Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 1 of 38 PageID# 48880

IN THE UNITED STATES DISTRICT COURTEASTERN DISTRICT OF VIRGINIAALEXANDRIA DIVISIONIN RE: CAPITAL ONE CONSUMERDATA SECURITY BREACH LITIGATION)))MDL No. 1:19md2915 (AJT/JFA)This Document Relates to the Consumer Cases

PLAINTIFFS’ MEMORANDUM IN SUPPORT OF MOTIONFOR PRELIMINARY APPROVAL AND TO
DIRECT NOTICE OF PROPOSED SETTLEMENT TO THE CLASSCase 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 2 of 38 PageID# 48881

TABLE OF CONTENTSFACTUAL BACKGROUND ......................................................................................................... 2A.

Overview of the Litigation ...................................................................................... 2

B.

Mediation and Settlement ....................................................................................... 8C.

The Terms of the Proposed Settlement ................................................................... 91.

The Settlement Class................................................................................... 92.

The Settlement Fund ................................................................................. 10

3.

Proposed Injunctive Relief—Business Practice Changes ......................... 13

4.

Proposed Notice and Claims Program ...................................................... 13

5.

Attorneys’ Fees and Expenses and Service Awards ................................. 14

6.

Releases..................................................................................................... 14

ARGUMENT ................................................................................................................................ 14
I.

ARTICLE III STANDING .............................................................................................. 14

II.

THE COURT SHOULD DIRECT NOTICE TO THE SETTLEMENT CLASS ........... 17A.

The Class Was Adequately Represented. ............................................................. 18

B.

The Proposed Settlement Was Negotiated at Arm’s Length. ............................... 18C.

The Relief is Fair, Reasonable, and Adequate. ..................................................... 19

D.
III.

1.

The costs, risk, and delay of trial and appeal. ........................................... 20

2.

The method of distributing relief is effective. .......................................... 20

3.

The terms relating to attorneys’ fees are reasonable. ................................ 22

4.

Any agreement required to be identified under Rule 23(e)(3). ................. 23

The Proposed Settlement Treats Class Members Equitably. ................................ 24

THE PROPOSED SETTLEMENT CLASS MEETS THE REQUIREMENTS
FOR CERTIFICATION. ................................................................................................. 24A.

The Rule 23(a) Requirements Are Satisfied ......................................................... 25

B.

The Rule 23(b)(3) Requirements Are Satisfied .................................................... 26

IV.

THE COURT SHOULD APPROVE THE CONSUMER SETTLEMENTBENEFITS PLAN. .......................................................................................................... 27

V.

THE COURT SHOULD APPROVE THE NOTICE PLAN, NOTICES, AND
CLAIM FORM, AND APPOINT THE SETTLEMENT ADMINISTRATOR.............. 28

VI.

THE COURT SHOULD APPOINT THE PROVIDER OF IDENTITY
DEFENSE SERVICES AND RESTORATION SERVICES. ........................................ 29

VII.

THE COURT SHOULD APPOINT CLASS COUNSEL. .............................................. 30iCase 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 3 of 38 PageID# 48882

CONCLUSION ............................................................................................................................. 30
APPENDIX A – TIMELINE OF SETTLEMENT EVENTS ....................................................... 31ii

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 4 of 38 PageID# 48883

TABLE OF AUTHORITIES
Cases
Abubaker v. Dominion Dental USA, Inc.,
No. 1:19-cv-01050, 2021 WL 6750844 (E.D. Va. Nov. 19, 2021) ......................... 24, 25, 26, 27
Amchem Prods. Inc. v. Windsor,
521 U.S. 591 (1997) ............................................................................................................ 24, 26
Broussard v. Meineke Disc. Muffler Shops, Inc.,
155 F.3d 331 (4th Cir. 1998) ..................................................................................................... 25
Brown v. Transurban USA, Inc.,
318 F.R.D. 560 (E.D. Va. 2016) ................................................................................... 18, 22, 26
Deiter v. Microsoft Corp.,
436 F.3d 461 (4th Cir. 2006) ..................................................................................................... 25
Ealy v. Pinkerton Gov’t Servs.,
514 F. App’x 299 (4th Cir. 2013).............................................................................................. 26
Eisen v. Carlisle & Jacquelin,
417 U.S. 156 (1974) .................................................................................................................. 28
Frank v. Gaos,
139 S. Ct. 1041 (2019) ........................................................................................................ 14, 15
Gray v. Hearst Commc’ns, Inc.,444 F. App’x 698 (4th Cir. 2011).............................................................................................. 26
Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc.,
892 F.3d 613 (4th Cir. 2018) ..................................................................................................... 15
Hutton v. Nat’l Bd. of Examiners in Optometry, Inc.,
No. 1:16-c-03025, 2019 WL 3183651 (D. Md. July 15, 2019) ................................................ 24
In re Anthem, Inc. Data Breach Litig.,
327 F.R.D. 299 (N.D. Cal. 2018) .................................................................................. 24, 25, 27
In re Equifax Inc. Customer Data Sec. Breach Litig.,
999 F.3d 1247 (11th Cir. 2021) ................................................................................................. 15
In re: Equifax Inc. Customer Data Security Breach Litig.,
No. 1:17-md-2800, 2020 WL 256132 (N.D. Ga. March 17, 2020) ........................ 24, 25, 26, 27
In re Jiffy Lube Securities Litigation,
927 F.2d 155 (4th Cir. 1991) ............................................................................................... 17, 18
In re: Lumber Liquidators Chinese-Manufactured Flooring Prod. Mktg., Sales Practices &Prod. Liab. Litig.,
952 F.3d 471 (4th Cir. 2020) ............................................................................................... 18, 23
In re The Mills Corp. Sec. Litig.,
265 F.R.D. 246 (E.D. Va. 2009) ............................................................................................... 17iii

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 5 of 38 PageID# 48884

In re NeuStar, Inc. Sec. Litig.,
No. 1:14–CV–885(JCC/TRJ), 2015 WL 5674798 (E.D. Va. Sept. 23, 2015) .......................... 19
J.D. v. Azar,
925 F.3d 1291 (D.C. Cir. 2019) ................................................................................................ 15
Jeffreys v. Commc’ns Workers of Am. AFL–CIO,
212 F.R.D. 320 (E.D. Va. 2003) ............................................................................................... 25
L-3 Commc’ns Corp. v. Serco, Inc.,673 F. App’x 284 (4th Cir. 2016).............................................................................................. 16
Mullane v. Cent. Hanover Bank & Trust Co.,
339 U.S. 306 (1950) .................................................................................................................. 28
Nelson v. Mead Johnson & Johnson Co.,
484 F. App’x 429 (11th Cir. 2012)............................................................................................ 19
Phillips Petroleum Co. v. Shutts,
472 U.S. 797 (1985) .................................................................................................................. 29
Soutter v. Equifax Info. Servs., LLC,
307 F.R.D 183 (E.D. Va. 2015) ................................................................................................ 26
Stillmock v. Weis Markets, Inc.,
385 F. App’x 267 (4th Cir. 2010).............................................................................................. 26
TransUnion LLC v. Ramirez,
141 S. Ct. 2190 (2021) .............................................................................................................. 15
Wal-Mart Stores, Inc. v. Dukes,
564 U.S. 338 (2011) .................................................................................................................. 25
Rules
Fed. R. Civ. P. 23 .................................................................................................................. passism
Other Authorities
Federal Practice and Procedure § 1779 (3d ed. 2005) ................................................................ 27iv

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 6 of 38 PageID# 48885

Following more than two years of intense litigation, and correspondingly hard-fought
settlement negotiations, the Parties1 have reached a Settlement to resolve consumer claims arisingfrom the Data Breach announced by Capital One in July 2019. The Settlement creates a nonreversionary common fund of $190 million to pay benefits to Settlement Class Members, including
cash compensation for Out-of-Pocket Losses fairly traceable to the Data Breach; cash
compensation for Time Spent dealing with issues arising from the Data Breach; at least three yearsof Identity Defense Services designed to help detect and remediate potential identity theft andfraud; and at least three years of Restoration Services including access to fraud resolution
specialists to assist with identity theft issues, for all Settlement Class Members, regardless ofwhether they make a claim. Further, as part of the Settlement, Capital One is committing to
implement and maintain, for at least two years, significant Business Practice Changes designed to
improve its cybersecurity, enforceable in this Court through agreed injunctive relief. Finally, theSettlement Fund will be used to pay additional necessary benefits, including a state-of-the-art
notice and administration program, and, as approved by the Court, service awards to the Settlement
Class Representatives and other plaintiffs who were deposed during discovery and attorneys’ feesand expenses.
The Settlement is a tremendous result for the Settlement Class, securing valuable benefits
tailored to the facts of the case developed during full discovery, through a Settlement fund that is
one of the largest created in any MDL data breach litigation. The Settlement is fair, reasonable,
and adequate and meets the requirements of Rule 23(e). Plaintiffs thus move for an order1

The parties to the settlement are the consumer Settlement Class Representatives, on behalf of the
proposed Settlement Class, and Defendants Capital One Financial Corporation, Capital One Bank
(USA) N.A., and Capital One, N.A. (collectively, “Capital One”). Capitalized terms used in thismemorandum have the same meaning as in the Settlement Agreement and the proposed Consumer
Settlement Benefits Plan.
1

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 7 of 38 PageID# 48886

preliminarily approving the Settlement and directing class notice, and scheduling a Final Approval
Hearing. In support of their motion, Plaintiffs submit the Settlement Agreement (Ex. 1 hereto); theproposed Consumer Settlement Benefits Plan (Ex. 2); a proposed Preliminary Approval Order (Ex.
3); the declaration of Class Counsel (Ex. 4); the declaration of Cameron R. Azari, Esq. on behalfof the proposed Notice Provider and Settlement Administrator (Epiq Class Action & Claims
Solutions, Inc.), including the Notice Plan (Ex. 5); the proposed Notices (Ex. 6); the proposed
Claim Form (Ex. 7); and the declaration of Gerald Thompson on behalf of the proposed providerof Identity Defense and Restoration Services (Pango) (Ex. 8).
FACTUAL BACKGROUND
A.

Overview of the Litigation

On July 29, 2019, Capital One announced that the sensitive personal information of
approximately 98 million Americans who had applied for Capital One credit cards had been stolen
by a malicious criminal hacker from Amazon’s AWS cloud where Capital One stored thisinformation (the “Data Breach”). Affected individuals across the country immediately began filingclass action lawsuits against Capital One and Amazon. Ultimately, more than 60 such lawsuits
were filed. In October 2019, the Judicial Panel on Multidistrict Litigation consolidated andtransferred these lawsuits to this Court.
On December 2, 2019, after review of over 30 applications for plaintiffs’ counsel
leadership, the Court appointed the undersigned counsel as Plaintiffs’ Lead Counsel and Local
Counsel. Doc. 210, Pretrial Order #3. Plaintiffs’ Lead Counsel immediately began preparation ofa detailed proposed discovery plan, exchanged initial written discovery with Capital One, reachedagreement on a proposed schedule for the litigation, negotiated an ESI protocol and crafted andnegotiated search terms for ESI discovery, and negotiated a protective order. Docs. 270, 312, 329.

2Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 8 of 38 PageID# 48887

On March 2, 2020, after extensive factual investigation and legal research and the vetting
and selection of appropriate, dedicated named plaintiffs (“Representative Plaintiffs”), plaintiffs
filed a 91-page Representative Complaint, which the Court approved (Doc. 302) as the vehicle for
litigating the plaintiffs’ claims (the “Representative Complaint”). The Representative Complaint
named Representative Plaintiffs from the states of California, Florida, New York, Texas, Virginia,
and Washington, asserting representative common law claims on behalf of a nationwide classagainst Capital One and Amazon for negligence, negligence per se, unjust enrichment, breach of
express and implied contract, and declaratory judgment, and state statutory claims under state data
breach notification and consumer protection statutes on behalf of state subclasses. Doc. 332, Doc.
354 (corrected).2
On April 10, 2020, Capital One and Amazon each filed motions to dismiss theRepresentative Complaint in its entirety. Docs. 386, 389. Defendants’ primary focus in thesemotions was arguing that Representative Plaintiffs had not alleged legally-cognizable harms
arising out of the Data Breach or that Defendants were not the proximate cause of any such harms.
Defendants further argued that Virginia law does not recognize a duty of care in tort to safeguard
personal information. Docs. 387, 390. Plaintiffs filed extensive opposition briefs and the motions
were fully briefed in just over one month. See Docs. 426, 427 (Plaintiffs’ Memoranda in
Opposition); Docs. 463, 464 (Defendants’ Replies).

2

During the next few months, three of the Representative Plaintiffs voluntarily dismissed theirclaims, primarily due to exigent circumstances created by COVID-19, without prejudice to theirability to submit claims as absent class members (Docs. 399, 436, 852) and two new Representative
Plaintiffs were substituted, ultimately resulting in the eight current Representative Plaintiffs who
are the Settlement Class Representatives under the settlement. Doc. 971 (Second Amended
Representative Complaint).
3

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 9 of 38 PageID# 48888

On May 27, 2020, the Court heard nearly five hours of oral argument on Defendants’
motions to dismiss. See Doc. 494. On September 18, 2020, the Court issued an extensive rulinglargely denying the motions. Doc. 879. However, extensive briefing related to Representative
Plaintiffs’ allegations continued for months thereafter. On October 2, 2020, Capital One asked the
Court to reconsider one of its rulings—that the Representative Plaintiffs had sufficiently alleged
Capital One assumed a duty of care to them in tort under Virginia law, and alternatively asked the
Court to certify this question to the Virginia Supreme Court. Doc. 916. Plaintiffs submitted
opposition briefing, and the Court denied the motion for reconsideration. Doc. 934 (Plaintiffs’
Opposition); Doc. 951 (Joinder by Amazon); Doc. 965 (Capital One’s Reply); Doc. 1059 (Orderdenying). Later, after concluding Virginia law applied as to all Representative Plaintiffs’ common
law claims (Doc. 1293; Doc. 879 at 9), the Court granted Capital One’s request to certify thequestion of tort duty to the Virginia Supreme Court (Doc. 1291). The Virginia Supreme Court
subsequently declined to accept the certified question. Doc. 1380. On October 16, 2020,
Defendants each filed Answers. Docs. 953, 955. On October 30, 2020, Capital One moved forjudgment on the pleadings on Representative Plaintiffs’ unjust enrichment and implied contract
claims (Doc. 996), which Plaintiffs opposed. Doc. 1032 (Plaintiffs’ Opposition); Doc. 1060
(Capital One’s Reply). After a hearing, the Court denied the motion. Doc. 1096 (12/09/2020 Hr’gTr.); Doc. 1290 (Order denying).
Meanwhile, as motion practice related to Representative Plaintiffs’ allegations wasunderway and the global COVID-19 pandemic forced the case to be litigated remotely, Plaintiffs
were engaged in a massive, time-consuming discovery effort. Plaintiffs served several rounds ofwritten discovery on Defendants and eighteen third-party subpoenas, including six subpoenas toformer Capital One employees, and reviewed over 350,000 documents produced by Defendants

4

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 10 of 38 PageID# 48889

and nearly 7,500 documents produced by third parties. See Class Counsel Decl., Ex. 4, ¶ 20.
Plaintiffs also took 33 depositions of Defendants’ fact witnesses, 13 depositions of Defendants’
Rule 30(b)(6) witnesses, and two third-party depositions. Id. In addition, Plaintiffs answered
Defendants’ written discovery requests, which involved searches of Plaintiffs’ electronic
documents in addition to the collection and review of physical documents. Plaintiffs ultimately
produced nearly 1,750 documents totaling over 7,500 pages in 54 document productions aftercollecting and reviewing over 145,000 documents from 24 custodians. Id. ¶ 21. Furthermore,discovery involved the completion and collection of a verified “Fact Sheet,” including ten pagesof questions and eight document requests, to MDL Plaintiffs. Ultimately, 101 MDL Plaintiffs
submitted verified Fact Sheets and responsive documents, while 147 MDL Plaintiffs chose todismiss their pending complaints.3 Id. In May 2020, each of the Representative Plaintiffs sat for
remote depositions. In addition, Defendants deposed ten additional MDL Plaintiffs. Id. ¶ 22.
Expert discovery was similarly intensive. Beginning in August 2019, Plaintiffs engaged
numerous experts, including five disclosed testifying experts, to develop opinions for classcertification and trial. Dr. Stuart E. Madnick, of the Massachusetts Institute of Technology,
rendered opinions as to the mechanism and root causes of the Data Breach, how the Data Breachshould have been prevented, and how the risk of further breaches can be mediated going forward.
Kevin Mitnick, an expert in “black hat” and “white hat” hacking, explained how the types of
personal information stolen in the Data Breach are misused to cause harm and the present risk ofcontinuing harm to victims of the Data Breach. Gary Olsen, a CPA and appraisal expert, and Terry
Long, an actuary, developed opinions relating to Representative Plaintiffs’ and class members’3

Of the 101 MDL Plaintiffs who submitted verified Fact Sheets and documents, an additional 32
eventually chose to dismiss their pending complaints.
5

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 11 of 38 PageID# 48890

damages. Brian Kelley gave opinions concerning the relation between and among Capital One’s
contracts with applicants and cardholders, Capital One’s cybersecurity policies and practices, andlegal and regulatory requirements governing Capital One’s protection of customer personal
information. These experts were ultimately disclosed, with full reports, on March 21, 2021. Severalof them also drafted supplemental or rebuttal reports, and all sat for at least one deposition. BothDefendants designated numerous experts as well, who also drafted expert reports and who werealso deposed. Id. ¶ 23.
The case also involved significant motion practice before Judge Anderson related to
discovery, some of which resulted in favorable rulings for Plaintiffs and the production ofimportant documents for Plaintiffs’ case. The discovery battles included several rounds of motions
regarding Capital One’s assertion of the bank examination privilege over thousands of documents,
which involved contested briefing and argument from the Office of the Comptroller of theCurrency. Id. ¶ 24.
After discovery closed in late 2020 and expert disclosures were completed in the spring of
2021, on April 28, 2021, Plaintiffs filed their Motion for Class Certification, seeking certificationof a nationwide class of approximately 98 million Americans. Docs. 1259, 1261. This motion was
fully briefed on June 18, 2021. See Doc. 1443 (Capital One’s Opposition); Doc. 1435 (Amazon’s
Opposition); Doc. 1558 (Plaintiffs’ Reply as to Capital One); Doc. 1571 (Plaintiffs’ Reply as to
Amazon). Defendants each filed several Daubert challenges related to Plaintiffs’ class certification
motion, which Plaintiffs opposed, and which were fully briefed by July 2, 2021. Docs. 1389, 1390,
1394, 1395, 1397, 1398, 1427, 1428, 1431, 1432 (Defendants’ motions to exclude and memoranda
in support); Docs. 1528, 1534, 1540, 1546, 1552 (Plaintiffs’ Oppositions); Docs. 1607, 1609, 1611,

6

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 12 of 38 PageID# 48891

1633, 1647 (Defendants’ Replies). Plaintiffs also moved to exclude one of Capital One’s experts
related to Plaintiffs’ Motion for Class Certification. Docs. 1559-60.
During the briefing on class certification, Capital One challenged the Court’s jurisdiction
over the case, arguing no Representative Plaintiff could prove their harms were caused by Capital
One. Capital One contended Representative Plaintiffs could not prove the known hacker, Paige
Thompson, further disseminated the personal information stolen in the Data Breach before herarrest. Docs. 1385-86 (challenging the Court’s jurisdiction to adjudicate Plaintiffs’ tort andstatutory claims). Capital One’s jurisdictional challenge ultimately resulted in several rounds ofbriefing in which plaintiffs vigorously opposed the very premise of Capital One’s contention that
the Court’s jurisdiction to adjudicate the case depended on the resolution of what wereundisputedly merits issues. Doc. 1502 (Plaintiffs’ Opposition); Doc. 1513 (Capital One’s Reply);Doc. 1653 (Capital One’s Supplemental Memorandum regarding Transunion v. Ramirez); Doc.
1721 (Plaintiffs’ Response); Doc. 1727 (Amazon’s Joinder); Doc. 1780 (Capital One’s
Supplemental Brief challenging the Court’s jurisdiction to adjudicate Plaintiffs’ contract andunjust enrichment claims); Doc. 1871 (Plaintiffs’ Response); Doc. 1921 (Capital One’s Reply);Docs. 2041, 2042, 2052, 2074, 2075, 2138, 2150, 2151 (filings related to supplemental authorities
regarding jurisdictional challenge).
The Court held a two-day hearing on July 12 and 13, 2021 on Plaintiffs’ Motion for Class
Certification, the various related Daubert challenges, and Capital One’s challenge to the Court’s
jurisdiction to adjudicate Representative Plaintiffs’ tort and statutory claims. Docs. 1745, 1747;
Docs. 1901-1902 (7/12-13/21 Hr’g Tr.). Soon thereafter, briefing on dispositive motionscommenced. On June 3, 2021, Capital One filed its motion for summary judgment seeking
judgment on each of Representative Plaintiffs’ claims on several bases. Capital One’s principal

7

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 13 of 38 PageID# 48892

argument was that Representative Plaintiffs could not prove they were harmed by Capital One
because they could not prove the hacker, Paige Thompson, further disseminated the personal
information stolen in the Data Breach before her arrest. Docs. 1460, 1463. Plaintiffs filed extensive
opposition briefing, contending there was substantial evidence from which a jury could conclude
Plaintiffs’ personal information was further disseminated beyond Thompson and that they had
suffered compensable damages resulting from Capital One’s failure to protect their personal
information. Doc. 1807. On July 2, 2021, Representative Plaintiffs moved for partial summary
judgment on their claims for breach of express and implied contract against Capital One. Docs.
1646, 1649. On the same day, Amazon moved for summary judgment on each of Representative
Plaintiffs’ claims, arguing it owed no duty of care to them and that it could not be liable to themfor unjust enrichment and under the asserted state statutes, to which plaintiffs submitted a detailed
opposition. Docs. 1678, 1693, 1820.
The summary judgment motions were fully briefed on August 23, 2021. Capital One andAmazon also filed additional Daubert motions in connection with summary judgment, whichplaintiffs opposed. Docs. 1658, 1675, 1828, 1840. Plaintiffs also filed a motion to exclude thetestimony of one of Capital One’s experts related to summary judgment. Docs. 1638, 1640. These
Daubert motions were also fully briefed on August 23, 2021. On September 30, 2021, the Court
held a full-day summary judgment hearing, including additional argument on Capital One’s
jurisdictional challenge. Doc. 2027; 9/30/21 Hr’g Tr. At the time of settlement, the motions forclass certification, summary judgment, and to exclude expert testimony were submitted to the
Court and under advisement.
B.

Mediation and Settlement

Parallel to their litigation of the Actions, the Parties engaged in arm’s-length settlement

8

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 14 of 38 PageID# 48893

negotiations beginning in March 2020. The negotiations were first overseen by former UnitedStates District Court Judge Layn R. Phillips and later overseen by United States District Judge
Leonie M. Brinkema. The Parties engaged in four mediation sessions, on March 21, 2020,
November 18, 2020, April 16, 2021, and August 3, 2021, with Judge Brinkema presiding over thelast three conferences. The Parties also engaged in private and joint communications with Judge
Brinkema to advance and resolve particular issues that arose in these negotiations and on
December 17, 2021, the Parties executed a binding term sheet, to be superseded by the Settlement
Agreement. Ex. 4, ¶ 30. The Settlement Agreement provides that Class Counsel shall seek Court
approval of a Consumer Settlement Benefits Plan (Exhibit 2 hereto) describing the benefits
available to Settlement Class Members and the process and timing for claiming such benefits. Ex.
1, § 8.1.
While the negotiations were professional throughout, they were marked by significant
factual and legal disputes impacting the value of the case. From Plaintiffs’ perspective, the hard
work through discovery and motion practice framed the key issues for both sides, positioned thecase for settlement, and—with Judge Brinkema’s assistance—the Parties were able to reach aresolution. At all times the negotiations were made at arm’s length, and free of collusion of any
kind. Attorneys’ fees, expenses, and the subject of service awards were not discussed in any
manner until the Parties had reached agreement on the material terms of the Settlement, including
the payment of the Settlement Fund. Ex. 4, ¶ 31.
C.

The Terms of the Proposed Settlement

The following are the material terms of the Settlement:
1.

The Settlement Class

The proposed Settlement Class is defined as follows:
The approximately 98 million U.S. residents identified by Capital One whose
9Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 15 of 38 PageID# 48894

information was compromised in the Data Breach that Capital One announced on
July 29, 2019, as reflected in the Class List.
Excluded from the Settlement Class are (i) Capital One, any entity in which Capital One has acontrolling interest, and Capital One’s officers, directors, legal representatives, Successors,
Subsidiaries, and assigns; (ii) any judge, justice, or judicial officer presiding over the Action andthe members of their immediate families and judicial staff; and (iii) any individual who timely andvalidly opts out of the Settlement Class. Ex. 1, § 2.39.
2.

The Settlement Fund

Capital One will pay $190 million into a Settlement Fund for class benefits, notice andadministration costs, fees, expenses, and service awards to the Settlement Class Representatives.
Id., § 3. No proceeds will revert to Capital One. Id. The specific benefits available to Settlement
Class Members are detailed in the proposed Consumer Settlement Benefits Plan (Ex. 2), andinclude:•Reimbursement for up to $25,000 in “Out-of-Pocket Losses”, which are verifiable
unreimbursed costs or expenditures that a Settlement Class Member actually
incurred and believes are fairly traceable to the Data Breach. Out-of-Pocket Losses
may include, without limitation, the following:o unreimbursed costs, expenses, losses or charges incurred as a result ofidentity theft or identity fraud, falsified tax returns, or other alleged misuseof a Settlement Class Member’s personal information;o costs incurred on or after March 22, 2019, associated with placing or
removing a credit freeze on a Settlement Class Member’s credit file withany credit reporting agency;o other miscellaneous expenses incurred on or after March 22, 2019, related
to any Out-of-Pocket Loss such as notary, fax, postage, copying, mileage,
and long-distance telephone charges;
o costs of credit reports, credit monitoring, or other products related todetection or remediation of identity theft incurred on or after March 22,
2019, through the date of the Settlement Class Member’s claim submission.

10

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 16 of 38 PageID# 48895•

Compensation for “Lost Time”, which is time spent remedying fraud, identity theft,or other misuse of a Settlement Class Member’s personal information that the
Settlement Class Member believes is fairly traceable to the Data Breach and timespent taking preventative measures to avoid such losses. Lost Time will be paid atthe “Reimbursement Rate”, which shall be the greater of $25 per hour, or, if theSettlement Class Member took time off work at the Settlement Class Member’s
documented hourly wage.
o Lost Time related to a qualifying claim for Out-of-Pocket losses may besupported by a certification for up to 15 hours.
o Lost Time not related to a qualifying claim for Out-of-Pocket losses but
incurred as a result of fraud, identity theft or other misuse, or incurred taking
preventative measures to avoid fraud, identity theft or other misuse may besupported by a certification for up to 5 hours.

•

At least three years of Identity Defense Services provided by Pango. This service
is designed to help detect and remediate potential identity theft and fraud, andincludes:o Dark web monitoring for your Social Security number, date of birth,address, driver’s license number, passport number;o Identity monitoring with authentication alerts;
o Lost wallet protection;o Security freeze capability in multiple categories: Credit – Experian,
Equifax, TransUnion and Innovis; Specialty Finance – Sage Stream, Clarity
DATAX and CoreLogic; Closed Checking and Savings accounts – Chex
Systems; and Utilities – NCTUE;
o $1 million in no-deductible insurance covering costs related to identity theftor fraud;o U.S.-based customer support specially trained in identity theft and fraud
discovery and remediation; ando Insight and tips for members on a user dashboard.

•

Additionally, for the approximately 200,000 Settlement Class Members whose
Social Security number or linked bank account number was impacted in the Data
Breach, the offered Identity Defense Services also include industry-leading credit
monitoring, including three-bureau credit monitoring with instant alerts and amonthly credit score.

•

Further, Pango will make available to all Settlement Class Members, even those
who do not enroll in Identity Defense Services or do not submit a claim, access to11

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 17 of 38 PageID# 48896

fraud resolution and identity restoration support (“Restoration Services”) for atleast three years. This coverage is a separate benefit and permits all Settlement
Class Members to have access to Pango’s U.S.-based fraud resolution specialists
who can assist with important tasks such as placing fraud alerts with the credit
bureaus, disputing inaccurate information on credit reports, scheduling calls withcreditors and other service providers, and working with law enforcement andgovernment agencies to dispute fraudulent information.
Ex. 2 and Thompson Decl., Ex. 8. The retail cost of buying the same Identity Defense
Services would be $180.00 per person for three years of the standard service and $540.00 perperson for three years of the service including three-bureau credit monitoring with instant alerts
and a monthly credit score. See Ex. 8.
Settlement Class Members will have 90 days after the Notice Date to claim payment for
Out-of-Pocket Losses and Lost Time. Settlement Class Members are also strongly encouraged toclaim Identity Defense Services during the 90-day claims period. However, Settlement Class
Members may later enroll in Identity Defense Services directly with Pango during the period of
the service, even if they did not make a claim for the service during the Claims Period. No claim
is necessary to access Restoration Services, which are available to all Settlement Class Members.
See Ex. 8.
The Consumer Settlement Benefits Plan provides that if valid claims exceed the Net
Settlement Fund, payments for Out-of-Pocket Losses and Lost Time will be reduced on a pro rata
basis. Ex. 2, ¶ 7.a. If the Net Settlement Fund is not exhausted, the remainder will first be used topurchase up to two years of additional Identity Defense Services and Restoration Services (and to
pay any attendant expenses to provide notice of such extended period for Identity Defense Services
and Restoration Services) and second will be used to increase payments to Settlement Class
Members submitting valid claims on a pro-rated basis. Id. ¶ 7.b.

12

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 18 of 38 PageID# 48897

3.

Proposed Injunctive Relief—Business Practice Changes

Capital One has also agreed to at least two years of Business Practice Changes andcommitments to improve its cybersecurity through the implementation of a Cyber Event Action
Plan. During the discovery phase of the case, a significant effort was targeted at developing an
understanding of the root cause of the Data Breach and the vulnerabilities which were exploitedby the hacker. Moreover, Plaintiffs’ discovery efforts, assisted by consultation with experts,
provided Class Counsel with a firm understanding of the improvements and remediation necessary
to protect the information of Class Members from further exposure and loss to cyber criminals.
With Class Counsel’s experience in litigating numerous data breach cases and armed with theinformation gained during discovery, and with the assistance of cybersecurity experts, ClassCounsel were able to negotiate valuable agreed Business Practice Changes, which are detailed inEx. 2 to the Settlement Agreement (Ex. 1) and ¶ 39 of Class Counsel’s declaration (Ex. 4).
4.

Proposed Notice and Claims Program

Class Counsel have retained, and request that the Court appoint, Epiq Class Action &Claims Solutions, Inc. and its affiliate Hilsoft Notifications (together “Epiq”) as Settlement
Administrator to provide notice to class members and to process claims. The Notice Plan designed
by Epiq satisfies the “best notice practicable” standard pursuant to Rule 23 of the Federal Rules ofCivil Procedure by drawing on the most up-to-date techniques used in commercial advertising to
inform the class and stimulate participation. Ex. 5. The Notice Plan includes dissemination ofindividual notice by email or postcard wherever possible. The total potential Settlement Class size
is approximately 98 million people, and contact information (to provide individual notice) isavailable for virtually all Settlement Class members. The individual notice effort alone is likely toreach at least 90% of the Settlement Class (and likely higher). In addition, internet sponsoredsearch listings will provide additional notice exposures. In Class Counsel’s experience, and13

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 19 of 38 PageID# 48898

according to Epiq, the reach of the Notice Plan meets that of other court-approved notice programs,
and has been designed to meet due process requirements, including the “desire to actually inform”
requirement. The Notice Plan is thus the best notice practicable under the circumstance of thiscase. Ex. 5, ¶¶ 43-46; Ex. 4, ¶¶ 40-41.
The claims process similarly draws upon the most up-to-date techniques to facilitate
participation, including a link to a Settlement website in all emails and digital advertising; theability to file claims electronically or by mail; and a call-center via a toll-free number to assist
class members in filing claims. Epiq, the proposed Settlement Administrator, is a widely-regarded
expert with the experience and capability to handle a case of this magnitude. Ex. 5, ¶¶ 4-8, 10-18,
23-39; Ex. 4, ¶¶ 40-41.
5.

Attorneys’ Fees and Expenses and Service Awards

Class Counsel may separately move for a fee of up to 35% of the Settlement Fund andreimbursement of litigation expenses. Class Counsel may also request service awards of up to$5,000 each for the 8 Settlement Class Representatives and the 10 other MDL Plaintiffs who were
deposed by Capital One. Capital One takes no position on these requests. Class Counsel will movefor fees, expenses, and service awards at least 21 days before the Objection Deadline. Ex. 4, ¶ 43.
6.

Releases

The Settlement Class will release Capital One and Amazon from claims that were or could
have been asserted in this case. The releases are detailed in the Settlement Agreement. Ex. 1, § 14.
ARGUMENTI.

ARTICLE III STANDING

As a preliminary consideration, the Court has an initial obligation to assure itself of thePlaintiffs’ “standing under Article III,” which “extends to court approval of proposed class action
settlements.” Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019) (per curiam). The Court does not have
14

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 20 of 38 PageID# 48899

the power “to approve a proposed class settlement if it lacks jurisdiction over the dispute, andfederal courts lack jurisdiction if no named plaintiff has standing.” Id. “On the other hand, only
one named plaintiff must have standing as to any particular claim in order for it to advance.” In re
Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1261 (11th Cir. 2021), cert. denied
sub nom. Huang v. Spector, 142 S. Ct. 431 (2021), and cert. denied sub nom. Watkins v. Spector,
No. 21-638, 2022 WL 89334 (U.S. Jan. 10, 2022). The Court need not determine whether absent
settlement class members have standing to have jurisdiction to approve a settlement. J.D. v. Azar,
925 F.3d 1291, 1324 (D.C. Cir. 2019); see also Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc.,
892 F.3d 613, 620 (4th Cir. 2018) (In a class action, “we analyze standing based on the allegationsof personal injury made by the named plaintiffs.”) (internal quotation marks omitted). Thus, toassure itself of its jurisdiction to approve the Settlement, the Court must find that at least one
Settlement Class Representative has “(1) suffered an injury-in-fact, (2) that is fairly traceable tothe challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial
decision.” Hutton, 892 F.3d at 619 (citation omitted).
The Court should readily conclude that it has jurisdiction over the Settlement because theSettlement Class Representatives have established standing to sue. As just one example,
Settlement Class Representative Gary Zielicke has presented evidence from which a reasonablefactfinder could conclude that he suffered fraud using his personal information stolen in the Data
Breach. Doc. 1807 at Appendix 1 (summarizing evidence for Mr. Zielicke and other Settlement
Class Representatives). Fraud resulting from a data breach is an injury in fact that is traceable tothe breached defendant and is redressable by a federal court. See Hutton, 892 F.3d at 622-24. Mr.
Zielicke also incurred costs to mitigate the fraud and prevent additional fraud (see Doc. 1807 at
Ex. BB), which also provides standing. Hutton, 892 F.3d at 622; see also TransUnion LLC v.

15

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 21 of 38 PageID# 48900

Ramirez, 141 S. Ct. 2190, 2204 (2021) (“If a defendant has caused . . . monetary injury to theplaintiff, the plaintiff has suffered a concrete injury in fact under Article III.”).
In addition, Capital One has stipulated that its Privacy Notice contains one or more express
contractual provisions covering Capital One’s obligations with respect to safeguarding personal
information. Doc. 1098. The Settlement Class Representatives have presented evidence fromwhich a reasonable factfinder could conclude that Capital One breached one or more of thesecontractual obligations related to data security as to all Settlement Class Members, resulting in thetheft of their and every Settlement Class Member’s personal information in the Data Breach. Doc.
1649. Further, Settlement Class Representatives have presented evidence supporting theiralternative claim that Capital One breached an implied contract with Settlement Class
Representatives and Settlement Class Members to provide reasonable data security. Id. Either issufficient to provide standing to the Settlement Class Representatives and thus to invoke the
Court’s subject matter jurisdiction to approve the Settlement.4 See L-3 Commc’ns Corp. v. Serco,
Inc., 673 F. App’x 284, 289 (4th Cir. 2016) (“[B]y alleg[ing] the existence of a contract, express
or implied, and a concomitant breach of that contract, [the plaintiff’s] complaint adequately
show[ed] an injury to her rights for purposes of standing.”) (citation and quotations omitted); seealso id. (“[W]hether a plaintiff ultimately recovers the damages he seeks is a question better left
to the applicable substantive law rather than a standing inquiry under Article III.”) (citation andquotations omitted).

4

Because Article III standing exists for the contract and implied contract claims, the Court need
not reach the standing question with respect to the other claims.
16

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 22 of 38 PageID# 48901

II.

THE COURT SHOULD DIRECT NOTICE TO THE SETTLEMENT
CLASSWhen binding absent class members—as contemplated by the Settlement here—the Court“must direct notice in a reasonable manner to all class members who would be bound by the
proposal if giving notice is justified by the parties’ showing that the court will likely be able to (i)approve the proposal under Rule 23(e)(2)” by finding that the Settlement is “fair, reasonable, andadequate”; and (ii) “certify the class for purposes of judgment on the proposal.” Fed. R. Civ. P.
23(e)(1)-(2). In determining whether a settlement is fair, reasonable, and adequate, the Court must
consider whether:(A) the class representatives and class counsel have adequately represented the class;(B) the proposal was negotiated at arm’s length;(C) the relief provided for the class is adequate, taking into account:(i) the costs, risks, and delay of trial and appeal;(ii) the effectiveness of any proposed method of distributing relief to the class,including the method of processing class-member claims;(iii) the terms of any proposed award of attorney’s fees, including timing of
payment; and(iv) any agreement required to be identified under Rule 23(e)(3); and(D) the proposal treats class members equitably relative to each other.
Fed. R. Civ. P. 23(e)(2).
The Court’s Rule 23(e) obligations are addressed with a “two-level analysis.” In re The
Mills Corp. Sec. Litig., 265 F.R.D. 246, 254 (E.D. Va. 2009). To determine whether a settlement
is fair, the Court considers the four factors set forth by the Fourth Circuit in Jiffy Lube: “(1) the
posture of the case at the time settlement was proposed; (2) the extent of discovery that had been
conducted; (3) the circumstances surrounding the negotiations; and (4) the experience of counsel.”In re Jiffy Lube Securities Litigation, 927 F.2d 155, 158-59 (4th Cir. 1991). To determine whether
17Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 23 of 38 PageID# 48902

a settlement is adequate, the courts also look to: “(1) the relative strength of the plaintiffs’ case on
the merits, (2) the existence of any difficulties of proof or strong defenses the plaintiffs are likely
to encounter if the case goes to trial, (3) the anticipated duration and expense of additional
litigation, (4) the solvency of the defendants and the likelihood of recovery on a litigated judgment,and (5) the degree of opposition to the settlement.” Id.
Evaluation under these enumerated factors confirms that the proposed Settlement is fair,adequate, and reasonable; accordingly, the Court should issue notice of the Settlement to theSettlement Class.
A.

The Class Was Adequately Represented.

“[T]he adequacy requirement is met when: (1) the named plaintiff does not have interests
antagonistic to those of the class; and (2) plaintiff‘s attorneys are qualified, experienced, andgenerally able to conduct the litigation.” Brown v. Transurban USA, Inc., 318 F.R.D. 560, 567(E.D. Va. 2016) (citation omitted). Here, the Settlement Class Representatives have the sameinterests as other class members as they are asserting the same claims and share the same injuries.
Further, the Court has already recognized Class Counsel’s experience and qualifications inappointing them to lead this litigation and the record shows Class Counsel worked diligently tolitigate and ultimately bring this case to resolution. Ex. 4, ¶¶ 3-31; see also In re: Lumber
Liquidators Chinese-Manufactured Flooring Prod. Mktg., Sales Practices & Prod. Liab. Litig.,
952 F.3d 471, 485 (4th Cir. 2020) (finding counsel’s experience in complex civil litigation
supported fairness of settlement).
B.

The Proposed Settlement Was Negotiated at Arm’s Length.

The Court can safely conclude this Settlement was negotiated at arm’s length, without
collusion, based on the terms of the Settlement itself; the Parties’ vigorous pursuit of fact and18

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 24 of 38 PageID# 48903

expert discovery and briefing and argument of numerous legal issues; the length and difficulty of
the negotiations; and the involvement of two experienced mediators, including Judge Brinkema.
See In re NeuStar, Inc. Sec. Litig., No. 1:14–CV–885(JCC/TRJ), 2015 WL 5674798, at *10 (E.D.
Va. Sept. 23, 2015) (adversarial encounters support a finding of arms’ length negotiations). Thisfactor supports a finding that the Court will likely be able to finally approve the Settlement.
C.

The Relief is Fair, Reasonable, and Adequate.

The relief offered to Class Members in the proposed Settlement is more than adequate
under the factors outlined in Rule 23(e)(2)(C). Settlement Class Members are entitled to benefits
that are tailored to the relief sought through the litigation: recovery of up to $25,000 in Out-ofPocket Losses; payment for Lost Time spent dealing with the Data Breach; at least three years of
Identity Defense Services to help detect and remediate potential identity theft and fraud; and at
least three years of Restoration Services including access to U.S.-based specialists in fraud
resolution and identity restoration available to all Settlement Class Members without making aclaim. Capital One’s agreed Business Practice Changes are likewise an important benefit flowing
to Settlement Class Members, whose sensitive personal information may still reside at Capital
One.
Class Counsel, a group with extraordinary experience in leading major data breach classactions, strongly believe that the relief is fair, reasonable, and adequate. Ex. 4, ¶¶ 3-10. The Court
may rely upon such experienced counsel’s judgment. See, e.g., Nelson v. Mead Johnson & Johnson
Co., 484 F. App’x 429, 434 (11th Cir. 2012) (“Absent fraud, collusion, or the like, the district court
should be hesitant to substitute its own judgment for that of counsel.”) (quotation omitted).
That the relief is fair, reasonable, and adequate is further confirmed by considering the four
specific factors enumerated in Rule 23(e)(2).

19

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 25 of 38 PageID# 48904

1.

The costs, risk, and delay of trial and appeal.

Plaintiffs faced significant risks and costs should they continue to litigate the case. First,
there was a risk that Plaintiffs’ claims would not have survived, or survived in full, on a class-widebasis after a ruling on the fully briefed and argued motion for class certification, motions forsummary judgment, Daubert motions on damages methodologies and other issues, and challenges
to the existence of a tort duty under Virginia law. Second, if Plaintiffs had prevailed on theirpending motion for class certification and successfully defeated Defendants’ pending motions thus
proceeding to trial, Plaintiffs still would have faced significant risk, cost, and delay including likelyinterlocutory and post-judgment appeals.
In contrast to the risk, cost, and delay posed by the pending motions and possible appeals
and trial, the proposed Settlement provides certain, substantial, and immediate relief to the
proposed Settlement Class without delay. It ensures that Settlement Class Members with valid
claims for Out-of-Pocket Losses or Lost Time will receive guaranteed compensation now, andprovides Settlement Class Members with access to Identity Defense Services and Restoration
Services, benefits that may not have been available at trial. It also requires injunctive relief thatwill help protect Class Member data from potential subsequent exposure.
The substantial costs, risk, and delay of a trial and appeal support a finding that the
proposed Settlement is adequate.
2.

The method of distributing relief is effective.

The proposed distribution process will be efficient and effective. The available relief isdetailed clearly in the Notice, which will be provided to all Settlement Class Members and lays
out the benefits to which they are entitled, including benefits provided regardless of whether a
Settlement Class Member files a claim.

20

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 26 of 38 PageID# 48905

As an initial matter, noticing the Settlement Class of the available relief will be efficientand effective. The proposed Notice Plan includes dissemination of individual notice by email or
postcard wherever possible. The total potential Settlement Class size is approximately 98 million
people, and contact information (to provide individual notice) is available for virtually all
Settlement Class members. The Settlement Administrator expects that the individual notice effort
alone will reach at least 90% of the Settlement Class (and likely higher). Ex. 5, ¶ 20. In addition,
supplemental internet sponsored search listings will provide additional notice exposures.
Therefore, Settlement Class Members will receive effective and efficient notice of the three
categories of relief, which will be distributed as follows:First, Settlement Class Members are entitled to make claims online via the Settlement
website or by mail for reimbursement for Out-of-Pocket Losses, such as fraudulent expenses or
charges, and compensation for a certain number of hours of “Lost Time” spent remedying fraud,
identity theft, or other misuse of personal information. See Ex. 6, Long Form Notice. Settlement
Class Members need only submit a claim form on the website or by mail accompanied byreasonable documentation showing the claimed expenses to establish Out-of-Pocket Losses, or aself-certification of their Lost Time. See Ex. 2. If a claim is rejected for any reason, there is also a
consumer-friendly appeals process whereby claimants will have the opportunity to cure any
deficiencies in their submission or request an automatic appeal if the Settlement Administrator
determines a claim is deficient in whole or part. Id. at ¶ 9.
Second, Settlement Class Members will be entitled to at least three years of Identity
Defense Services provided by Pango, to help detect and remediate potential identity theft andfraud. Settlement Class Members need only visit the Settlement website and sign-up via an online

21

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 27 of 38 PageID# 48906

form in order to claim this benefit. And even if a Settlement Class Member does not initially claim
Identity Defense Services, they can later enroll directly with Pango during the period of the service.
Third, for at least three years all Settlement Class Members will be entitled to utilize
Restoration Services offered through Pango, regardless of whether they submit a claim for losses
or enroll in Identity Defense Services. Id. at ¶¶ 2, 5. This coverage is a separate benefit and permits
all Settlement Class Members to have access to U.S.-based fraud resolution specialists who can
assist with important tasks such as placing fraud alerts with the credit bureaus, disputing inaccurate
information on credit reports, scheduling calls with creditors and other service providers, andworking with law enforcement and government agencies to dispute fraudulent transactions or
credit applications.
Because Settlement Class Members may make claims through a simple online form or by
mail—and have the benefit of additional services for which they need take no action, including the
Restoration Services detailed above as well as the business practices Capital One has agreed to—the method of distributing the relief is both efficient and effective, and the proposed Settlement isadequate under this factor.
3.

The terms relating to attorneys’ fees are reasonable.

Class Counsel will request a fee expressed as a percentage of the value conferred by the
Settlement on the Settlement Class, and for reimbursement of expenses incurred in prosecuting
and settling this case. Ex. 1, § 19. Where, as here, a class settlement creates a non-reversionary
common fund, fees are awarded on a “percentage of the fund” approach. See, e.g., Transurban,
318 F.R.D. at 575. Under the Settlement Agreement, Plaintiffs’ request for Attorneys’ Fees andExpenses must be filed with the Court at least 21 days before the Objection deadline. Ex. 1, § 19.1.
In the settlement negotiations, attorneys’ fees were not discussed in any manner until the Parties
had reached agreement on the material terms of the Settlement, including the amount of the22Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 28 of 38 PageID# 48907

Settlement Fund. Ex. 4, ¶ 42. Capital One has agreed not to oppose any request for fees not inexcess of 35 percent of the common fund, Ex. 1, § 19.2, but the ultimate fee award will be
determined in the discretion of the Court based on an application to the Court based on Fourth
Circuit law with the opportunity for comment from Settlement Class Members.
Importantly, the Settlement Agreement is not conditioned upon the Court’s approval of thefee award. Ex. 1, § 19.3. Accordingly, at this stage, the Court can and should conclude that it islikely to approve the Settlement for purposes of sending notice to the Settlement Class, even if it
has not yet concluded whether and in what amount it would award attorneys’ fees and expenses. 5
The proposed Settlement is adequate under this factor.
4.

Any agreement required to be identified under Rule 23(e)(3).

Rule 23(e) mandates that “[t]he parties seeking approval must file a statement identifying
any agreement made in connection with the proposal,” and that the Court must then take into
account any such agreements when determining whether the relief provided in the settlement isadequate. See Fed. R. Civ. P. 23(e)(2)-(3). As is common in consumer class settlements, the Parties
have entered into a confidential supplemental agreement establishing the opt-out threshold above
which Capital One may terminate the Settlement Agreement. The Parties will submit in camera or
seek leave to file under seal with the Court this confidential supplemental agreement with accesslimited to the Parties’ counsel.
This factor weighs in favor of finding that the Proposed Settlement is adequate.

Similarly, Class Counsel will request service awards of $5,000 for each of the Settlement Class
Representatives and other MDL Plaintiffs who were deposed in this case. Service awards of thissize are reasonable. See In re: Lumber Liquidators Chinese-Manufactured Flooring Durability
Mktg., No.115MD2627AJTTRJ, 2020 WL 5757504, at *3 (E.D. Va. Sept. 4, 2020) (granting
service award of $5,000). The Settlement Agreement is not conditioned on the Court’s approvalof this request. Ex. 1, § 18.3.
523

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 29 of 38 PageID# 48908

D.

The Proposed Settlement Treats Class Members Equitably.

Finally, the proposed Settlement treats all class members equitably relative to each other.
Fed. R. Civ. P. 23(e)(2)(D). All Settlement Class Members will have the same opportunity to filea claim for Out-of-Pocket Losses and Lost Time; this means that monetary compensation will beapportioned in accordance with each claimant‘s injury. In the event claims exceed the available
funds, all claims will be reduced pro rata, with no Settlement Class Member obtaining any greater
relative benefit over another. This factor likewise supports a finding that the Court will be able toapprove the proposed Settlement, and that class notice is appropriate.
III.

THE PROPOSED SETTLEMENT CLASS MEETS THE
REQUIREMENTS FOR CERTIFICATION.

To issue notice, the Court should decide it will “likely be able to . . . certify the class forpurposes of judgment.” Fed. R. Civ. P. 23(e)(1)(B); Amchem Prods. Inc. v. Windsor, 521 U.S. 591,
620 (1997). Such a decision should not be difficult here. Settlement classes are routinely certified
in similar consumer data breach cases. See, e.g., Abubaker v. Dominion Dental USA, Inc., No.
1:19-cv-01050, 2021 WL 6750844 (E.D. Va. Nov. 19, 2021) (Brinkema, J.); Hutton v. Nat’l Bd.
of Examiners in Optometry, Inc., No. 1:16-c-03025, 2019 WL 3183651 (D. Md. July 15, 2019); In
re: Equifax Inc. Customer Data Security Breach Litig., No. 1:17-md-2800, 2020 WL 256132 (N.D.
Ga. March 17, 2020) ), aff’d in relevant part 999 F.3d 1247 (11th Cir. 2021), cert. denied sub nom.
Huang v. Spector, 142 S. Ct. 431 (2021), and cert. denied sub nom. Watkins v. Spector, No. 21638, 2022 WL 89334 (U.S. Jan. 10, 2022); In re Anthem, Inc. Data Breach Litig., 327 F.R.D. 299(N.D. Cal. 2018). There is nothing different about this case, which is demonstrated by examining
the requirements of Rule 23(a) and (b).66

There exists a fulsome record supporting class certification. See Docs. 1259, 1261 (Plaintiffs’
motion for class certification and memorandum in support); Doc. 1557 (Plaintiffs’ reply in supportof class certification).
24

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 30 of 38 PageID# 48909

A.

The Rule 23(a) Requirements Are Satisfied.

Numerosity: The proposed Settlement Class consists of approximately 98 million U.S.
residents, indisputably rendering individual joinder impracticable. See Jeffreys v. Commc’ns
Workers of Am. AFL–CIO, 212 F.R.D. 320, 322 (E.D. Va. 2003) (noting that “where the classnumbers twenty-five or more, joinder is generally presumed to be impracticable”).
Commonality: “Commonality requires the plaintiff to demonstrate that the class members
have suffered the same injury” such that all their claims “can productively be litigated at once.”
Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 349-350 (2011) (internal citations omitted). Thisrequires that the determination of the common question “will resolve an issue that is central to thevalidity of each one of the claims in one stroke.” Id. at 350 “Even a single common question willdo.” Id. at 359 (internal quotations omitted). All Settlement Class Members suffered the same
injury—theft of their personal data in the Data Breach—and are asserting the same legal claims.
Accordingly, common questions of law and fact abound. See, e.g., Dominion, 2021 WL 6750844,
at *3; Equifax, 2020 WL 256132, at *11-12; Anthem, 327 F.R.D. at 309.
Typicality: Typicality under Rule 23(a)(3) requires an inquiry into the “representative
parties’ ability to represent a class . . . .” Deiter v. Microsoft Corp., 436 F.3d 461, 466 (4th Cir.
2006). “The premise of the typicality requirement is simply stated: as goes the claim of the named
plaintiff, so go the claims of the class.” Broussard v. Meineke Disc. Muffler Shops, Inc., 155 F.3d
331, 340 (4th Cir. 1998) (citation and quotations omitted). In other words, the “plaintiff’s claim
cannot be so different from the claims of absent class members that their claims will not be
advanced by plaintiff’s proof of his own individual claim.” Deiter, 436 F.3d at 466-67. Thisrequirement is readily satisfied in data breach cases. The Settlement Class Representatives’ claims
are typical of other Settlement Class Members because they arise from the same Data Breach and25

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 31 of 38 PageID# 48910

involve the same overarching legal theories, including the theories that Capital One breached its
contracts with Settlement Class Representatives and class members and failed in its common-law
duty to protect their personal information. See, e.g., Dominion, 2021 WL 6750844, at *3; Equifax,
2020 WL 256132, at *12.
Adequacy of Representation: “The adequacy inquiry . . . serves to uncover conflicts ofinterest between named parties and the class they seek to represent.” Amchem Prods., Inc. v.
Windsor, 521 U.S. 591, 625 (1997). Settlement Class Representatives do not have any interests
antagonistic to other class members and have retained lawyers who are abundantly qualified andexperienced, satisfying the adequacy requirement. Ex. 4, ¶¶ 3-9, 50.
B.

The Rule 23(b)(3) Requirements Are Satisfied

Rule 23(b)(3) requires that “questions of law or fact common to class members
predominate over any questions affecting only individual members,” and that class treatment is“superior to other available methods for fairly and efficiently adjudicating the controversy.” Onepart of the superiority analysis—manageability—is irrelevant for purposes of certifying asettlement class. Transurban, 318 F.R.D. at 569.
Predominance: Rule 23(b)(3)’s predominance requirement tests whether a proposed classis “sufficiently cohesive to warrant adjudication by representation.” Amchem Prods., Inc. v.
Windsor, 521 U.S. 591, 623 (1997). The predominance inquiry measures the relative weight of thecommon questions as against individual ones. Amchem, 521 U.S. at 624. “If the ‘qualitatively
overarching issue’ in the litigation is common, a class may be certified notwithstanding the needto resolve individualized issues.” Soutter v. Equifax Info. Servs., LLC, 307 F.R.D 183, 214 (E.D.
Va. 2015) (citing Ealy v. Pinkerton Gov’t Servs., 514 F. App’x 299, 305 (4th Cir. 2013)). Common
liability issues often predominate where class members “all assert injury from the same action.”26

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 32 of 38 PageID# 48911

Gray v. Hearst Commc’ns, Inc., 444 F. App’x 698, 701–02 (4th Cir. 2011); see also Stillmock v.
Weis Markets, Inc., 385 F. App’x 267, 273 (4th Cir. 2010) (finding common issues predominated
where class members were exposed to “the identical risk of identity theft in the identical mannerby the repeated identical conduct of the same defendant.”).
Here, as in other data breach cases, common questions predominate because all claims ariseout of a common course of conduct by Capital One. See, e.g., Dominion, 2021 WL 6750844, at*3; Equifax, 2020 WL 256132, at *13; Anthem, 327 F.R.D. at 311-16. The focus on a defendant’ssecurity measures in a data breach class action “is the precise type of predominant question thatmakes class-wide adjudication worthwhile.” Anthem, 327 F.R.D. at 312. Further, the Court
previously found that Virginia law applies across all common law claims, e.g., Plaintiffs’ claims
for breach of contract (Doc. 879 at 9) and Plaintiffs’ tort and quasi-contract claims (Doc. 1293),
such that any “variations in state law will not predominate over the common questions.” Equifax,
2020 WL 256132, at *13.
Superiority: “[T]he purpose of the superiority requirement is to assure that the class actionis the most efficient and effective means of resolving the controversy . . . .” 7AA Charles Wright,
Arthur Miller & Mary Kay Kane, Federal Practice and Procedure § 1779 (3d ed. 2005). Litigating
the same claims of 98 million Americans through individual litigation would obviously be
inefficient. The superiority requirement thus is satisfied. See Equifax, 2020 WL 256132, at *14;
Anthem, 327 F.R.D. at 315-16.
IV.

THE COURT SHOULD APPROVE THE CONSUMER SETTLEMENTBENEFITS PLAN.

The Consumer Settlement Benefits Plan was designed by Class Counsel to equitably
distribute cash and other relief to Settlement Class Members. The Plan is based in large part on
Class Counsel’s experience in scores of privacy and data breach class actions, and reflects iterated
27

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 33 of 38 PageID# 48912

improvements from the settlements of the largest data breach MDLs to date. The Plan includes
guidance for the Settlement Administrator in reviewing claims, specific mechanisms to address
instances where the Settlement Fund is either depleted or has a remainder, and a simple and fairappeal process for disallowed claims. Plaintiffs request that the Court approve the Consumer
Settlement Benefits Plan (Exhibit 2) and direct that Class Counsel and the Administrator
implement the Plan according to its own terms and the Settlement Agreement.
V.

THE COURT SHOULD APPROVE THE NOTICE PLAN, NOTICES, AND
CLAIM FORM, AND APPOINT THE SETTLEMENT ADMINISTRATOR.

To satisfy the requirements of both Rule 23 and due process, Rule 23(c)(2)(B) provides
that, “[f]or any class certified under Rule 23(b)(3), the court must direct to class members the bestnotice that is practicable under the circumstances, including individual notice to all members who
can be identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B); Eisen v. Carlisle &Jacquelin, 417 U.S. 156, 173 (1974). Rule 23(e)(1) similarly requires that notice be reasonably
disseminated to those who would be bound by the court’s judgment. Fed. R. Civ. P. 23(e)(1). The
best practicable notice is that which is “reasonably calculated, under all the circumstances, toapprise interested parties of the pendency of the action and afford them an opportunity to present
their objections.” Mullane v. Cent. Hanover Bank & Trust Co., 339 U.S. 306, 314 (1950).
Plaintiffs request that the Court appoint Epiq as the Settlement Administrator and approve
the Notice Plan submitted by Epiq. See Ex. 5. The Notice Plan is uncomplicated. Capital One will
generate and provide to Epiq a Class List within 30 days of the Preliminary Approval Order. Ex.
1, § 10.2. Using the information in that list, Epiq will provide direct notice by email or, as
necessary, mailed postcard. Combined with other supplemental notice methods, Epiq expects thenotice to reach at least 90% of the identified Settlement Class Members, easily meeting therequirements of Rule 23 and due process. Ex. 5, ¶20; see, e.g., Federal Judicial Center, “Judges’28

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 34 of 38 PageID# 48913

Class Action Notice and Claims Process Checklist and Plain Language Guide” (2010) (recognizing
the effectiveness of notice that reaches between 70 and 95 percent of the class). When
implemented, the Notice Plan will provide the best notice practicable under the circumstances. Ex.
5, ¶¶ 19-47; Ex. 4, ¶¶ 40-41.
The Court should also approve the proposed forms of notice attached as Exhibit 6(“Notices”), which satisfy all of the criteria of Rule 23. The Notices are clear, straightforward, andprovide persons in the proposed Settlement Class with enough information to evaluate whether toparticipate in the Settlement. Ex. 5, ¶¶ 40-41. The Notices also advise the proposed Settlement
Class how to exclude themselves from the Settlement, and how to object to the Settlement,
including the requested attorney fees and costs. Thus, the Notices satisfy the requirements of Rule
23. Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 812 (1985) (explaining a settlement noticemust provide settlement class members with an opportunity to present their objections to thesettlement).
Finally, the Court should approve the Claim Form attached as Exhibit 7. The Claim Formis written in plain language and can be submitted online or printed and mailed to the Settlement
Administrator. Ex. 5, ¶¶ 37, 40-42.
VI.

THE COURT SHOULD APPOINT THE PROVIDER OF IDENTITY
DEFENSE SERVICES AND RESTORATION SERVICES.

Plaintiffs request that the Court appoint Intersections, LLC d/b/a Pango (“Pango”) as theprovider of Identity Defense Services and Restoration Services under the Consumer Settlement
Benefits Plan. Pango has broad experience in providing its services to individuals, large
companies, and in servicing large and small data breach populations, including in class action
settlements. Pango’s qualifications and services are detailed in the Declaration of Gerald
Thompson, attached as Exhibit 8.
29

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 35 of 38 PageID# 48914

VII.

THE COURT SHOULD APPOINT CLASS COUNSEL.

When certifying a class, Rule 23 requires a court to appoint class counsel that will fairly
and adequately represent the class members. Fed. R. Civ. P. 23(g)(1)(B). In making thisdetermination, the Court considers counsel’s work in identifying or investigating potential claims;
experience in handling class actions or other complex litigation and the types of claims asserted in
the case; knowledge of the applicable law; and resources committed to representing the class. Fed.
R. Civ. P. 23(g)(1)(A)(i–iv).
The Court previously appointed Norman E. Siegel, Karen Hanson Riebel, and John A.
Yanchunis as Plaintiffs’ Co-Lead Counsel. Doc. 210 (Pretrial Order #3 Appointing Plaintiffs’ LeadCounsel); see also Doc. 136 (Siegel application and qualifications); Doc. 135 (Riebel); Doc. 140(Yanchunis); Ex. 4, ¶¶ 3-9 (summary of qualifications and experience). Throughout this case, LeadCounsel have demonstrated the hard work, legal scholarship, experience, and resources they bring
to bear, ultimately resulting in the Settlement now before the Court. The Court should thus appoint
them as Class Counsel under Rule 23(g).
CONCLUSION
For the reasons set forth set forth above, Plaintiffs request the Court enter the orderproposed by the Parties directing the Settlement Class be notified of the proposed Settlement in
the manner set forth in the Notice Plan and schedule a Final Approval Hearing.

30

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 36 of 38 PageID# 48915

APPENDIX A – TIMELINE OF SETTLEMENT EVENTSFor convenience, proposed dates and deadlines leading to a Final Approval Hearing areprovided below and in the proposed order separately submitted to the Court.
ACTIONDATE

Defendants Provide Class Member List

Within 30 days following entry of Order
Directing Notice

Notice Date

105 days following entry of Order Directing
NoticeProof of Notice Submitted

At least 10 days prior to the Final Approval
Hearing

Motion for Attorneys’ Fees, Expenses, andService Awards to the Plaintiffs

21 days prior to the Objection Deadline

Exclusion / Opt-Out Deadline

45 days after Notice Date

Objection Deadline

45 days after Notice Date

Final Approval Brief and Response to At least 10 days prior to the Final Approval
Objections Due
Hearing
Final Approval Hearing(To be scheduled no earlier than 175 days after
entry of Preliminary Approval Order)

Deadline to Submit Claims

90 days after Notice Date

31

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 37 of 38 PageID# 48916

Dated: January 31, 2022
Respectfully Submitted,/s/ Steven T. Webster
Steven T. Webster (VSB No. 31975)
WEBSTER BOOK LLP
300 N. Washington Street, Suite 404
Alexandria, Virginia 22314
Tel: (888) 987-9991
stw@websterbook.com
Plaintiffs’ Local Counsel
Norman E. Siegel
STUEVE SIEGEL HANSON LLP
460 Nichols Road, Suite 200
Kansas City, MO 64112
Tel: (816) 714-7100
siegel@stuevesiegel.com
Karen Hanson Riebel
LOCKRIDGE GRINDAL NAUEN, P.L.L.P
100 Washington Avenue South, Suite 2200
Minneapolis, MN 55401
Tel: (612) 339-6900
khriebel@locklaw.com
John A. Yanchunis
MORGAN & MORGAN COMPLEX
LITIGATION GROUP
201 N. Franklin Street, 7th Floor
Tampa, FL 33602
Tel: (813) 223-5505
jyanchunis@ForThePeople.com
Plaintiffs’ Lead Counsel

32

Case 1:19-md-02915-AJT-JFA Document 2219 Filed 01/31/22 Page 38 of 38 PageID# 48917

CERTIFICATE OF SERVICE
I hereby certify that on January 31, 2022, I electronically filed the foregoing documentwith the Clerk of the Court using the CM/ECF system, which will send notice of electronic filingto all counsel of record.
/s/ Steven T. Webster
Steven T. Webster (VSB No. 31975)
WEBSTER BOOK LLP

33