made for the sole purpose of attempting to consummate

settlement of the Actions on a class-wide basis. The Agreement compromises claims which arecontested in good faith, and it shall not be deemed an admission by any of the Parties as to themerits of any claim or defense.
15.2.

This Agreement, whether or not consummated, any communications andnegotiations relating to this Agreement or the Settlement, and any proceedings taken pursuant tothis Agreement:
15.2.1. Shall not be offered or received against any Defendant as evidence of orconstrued as or deemed to be evidence of any presumption, concession, or admission by
any Defendant with respect to the truth of any fact alleged by any Settlement Class
Representative or any Settlement Class Member or the validity of any claim that has beenor could have been asserted in the Actions or in any litigation, or the deficiency of any
defense that has been or could have been asserted in the Actions or in any litigation, or of
any liability, negligence, fault, breach of duty, or wrongdoing of any Defendant;
15.2.2. Shall not be offered or received against any Defendant as evidence of apresumption, concession, or admission of any fault, misrepresentation, or omission withrespect to any statement or written document approved or made by any Defendant;
15.2.3. Shall not be offered or received against any Defendant as evidence of apresumption, concession, or admission with respect to any liability, negligence, fault,
breach of duty, or wrongdoing, or in any way referred to for any other reason as against
any Defendant, in any other civil, criminal, or administrative action, or proceeding, otherthan such proceedings as may be necessary to effectuate the provisions of this Agreement;24Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 29 of 49 PageID#
48946

provided, however, that if this Agreement is approved by the Court, the Parties may refer
to it to effectuate the liability protection granted them hereunder;
15.2.4. Shall not be construed against any Defendant as an admission or concessionthat the consideration to be given hereunder represents the amount that could be or would
have been recovered after trial;
15.2.5. Shall not be construed as or received in evidence as an admission,concession, or presumption against any Settlement Class Representative or any Settlement
Class Member that any of their claims are without merit, or that any defenses asserted byany Defendants have any merit, or that damages recoverable under the Actions would nothave exceeded the Settlement Fund, provided, however, that if this Agreement is approvedby the Court, the Defendants may refer to it to enforce the release of claims granted to themhereunder; and15.2.6. Shall not be used by the Settlement Class Representatives or Class Counsel
to argue or present any argument that Defendants could not contest class certification
and/or proceeding collectively on any grounds if the Actions were to proceed or to establish
any of the elements of class certification in any litigated certification proceedings, whether
in the Actions or in any other judicial proceeding in which any Defendant is a party.
15.3.

The negotiation, terms, and entry of the Parties into this Agreement shall remainsubject to the provisions of Federal Rule of Evidence 408, any and all state statutes of a similar
nature, and the mediation privilege.
15.4.

Notwithstanding the foregoing, Defendants may use, offer, admit, or refer to thisAgreement and to the Settlement reached herein where necessary to defend themselves in any

25

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 30 of 49 PageID#48947

other action, or in any judicial, administrative, regulatory, arbitrative, or other proceeding, and asnecessary to comply with regulatory and/or disclosure obligations.
16.

Opt-Outs
16.1.

Any Settlement Class Member who wishes to exclude themselves from theSettlement Class must submit a written request for exclusion to the Settlement Administrator,
postmarked no later than the Opt-Out Deadline.
16.2.

16.3.

The written request for exclusion must:(i)

Identify the case name of the Action;(ii)

Identify the name and address of the Settlement Class Member seeking
exclusion;(iii)

Be personally signed by the Settlement Class Member seeking exclusion;(iv)

Include a statement clearly indicating the Settlement Class Member’s
intent to be excluded from the Settlement; and(v)

Request exclusion only for that one Settlement Class Member whose
personal signature appears on the request.

Opt-out requests seeking exclusion on behalf of more than one Settlement Class

Member shall be deemed invalid by the Settlement Administrator.
16.4.

Any Settlement Class Member who submits a valid and timely request for exclusionin the manner described herein shall not: (i) be bound by any orders or judgments entered inconnection with the Settlement; (ii) be entitled to any relief under, or be affected by, theAgreement; (iii) gain any rights by virtue of the Agreement; or (iv) be entitled to object to any
aspect of the Settlement.
16.5.

Any Settlement Class Member who does not submit a valid and timely request for

exclusion in the manner described herein shall be deemed to be part of the Settlement Class upon26

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 31 of 49 PageID#
48948

expiration of the Opt-Out Deadline, and shall be bound by all subsequent proceedings, orders, andjudgments applicable to the Settlement Class.
16.6.

Class Counsel agree that this Settlement Agreement is fair, reasonable, and in thebest interests of the Settlement Class Members.
17.

Objections
17.1.

Any Settlement Class Member who wishes to object to the Settlement must submit

a written objection to the Court on or before the Objection Deadline, as specified in the Preliminary
Approval Order.
17.2.

17.3.

The written objection must include:(i)

The case name and number of the Action;(ii)

The name, address, telephone number of the objecting Settlement Class
Member and, if represented by counsel, of his/her counsel;(iii)

A statement of whether the objection applies only to the objector, to a
specific subset of the class, or to the entire class;(iv)

A statement of the specific grounds for the objection; and(v)

A statement of whether the objecting Settlement Class Member intends toappear at the Final Approval Hearing, and if so, whether personally or
through counsel.

In addition to the foregoing requirements, if an objecting Settlement Class Member

is represented by counsel and such counsel intends to speak at the Final Approval Hearing, thewritten objection must include a detailed description of any evidence the objecting Settlement
Class Member may offer at the Final Approval Hearing, as well as copies of any exhibits theobjecting Settlement Class Member may introduce at the Final Approval Hearing.
17.4.

Any Settlement Class Member who fails to object to the Settlement in the manner

described in this Agreement and in the notice provided pursuant to the Notice Plan shall be deemed
to have waived any such objection, shall not be permitted to object to any terms or approval of the27Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 32 of 49 PageID#
48949

Settlement at the Final Approval Hearing, and shall be precluded from seeking any review of theSettlement or the terms of this Agreement by appeal or any other means.
18.

Service Awards
18.1.

The Settlement Class Representatives and Class Counsel shall submit a request to

the Court for payment of Service Awards, not to exceed five thousand United States Dollars($5,000) per individual, to (i) the Settlement Class Representatives and (ii) any other Settlement
Class Member who was deposed in the Action. Any request for Service Awards must be filedwith the Court at least twenty-one (21) days before the Objection Deadline. If approved by the
Court, such Service Awards shall be paid by the Settlement Administrator from the Settlement
Fund within fourteen (14) Business Days after the Effective Date. For the avoidance of doubt,
Capital One shall not under any circumstances be responsible for the payment of any Service
Awards.
18.2.

Capital One agrees not to oppose any request to the Court for Service Awards,

provided such request does not seek more than five thousand United States Dollars ($5,000) per
individual.
18.3.

The Parties agree that the effectiveness of this Agreement is not contingent upon

the Court’s approval of the payment of any Service Awards. If the Court declines to approve, inwhole or in part, a request for Service Awards, all remaining provisions in this Agreement shallremain in full force and effect. No decision by the Court, or modification or reversal or appeal ofany decision by the Court, concerning the payment of Service Awards, or the amount thereof, shallbe grounds for cancellation or termination of this Agreement.
19.

Attorneys’ Fees and Expenses
19.1.

Class Counsel shall submit a request to the Court for payment of Attorneys’ Fees,

expressed as a percentage of the value conferred by the Settlement on the Settlement Class, and28

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 33 of 49 PageID#
48950

for reimbursement of Expenses incurred in prosecuting and settling the Action. Any request for
Attorneys’ Fees and Expenses must be filed with the Court at least twenty-one (21) days before
the Objection Deadline. If approved by the Court, such Attorneys’ Fees and Expenses shall be
paid by the Settlement Administrator from the Settlement Fund within fourteen (14) Business Daysof the Effective Date. For the avoidance of doubt, Capital One shall not under any circumstances
be responsible for the payment of any Attorneys’ Fees and Expenses.
19.2.

Capital One agrees not to oppose any request to the Court for Attorneys’ Fees,

provided such a request does not seek a fee in excess of thirty-five percent (35%) of the Settlement
Fund. Notwithstanding the foregoing, Capital One shall have the right to file a response to any
request for Attorneys’ Fees or Expenses to address any misstatements made therein.
19.3.

The Parties agree that the effectiveness of this Agreement is not contingent upon

the Court’s approval of the payment of any Attorneys’ Fees or Expenses. If the Court declines toapprove, in whole or in part, a request for Attorneys’ Fees or Expenses, all remaining provisions
in this Agreement shall remain in full force and effect. No decision by the Court, or modification
or reversal or appeal of any decision by the Court, concerning the payment of Attorneys’ Fees or
Expenses, or the amount thereof, shall be grounds for cancellation or termination of thisAgreement.
20.

Confidentiality
20.1.

The Parties and the Parties’ Counsel agree that the terms of this Settlement shallremain confidential and not be disclosed until the Agreement is publicly filed in connection with
the Settlement Class Representatives’ motion seeking a Preliminary Approval Order.
21.

Notices21.1.

All notices to Class Counsel provided for in this Agreement shall be sent by e-mailand First Class mail to the following:29

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 34 of 49 PageID#
48951

Norman E. Siegel
STUEVE SIEGEL HANSON LLP
460 Nichols Road, Suite 200
Kansas City, MO 64112
siegel@stuevesiegel.com
Karen Hanson Riebel
LOCKRIDGE GRINDAL NAUEN, P.L.L.P
100 Washington Avenue South, Suite 2200
Minneapolis, MN 55401
khriebel@locklaw.com
John A. Yanchunis
MORGAN & MORGAN COMPLEX LITIGATION GROUP
201 N. Franklin Street, 7th Floor
Tampa, FL 33602
jyanchunis@ForThePeople.com
21.2.

All notices to Capital One or Capital One’s Counsel provided for in this Agreement

shall be sent by e-mail and First Class mail to the following:David L. Balser
S. Stewart Haskins IIKING & SPALDING LLP
1180 Peachtree Street, N.E.
Atlanta, GA 30309
dbalser@kslaw.com
shaskins@kslaw.com
Robert A. Angle
Timothy St. George
TROUTMAN PEPPER HAMILTON SANDERS LLP
1001 Haxall Point
Richmond, VA 23219
robert.angle@troutman.com
timothy.st.george@troutman.com
Mary C. Zinsner
TROUTMAN PEPPER HAMILTON SANDERS LLP
401 9th Street, NW, Suite 1000
Washington, DC 20004
mary.zinsner@troutman.com
21.3.

All notices to the Settlement Administrator provided for in this Agreement shall besent by e-mail and First Class mail to the following:30

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 35 of 49 PageID#
48952

Capital One Settlement Administrator
PO Box 4518
Portland, OR 97208-4518
info@capitalonesettlement.com
21.4.

The notice recipients and addresses designated in this Section may be changed by

written notice posted to the Settlement website.
22.

Miscellaneous Provisions
22.1.

Further Steps. The Parties agree that they each shall undertake any further required

steps to effectuate the purposes and intent of this Agreement
22.2.

Cooperation. The Parties: (i) acknowledge that it is their intent to consummate thisSettlement Agreement and (ii) agree to cooperate to the extent reasonably necessary to effect andimplement all terms and conditions of the Settlement Agreement and to exercise their best efforts
to accomplish the foregoing terms and conditions of the Settlement Agreement.
22.3.

Contact with Settlement Class Members. The Parties agree that Class Counsel may

communicate with Settlement Class Members regarding the Settlement, and Capital One shall notinterfere with such communication.
22.4.

Contractual Agreement. The Parties understand and agree that all terms of thisAgreement, including the exhibits hereto, are contractual and are not a mere recital, and eachsignatory warrants that he or she is competent and possesses the full and complete authority to
execute and covenant to this Agreement on behalf of the Party that he or she represents.
22.5.

Recitals. The recitals set forth above in Section 1 shall be and hereby are terms ofthis Agreement as if set forth herein.
22.6.

Headings. Any headings contained herein are for informational purposes only anddo not constitute a substantive part of this Agreement. In the event of a dispute concerning theterms and conditions of this Agreement, the headings shall be disregarded.

31

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 36 of 49 PageID#
48953

22.7.

Integration. This Agreement constitutes the entire agreement among the Parties

and no representations, warranties, or inducements have been made to any Party concerning thisAgreement other than the representations, warranties, and covenants expressly contained andmemorialized herein.
22.8.

Exhibits. The exhibits to this Agreement are expressly incorporated by reference

and made part of the terms and conditions set forth herein.
22.9.

Drafting. The language of all parts of this Agreement shall in all cases be construed

as a whole, according to their fair meaning, and not strictly for or against any Party. No Party shallbe deemed the drafter of this Agreement. The Parties acknowledge that the terms of the Agreement
are contractual and are the product of negotiations between the Parties and their counsel. Each
Party and their counsel cooperated in the drafting and preparation of the Agreement. In any
construction to be made of the Agreement, the Agreement shall not be construed against any Party
and any canon of contract interpretation to the contrary shall not be applied.
22.10. Modification or Amendment. This Agreement may not be modified or amended,
nor may any of its provisions be waived, except by an express writing signed by the Parties who
executed this Agreement, or their Successors.
22.11. Waiver. The failure of a Party to insist upon strict performance of any provision ofthis Agreement shall not be deemed a waiver of such Party’s rights or remedies or a waiver bysuch Party of any default by another Party in the performance or compliance of any of the termsof this Agreement. In addition, the waiver by one Party of any breach of this Agreement by anyother Party shall not be deemed a waiver of any other prior or subsequent breach of this Agreement.
22.12. Severability. Should any part, term, or provision of this Agreement be declared ordetermined by any court or tribunal to be illegal or invalid, the Parties agree that the Court may

32

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 37 of 49 PageID#
48954

modify such provision to the extent necessary to make it valid, legal, and enforceable. In any
event, such provision shall be separable and shall not limit or affect the validity, legality, or
enforceability of any other provision hereunder.
22.13. Counterparts. This Agreement may be executed in one or more counterparts. All
executed counterparts and each of them shall be deemed to be one and the same instrument
provided that counsel for the Parties to this Agreement shall exchange among themselves original
signed counterparts.
22.14. Electronic Mail. Transmission of a signed Agreement by electronic mail shallconstitute receipt of an original signed Agreement by mail.
22.15. Successors and Assigns. The Agreement shall be binding upon, and inures to thebenefit of, the heirs, executors, Successors, and assigns of the Parties hereto.
22.16. Survival. The Parties agree that the terms set forth in this Agreement shall survive
the signing of this Agreement.
22.17. Governing Law. All terms and conditions of this Agreement shall be governed byand interpreted according to the laws of the Commonwealth of Virginia, without reference to its
conflict of law provisions, except to the extent the federal law of the United States requires thatfederal law governs.
22.18. Interpretation. The following rules of interpretation shall apply to this Agreement:(i)Definitions apply to the singular and plural forms of each term defined.

(ii)

Definitions apply to the masculine, feminine, and neuter genders of eachterm defined.

(iii)

Whenever the words “include,” “includes” or “including” are used in thisAgreement, they shall not be limiting but rather shall be deemed to befollowed by the words “without limitation.”33

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 38 of 49 PageID#
48955

22.19. No Precedential Value. The Parties agree and acknowledge that this Agreement
carries no precedential value.
22.20. Fair and Reasonable. The Parties and the Parties’ Counsel believe this Agreement
is a fair and reasonable compromise of the disputed claims and in the best interest of the Parties.
The Parties have arrived at this Agreement as a result of extensive arms-length negotiations.
22.21. Retention of Jurisdiction. The administration and consummation of the Settlement
as embodied in this Agreement shall be under the authority of the Court, and the Court shall retain
jurisdiction over the Settlement and the Parties for the purpose of enforcing the terms of thisAgreement. The Court also shall retain exclusive jurisdiction over any determination of whether
any subsequent suit is released by the Settlement Agreement.
22.22. Confidentiality of Discovery Material. The Parties, the Parties’ Counsel, and any
retained or consulting experts, agree that they remain subject to the Court’s Protective Order, Dkt.
No. 368, as appropriate.
22.23. No Government Third-Party Rights or Beneficiaries. Except as expressly provided
for herein, no government agency or official can claim any rights under this Agreement or
Settlement, whether with respect to the alleged conduct that is the subject of the releases in Section
14 or the funds (or remainder of funds) paid or used in the Settlement.
22.24. No Collateral Attack. The Settlement Agreement shall not be subject to collateralattack, including by any Settlement Class Member or any recipient of notices of the Settlement
after the Judgment is entered.

34

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 39 of 49 PageID#
48956

IN WITNESS WHEREOF, the Parties have caused this Agreement to be duly executed bythemselves or by their duly authorized counsel:
Class Counsel on behalf of the Settlement
Class Representatives (who have specificallyassented to the terms of this Settlement
Agreement) and the Settlement Class:

Defendant Capital One Financial
Corporation:

Name:
Title:
Date:

Name: Norman E. Siegel
Date: January 31, 2022

Defendant Capital One Bank (USA), N.A.:

Name: Karen Hanson Riebel
Date: January 31, 2022

Name:
Title:
Date:

Morgan and Morgan
Name: John A. Yanchunis, Partner
Date: January 31, 2022

Defendant Capital One, N.A.:

Name:
Title:
Date:

35

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 40 of 49 PageID#
48957

EXHIBIT 1
LIST OF ACTIONS1
1.

In re: Capital One Consumer Data Security Breach Litigation (E.D. Va., Case

No. 1:19-md-02915-AJT-JFA) (encompassing all putative class action claims filed byRepresentative Plaintiffs in the MDL proceeding)2.

Ababseh v. Capital One Financial Corporation et al. (W.D. Wash., Case No.

2:19-cv-01397) (E.D. Va., Case No. 1:19-cv-02940)
3.

Aballo et al. v. Capital One Financial Corporation et al. (N.D. Cal., Case No.

3:19-cv-04475) (E.D. Va., Case No. 1:19-cv-02929)
4.

Agnew et al. v. Capital One Financial Corporation (D.D.C., Case No. 1:19-cv-

02489) (E.D. Va., Case No. 1:19-cv-02963)
5.

Aminov v. Capital One Financial Corporation et al. (E.D. Va., Case No. 1:19-cv-

6.

Anthony v. Capital One Financial Corporation et al. (E.D. Va., Case Nos. 1:19-

01006)

cv-00993 and 3:19-cv-00608)
7.

Atachbarian v. Capital One Financial Corporation (C.D. Cal., Case No. 2:19-cv-

06965) (E.D. Va. Case No. 1:19-cv-02944)
8.

Baird v. Capital One Financial Corporation et al. (E.D. Va. Case Nos. 1:19-cv-

00979 and 3:19-cv-00585)
9.

Baisden et al. v. Capital One Financial Corporation et al. (W.D. Wis., Case No.

3:19-cv-00623) (E.D. Va., Case No. 1:19-cv-02970)

1

As noted in Section 2.1 of the Settlement Agreement and Release, the definition of “Action” or“Actions” in the Settlement Agreement and Release does not include the case styled Minsky v.
Capital One Financial Corporation et al., Case No. 1:19-cv-01472 (AJT) (E.D. Va.).

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 41 of 49 PageID#
48958

10.

Barnes et al. v. Capital One Financial Corporation et al. (E.D. Va. Case Nos.

1:19-cv-01021 and 3:19-cv-00587)
11.

Berger et al. v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-

cv-02298) (E.D. Va., Case No. 1:19-cv-02918)
12.

Biaohealth, LLC v. Capital One Financial Corporation et al. (E.D. Va., Case

Nos. 1:19-cv-02957 and 3:19-cv-00650)
13.

Bowen et al. v. Capital One Financial Corporation et al. (S.D.N.Y., Case No.

1:19-cv-07917) (E.D. Va., Case No. 1:19-cv-02966)
14.

Broderick et al. v. Capital One Financial Corporation et al. (E.D. Va., Case No.

1:19-cv-01454)
15.

Busby et al. v. Capital One Financial Corporation et al. (E.D. Va., Case Nos.

1:19-cv-01062 and 3:19-cv-00557)
16.

Carter et al. v. Capital One Financial Corporation et al. (E.D. Va., Case Nos.

1:19-cv-02950 and 3:19-cv-00557)
17.

Castro et al. v. Capital One Financial Corporation et al. (E.D. Va., Case Nos.

1:19-cv-01008 and 3:19-cv-00586)
18.

Cox et al. v. Capital One Financial Corporation (E.D. Va., Case No. 1:19-cv-

19.

Curtis et al. v. Capital One Financial Corporation et al. (W.D. Wash., Case No.

01042)

2:19-cv-1366) (E.D. Va., Case No. 1:19-cv-02939)
20.

Dames v. Capital One Financial Corporation et al. (E.D. Va., Case Nos. 1:19-cv-

01010 and 3:19-cv-00607)

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 42 of 49 PageID#
48959

21.

Desoer v. Capital One Financial Corporation et al. (W.D. Wash., Case No. 2:19-

cv-01223) (E.D. Va., Case No. 1:19-cv-02935)
22.

Easton v. Capital One Financial Corporation et al. (E.D. Va., Case Nos. 1:19-cv-

02951 and 3:19-cv-00574)
23.

Edmondson et al. v. Capital One Financial Corporation et al. (E.D. Va., Case No.

1:21-cv-00332)
24.

Fadullon v. Capital One Financial Corporation et al. (W.D. Wash., Case No.

2:19-cv-01189) (E.D. Va., Case No. 1:19-cv-02926)
25.

Fisher et al. v. Capital One Financial Corporation et al. (N.D. Cal., Case No.

3:19-cv-04485) (E.D. Va., Case No. 1:19-cv-02960)
26.

Francis v. Capital One Financial Corporation et al. (M.D. Fla., Case No. 8:19-

cv-01898) (E.D. Va., Case No. 1:19-cv-02923)
27.

Gershen v. Capital One Financial Corporation et al. (E.D. Va., Case No. 1:19-

cv-01174)
28.

Greenberg et al. v. Capital One Financial Corporation et al. (S.D.NY., Case No.

1:19-cv-07752) (E.D. Va., Case No. 1:19-cv-02965)
29.

Greenstein v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-

cv-02307) (E.D. Va., Case No. 1:19-cv-02919)
30.

Grimm et al. v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-

cv-02357) (E.D. Va., Case No. 1:19-cv-02961)
31.

Haque v. Capital One Financial Corporation et al. (E.D. Pa., Case No. 2:19-cv-

03512) (E.D. Va., Case No. 1:19-cv-02969)

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 43 of 49 PageID#
48960

32.

Harn v. Capital One Financial Corporation et al. (D. Kan., Case No. 2:19-cv-

02441) (E.D. Va., Case No. 1:19-cv-02922)
33.

Heath et al. v. Capital One Financial Corporation et al. (E.D. Va., Case Nos.

1:19-cv-02949 and 3:19-cv-00555)
34.

Hilker v. Capital One Financial Corporation et al. (E.D. Va., Case No. 1:19-cv-

35.

Hoskinson-Short et al. v. Capital One Financial Corporation et al. (W.D. Wash.,00995)

Case No. 2:19-cv-01218) (E.D. Va., Case No. 1:19-cv-02934)
36.

Howitt v. Capital One Financial Corporation (S.D.N.Y., Case No. 1:19-cv-

07161) (E.D. Va. Case No. 1:19-cv-02924)
37.

Hun v. Capital One Financial Corporation et al. (E.D.N.Y., Case No. 1:19-cv-

04436) (E.D. Va., Case No. 1:19-cv-02921)
38.

Imperatori v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-

cv-02503) (E.D. Va., Case No. 1:19-cv-02964)
39.

Jacobs v. Capital One Financial Corporation et al. (S.D. Ind., Case No. 1:19-cv-

03217) (E.D. Va., Case No, 1:19-cv-02942)
40.

Janik v. Capital One Financial Corporation et al. (D. Conn., Case No. 3:19-cv-

01242) (E.D. Va., Case No. 1:19-cv-02941)
41.

Labajo et al. v. Capital One Financial Corporation et al. (C.D. Cal., Case No.

5:19-cv-01431) (E.D. Va., Case No. 1:19-cv-02928)
42.

Lipskar v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-cv-

02328) (E.D. Va., Case No. 1:19-cv-02920)

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 44 of 49 PageID#
48961

43.

Lundgren et al. v. Capital One Financial Corporation et al. (W.D. Wash., CaseNo. 2:19-cv-1361 (E.D. Va., Case. No. 1:19-cv-02938)
44.

Mallh et al. v. Capital One Financial Corporation et al. (E.D.N.Y., Case No.

1:19-cv-05040) (E.D. Va., Case No. 1:19-cv-02932)
45.

Materna v. Capital One Financial Corporation et al. (E.D. Va., Case Nos. 1:19-

cv-02953 and 3:19-cv-00581)
46.

McDonough v. Capital One Financial Corporation et al. (E.D. Va., Case Nos.

1:19-cv-00984, 1:19-cv-02947, and 3:19-cv-00595)
47.

Merritt et al. v. Capital One Financial Corporation et al. (E.D. Va., Case No.

1:19-cv-01048)
48.

Miller v. Capital One Financial Corporation et al. (D.D.C., Case No. 1:19-cv-

02447) (E.D. Va., Case No. 1:19-cv-02962)
49.

Miranda et al. v. Capital One Financial Corporation et al. (Alameda Cty. Super.

Ct., Case No. RG21113096) (N.D. Cal., Case No. 4:21-cv-08580) (E.D. Va., Case No. 1:21-cv01259)
50.

Most Wanted Motorsports LLC v. Capital One Financial Corporation et al.

(W.D. Wash., Case No. 2:19-cv-01303) (E.D. Va., Case No. 1:19-cv-02936)
51.

Ouellette et al. v. Capital One Financial Corporation et al. (W.D. Wash., CaseNo. 2:19-cv-01203) (E.D. Va., Case No. 1:19-cv-02927)
52.

Perdew v. Capital One Bank (USA), N.A. (S.D. Cal., Case No. 3:19-cv-01421)(E.D. Va., Case No. 1:19-cv-02925)
53.

Potts v. Capital One Financial Corporation et al. (N.D.N.Y., Case No. 3:19-cv-

01001) (E.D. Va., Case No. 1:19-cv-02971)

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 45 of 49 PageID#
48962

54.

Robertson v. Capital One, N.A. et al. (M.D. Pa., Case No. 1:19-cv-01368) (E.D.

Va., Case No. 1:19-cv-02972)
55.

Ruffino v. Capital One Financial Corporation et al. (N.D. Ill., Case No. 1:19-cv-

05234) (E.D. Va., Case No. 1:19-cv-02930)
56.

Summer et al. v. Amazon Web Services, Inc. et al. (W.D. Wash., Case No. 2:19-

cv-01304) (E.D. Va., Case No. 1:19-cv-02937)
57.

Tadler v. Capital One Financial Corporation et al. (E.D.N.Y., Case No. 2:19-cv-

04782) (E.D. Va., Case No. 1:19-cv-02931)
58.

Tadrous v. Capital One Financial Corporation et al. (D.D.C., No. 1:19-cv-02292)(E.D.Va., Case No. 1:19-cv-02917)
59.

Tester et al. v. Capital One Financial Corporation et al. (E.D. Va. Case Nos.

1:19-cv-02952 and 3:19-cv-00579)
60.

Tsirigos et al. v. Capital One Bank (USA), N.A. (E.D.N.Y. Case No., 1:19-cv-

04507) (E.D. Va., Case No. 1:19-cv-02933)
61.

Veverka v. Capital One, N.A. et al. (E.D. Pa., Case No. 2:19-cv-03461) (E.D. Va.,

Case No. 1:19-cv-02968)
62.

Wise et al. v. Capital One Financial Corporation et al. (M.D. Fla., Case No. 8:19-

cv-01915) (E.D. Va., Case No. 1:19-cv-02945)
63.

Zimprich v. Capital One Financial Corporation et al. (C.D. Cal., Case No., 8:19-

cv-01689) (E.D. Va., Case. No. 1:19-cv-02943)
64.

Zosiak v. Capital One Financial Corporation et al. (D.D.C, Case No. 1:19-cv-

02265) (E.D. Va., Case No. 1:19-cv-02916)

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 46 of 49 PageID#
48963
EXHIBIT 2

As part of this Settlement Agreement, the parties acknowledge that Capital One has agreed
to implement and maintain the following business practices, many of which are already in place
or in the process of being implemented, for a period of two years from the date of final approvalof the Settlement Agreement unless otherwise noted.
1.

Scope: The undertakings described herein apply to all networking equipment, databases,or data stores, applications, servers, and endpoints that: (1) are capable of accessing, usingor sharing software, data, and hardware resources; (2) are owned, operated, and/or
controlled by Capital One; and (3) collect, process, store, have access, or grant access to
Personal Information of U.S. consumers. “Personal Information” shall have the same
meaning as “nonpublic personal information” set forth in Section 509 of the GrammLeach-Bliley Act and regulations issued thereunder.

2.

Cyber Event Action Plan: Capital One commits that it is implementing a comprehensive
Cyber Event Action Plan designed to enhance and maintain a strong and sustainablecybersecurity program commensurate with the nature, size, complexity, and risk profile ofthe organization. Capital One is committed to enhance and improve Capital One’s
cybersecurity program and agrees that the commitments identified in the Cyber Event
Action Plan will be reviewed and assessed by the company’s internal audit function.1

1

The parties recognize and acknowledge that cloud computing, cybersecurity, and othertechnological capabilities are constantly changing, often at a rapid pace. Nothing herein shall beread or interpreted to preclude Capital One from having the ability to depart from the precise
technical details provided herein, where doing so does not degrade Capital One’s cybersecurity
capabilities compared with such capabilities upon the implementation of its Cyber Event Action
Plan. Moreover, the parties acknowledge that where there is a conflict between regulatory
requirements and the details in this document, the regulatory requirements will control.

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 47 of 49 PageID#
48964

a. Technology Enhancements: Capital One confirms that the Cyber Event Action
Plan includes, at a minimum, enhancements to the Company’s cybersecurity
program in the following technology-related areas:
i. Cloud Governance and Perimeter Security, including:
1. Strengthening the Company’s perimeter security defenses,
including (i) implementation of an improved web application
firewall architecture; and (ii) extension of the Company’s anti-bot
capabilities.
2. Strengthening the Company’s cloud governance practices, including
enhancing reviews of controls for cloud services.
3. Enhancing the Company’s cloud security standards, procedures, andcontrols, including (i) enhanced compliance tracking; and, (ii)
implementation of additional cloud security controls.
4. Strengthening the Company’s security configuration management
practices, including (i) updating the Company’s Security
Configuration Management Procedures for cloud and non-cloud
resources to close any potential procedural or scope gaps; and (ii)enhancing baseline configuration documentation and compliance
processes.
ii. Threat Detection and Vulnerability Management, including:
1. Expanding cloud environment monitoring and improving alert
coverage and intelligence, including (i) reviewing logging and2

Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 48 of 49 PageID#
48965

alerting practices for enhancement opportunities; and (ii) reviewing
Information Security Standards and enhancing as required.
2. Improving readiness and training for analysts in the Company’s
Cyber

Security

Operations

Center(“CSOC”),

including(i) reviewing and enhancing CSOC operating procedures; and, (ii)
improving alert handling by improving automation and adding
additional information and intelligence.
3. Strengthening of the Company’s vulnerability scanning andpenetration testing practices.
iii. Access Management, including:
1. Improving existing restrictive access for humans, machines, andresources in the Company’s AWS environment, including(i) enhancing access policies for storage services; (ii) enhancing
machine identity and access management policies; and (iii)enhancing governance procedures for AWS access management.
iv. Data Protection, including:
1. Strengthening the Company's data protection controls (e.g.
encryption,data

inventory)

andgovernance,

includingenhancements to standards, monitoring, and exception management.
2. Enhancing data loss prevention program to better identify andmeasure risk, and improving corresponding technical capabilities.
b. Cyber Governance and Risk Management: Capital One confirms that the Cyber
Event Action Plan includes, at a minimum, enhancements to the governance of the3Case 1:19-md-02915-AJT-JFA Document 2219-1 Filed 01/31/22 Page 49 of 49 PageID#
48966

Company’s cybersecurity program, including enhanced Board and Senior
Management oversight and elevated adherence monitoring to enterprise policies.
c. Cyber Talent and Education: Capital One confirms that the Cyber Event Action
Plan includes, at a minimum, enhancements to the Company’s cybersecurity skills
framework and recruiting/training programs, and a resulting increase in the cloudand cyber certified practitioners.

4