1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

MORGAN & MORGAN

COMPLEX LITIGATION GROUP

John A. Yanchunis (Admitted Pro Hac Vice)

201 N. Franklin Street, 7th Floor

Tampa, FL 33602

Telephone: 813/223-5505

813/223-5402 (fax)

jyanchunis@ForThePeople.com

ROBBINS GELLER RUDMAN

& DOWD LLP

Stuart A. Davidson (Admitted Pro Hac Vice)

120 East Palmetto Park Road, Suite 500

Boca Raton, FL 33432

Telephone: 561/750-3000

561/750-3364 (fax)

sdavidson@rgrdlaw.com

CASEY GERRY SCHENK FRANCAVILLA

 BLATT & PENFIELD LLP

Gayle M. Blatt (122048)

110 Laurel Street

San Diego, CA 92101

Telephone: 619/238-1811

619/544-9232 (fax)

gmb@cglaw.com

MILBERG TADLER PHILLIPS 

GROSSMAN LLP

Ariana J. Tadler (Admitted Pro Hac Vice)

One Pennsylvania Plaza, 19th Floor

New York, NY 10119

Telephone: 212/594-5300

212/868-1229 (fax)

atadler@milberg.com

LOCKRIDGE GRINDAL NAUEN P.L.L.P.

Karen Hanson Riebel (Admitted Pro Hac Vice)

100 Washington Ave. South, Suite 2200

Minneapolis, MN 55401

Telephone: 612/339-6900

612/339-0981 (fax)

khriebel@locklaw.com

ROBINSON CALCAGNIE, INC.

Daniel S. Robinson (244245)

19 Corporate Plaza Dr.

Newport Beach, CA 92660

Telephone: 949/720-1288 

949/720-1292

drobinson@robinsonfirm.com

Attorneys for Plaintiffs and Proposed Class Counsel

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA - SAN JOSE DIVISION

IN RE: YAHOO! INC. CUSTOMER DATA 

SECURITY BREACH LITIGATION

)

)

)

)

)

)

)

)

)

)

)

No. 16-md-02752-LHK

MEMORANDUM OF POINTS AND 

AUTHORITIES IN SUPPORT OF 

PLAINTIFFS’ MOTION FOR 

PRELIMINARY APPROVAL OF CLASS 

ACTION SETTLEMENT 

Date: November 29, 2018

Time: ____ p.m.

Courtroom: 8, 4th Floor

Judge: Hon. Lucy H. Koh

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 1 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - i -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Table of Contents

I. Introduction ..................................................................................................................................1

II. Background .................................................................................................................................2

A. Yahoo’s Services and Representations Concerning Data Security.................................2

B. The 2013 Breach, 2014 Breach, And Forged Cookie Breach ........................................3

C. Coordination and Consolidation in Federal and State Courts ........................................4

D. Litigation History............................................................................................................4

E. Plaintiffs’ Claims and Relief Sought...............................................................................6

F. Defendants’ Class Certification Opposition and Daubert Challenges ...........................7

G. Settlement Negotiations .................................................................................................8

III. The Settlement Terms................................................................................................................8

A. Proposed Settlement Class..............................................................................................8

B. Business Practice Changes .............................................................................................8

C. Settlement Fund...............................................................................................................9

1. Out-Of-Pocket Costs..........................................................................................10

2. Paid User and Small Business User Costs.........................................................11

3. Alternative Compensation .................................................................................11

D. Credit Services..............................................................................................................12

E. Class Notice and Settlement Administration.................................................................13

F. Service Awards To Named Plaintiffs ...........................................................................14

G. Attorneys’ Fees, Costs, and Expenses ..........................................................................14

H. Reduction or Residual...................................................................................................14

I. Release............................................................................................................................15

IV. Argument ................................................................................................................................15

A. The Settlement Class Should Be Preliminarily Certified..............................................15

1. The Rule 23(A) Requirements Are Met.............................................................15

2. The Rule 23(B) Requirements Are Met.............................................................16

B. The Settlement Should Be Preliminarily Approved......................................................17

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 2 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - ii -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. The Strength of Plaintiffs’ Case.........................................................................19

2. The Risk, Expense, Complexity, and Duration of Further Litigation................20

3. The Risk of Maintaining Class Action Status Through Trial ............................21

4. The Amount Offered In Settlement ...................................................................22

5. The Extent of Discovery Completed and the Stage of Proceedings..................22

6. The Experience and View of Counsel ..............................................................23

7. The Presence of a Government Participant........................................................23

8. The Reaction of the Class Members to the Proposed Settlement ......................23

9. Lack of Collusion Among the Parties................................................................23

C. The Proposed Notice Plan Should Be Approved ..........................................................23

D. Appointment of the Settlement Administrator..............................................................24

E. Appointment of Settlement Class Counsel....................................................................25

F. Schedule For Final Approval.........................................................................................25

V. Conclusion ................................................................................................................................25

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 3 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - iii -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CASES

Amchem Prods. v. Windsor, 521 U.S. 591,620 (1997)................................................................. 15

Ellis v. Costco Wholesale Corp., 657 F.3d 970, 979-80 (9th Cir. 2011)...................................... 15

G. F. v. Contra Costa Cty., 2015 WL 4606078, at *13 (N.D. Cal. July 30, 2015) ...................... 23

Hammond v. The Bank of N.Y. Mellon Corp., 2010 WL 2643307, at *1 (S.D.N.Y. 

June 25, 2010)................................................................................................................... 21

Hanlon v. Chrysler Corp., 150 F.3d 1011, 1022 (9th Cir. 1998). ................................................ 16

In re Anthem, Inc. Data Breach Litig., 15-MD-02617-LHK, 2018 WL 3872788, at 

*11 (N.D. Cal. Aug. 15, 2018).......................................................................................... 17

In re Bluetooth Headset Products Liab. Litig., 654 F.3d 935, 946 (9th Cir. 2011)...................... 19

In re High-Tech Employee Antitrust Litig., 2014 WL 3917126, at *3 (N.D. Cal. Aug. 

8, 2014) ............................................................................................................................. 17

In re Linkedin User Privacy Litig., 309 F.R.D. 573, 585 (N.D. Cal. 2015) ................................. 17

In re Tableware Antitrust Litig., 484 F. Supp. 2d 1078, 1079-80 (N.D. Cal. 2007) .................... 17

In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig., 266 F. Supp. 3d 1, 19 

(D.D.C. 2017) ................................................................................................................... 21

In re: Yahoo! Inc. Customer Data Breach Security Litigation, Case No. 16-md02752-LHK (N.D. Cal.)...................................................................................................... 4

Just Film, Inc. v. Buono, 847 F.3d 1108, 1118 (9th Cir. 2017).................................................... 16

Linney v. Cellular Alaska P’ship, 151 F.3d 1234, 1238 (9th Cir. 1998)...................................... 21

O'Connor v. Uber Techs., Inc., 201 F. Supp. 3d 1110, 1122 (N.D. Cal. 2016)............................ 17

Smith v. Triad of Alabama, LLC, 2017 WL 1044692, at *6 (M.D. Ala. Mar. 17, 2017) ............. 21

Spann v. J.C. Penney Corp., 314 F.R.D. 312, 331 (C.D. Cal. 2016)............................................ 24

Staton v. Boeing Co., 327 F.3d 938, 957 (9th Cir. 2003) ............................................................. 16

Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036, 1045 (2016) ................................................ 16

Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011).......................................................... 15

STATUTES

Class Action Fairness Act, 28 U.S.C. § 1715 ............................................................................... 24

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 4 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - iv -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

OTHER AUTHORITIES

2018 Amendment Advisory Committee Notes............................................................................. 18

Manual for Complex Litigation, § 21.632 .................................................................................... 15

RULES

Fed. R. Civ. P. 23................................................................................................................... passim

Fed. R. Civ. P. 23(a) ..................................................................................................................... 15

Fed. R. Civ. P. 23(b)(2)................................................................................................................... 2

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 5 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I. INTRODUCTION

In 2016 and 2017, Yahoo1acknowledged that it had been the target of multiple 

cyberattacks resulting in the exposure of Yahoo users’ information – i.e., the 2013 Breach, 2014 

Breach, and Forged Cookie Breach (collectively, the “Data Breaches”). Names, email addresses, 

telephone numbers, dates of birth, hashed passwords, and, in some cases, security questions and 

answers (hereinafter “Personal Information”) were among the disclosed data. 

After two years of litigation, two rounds of motions to dismiss, the production and review 

of over 9 million pages of documents, seven percipient witness and Rule 30(b)(6) depositions, 

nine named Plaintiff depositions, producing Plaintiffs’ four experts for deposition following 

submission of their reports, filing Plaintiffs’ Motion for Class Certification and Defendants’ 

response, and two day-long mediation sessions, the parties reached a resolution that—if 

accepted—will resolve all pending litigation both here and in the parallel state court proceedings, 

and provide, by far, the largest available cash fund for data breach class members in history. 

Specifically, Yahoo will establish a $50-million non-reversionary settlement fund for the benefit 

of the Class (“Settlement Fund”). In addition to the Settlement Fund, Yahoo will provide at least 

two years of three-credit-bureau credit monitoring and identity theft protection insurance for all 

Settlement Class Members, robust class notice and settlement administration, and service awards 

for the Settlement Class Representatives. Yahoo will also pay up to $35 million in attorneys’ fees 

and $2.5 million in reimbursement of costs and expenses. Hence, the full $50-million Settlement 

Fund will be available to compensate Settlement Class Members for out-of-pocket costs 

stemming from the Breaches, to reimburse Paid Users and Small Business Users up to 25% of 

the amounts they paid for Yahoo’s email services, and to fund alternative compensation for Class 

Members that already have credit monitoring. 

As a result of the litigation, Oath Holdings as successor to Yahoo’s operating business 

 

1 Unless otherwise noted, all capitalized terms are defined in the Settlement Agreement and 

Release, which is being filed concurrently herewith. As noted in the Settlement Agreement, in 

June 2017, Yahoo! Inc. and Verizon Communications Inc. completed an asset sale transaction, 

pursuant to which Yahoo! Inc. became Altaba Inc. (“Altaba”), and Yahoo! Inc.’s previously 

operating business became Oath Holdings Inc. (“Oath Holdings”). Settlement Agreement 

§§ 1.54, 1.55. Accordingly, herein, Yahoo refers to both Oath Holdings and Altaba. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 6 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

also made, and continues to make, significant and substantive changes to its information security 

environment, including encryption of the User Data Base (“UDB”), backup files, enhanced 

intrusion detection tools, increased information security team headcount and budget, and 

implementation of the NIST Framework for Improving Critical Infrastructure Cybersecurity 

(“NIST Cybersecurity Framework”), amongst others. 

Plaintiffs strongly believe the Settlement is a favorable one for the Settlement Class.2 It 

provides quick relief for Settlement Class Members with out-of-pocket damages and enhances 

protection of Settlement Class Members’ Personal Information via credit monitoring and 

Yahoo’s strengthened security program. Credit monitoring in particular will be most effective 

the sooner it is implemented, and, once implemented, help preserve the confidentiality of 

Settlement Class Members’ information in ways that a later monetary judgment could not. 

Accordingly, Plaintiffs respectfully request that the Court preliminarily approve the parties’ 

Settlement Agreement3and enter an order that: 

(1) Certifies the Settlement Class under Fed. R. Civ. P. 23(b)(2) and (b)(3);

(2) Preliminarily approves the Settlement as fair, reasonable, and adequate; 

(3) Directs Notice to be disseminated to the Settlement Class in the form and manner 

proposed by the parties as set forth in the Settlement and Exhibit 5 thereto; 

(4) Appoints Heffler Claims Group (“Heffler”) to serve as the Settlement 

Administrator; 

(5) Appoints Class Counsel; and 

(6) Sets a hearing date and schedule for final approval of the settlement and 

consideration of Class Counsel’s motion for award of fees, costs, expenses, and 

service awards. 

II. BACKGROUND

A. Yahoo’s Services and Representations Concerning Data Security

Yahoo provides comprehensive internet services. Yahoo’s core service is Yahoo Mail, a 

free email service. Since 2011, Yahoo also provided a premium email service (“Paid Mail”), 

costing between $19.99 and $49.99 per year for features such as ad-free mail and priority 

 

2 Declaration of John Yanchunis (“Yanchunis. Dec.”), ¶ 24.

3 Attached as Exhibit 1 to the accompanying Declaration of John Yanchunis and cited hereafter 

as “SA” or “Settlement.”

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 7 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

customer support.4 Yahoo also provides paid business services. Cert. Memo, Ex. 3 at 941. 

Anyone creating a Yahoo account in the United States or Israel agrees to Yahoo’s Terms of 

Service (“Yahoo TOS”). Id., Ex. 4. The Yahoo TOS incorporated a “Privacy Policy,” which 

stated: “We have physical, electronic, and procedural safeguards that comply with federal 

regulations to protect personal information about you.” Id., Ex. 6. On the “Security at Yahoo” 

web page linked to the Privacy Policy, Yahoo represented: “We deploy industry standard 

physical, technical, and procedural safeguards that comply with relevant regulations to protect 

your personal information.” Id., Ex. 7. Similar, uniform representations were made in the Small 

Business Terms of Service (id., Ex. 8), and incorporated Privacy Policy (id., Ex. 9). 

B. The 2013 Breach, 2014 Breach, and Forged Cookie Breach

In September 2016, Yahoo revealed that Personal Information “associated with at least 

500 million user accounts was stolen” from Yahoo’s UDB in late 2014 (the “2014 Breach”). 

Cert. Memo, Ex. 10. A few months later, Yahoo revealed that “an unauthorized third party, in 

August 2013, stole [Personal Information] associated with more than one billion user accounts” 

(the “2013 Breach”). Id., Ex. 14. Ten months later, it was announced that the 2013 Breach 

affected all three billion existing accounts. Id., Ex. 13. Around the same time the 2013 Breach 

was first announced, Yahoo confirmed that “an unauthorized third party accessed the company’s 

proprietary code to learn how to forge cookies,” and that the “cookie forging activity” had 

continued for more than one and a half years, from early 2015 through September 2016 (the 

“Forged Cookie Breach”). See Id., Ex. 14; Ex. 11 at 918.5 Collectively, the Data Breaches 

impacted approximately one billion U.S. and Israeli accounts.

6 Cert. Memo at 2-3, Ex. 11 & 12. 

 

4

See Memorandum of Points and Authorities In Support of Plaintiffs’ Motion for Class 

Certification (“Cert. Memo”) at 1, (ECF No. 248-5 at 9), and its Exhibit 3 at 939-941. To avoid 

further burdening the record, Plaintiffs will cite to the Cert. Memo and its exhibits rather than reattaching those exhibits. 

5

The 2013, 2014, and Forged Cookie breaches are referred to jointly as the “Data Breaches.”

6

The MDL included claims on behalf of users residing in Israel with Yahoo accounts between 

2012 and 2016, and Israeli users specifically agreed in the TOS to be bound by California law, 

and to litigate any disputes relating to their use of Yahoo in the United States. Notwithstanding 

the provisions of the TOS, two parallel class actions alleging claims related to the Data Breaches 

were filed in Israel, and styled Class Action 7406-08-17 Raynzilber v. Yahoo! Inc. and Class 

Action 61020-09-16 Lahav v. Yahoo! Inc., respectively. Persons residing in Israel who used 

Yahoo services between 2012-2016 are eligible for benefits under the Settlement in this action.

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 8 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

C. Coordination and Consolidation in Federal and State Courts

Beginning in September 2016, multiple class action lawsuits were filed against Yahoo 

and other Defendants in federal courts across the country and in California state courts, alleging 

that Defendants failed to properly protect personal information in accordance with their duties, 

had inadequate data security, and delayed notifying potentially impacted individuals of the Data 

Breaches. On December 7, 2016, the Judicial Panel on Multidistrict Litigation transferred several 

federal putative class action lawsuits to this Court (the “MDL Court”) for coordinated pretrial 

proceedings in In re: Yahoo! Inc. Customer Data Breach Security Litigation, Case No. 16-md02752-LHK (N.D. Cal.) (“MDL Case”). ECF No. 1. Meanwhile, multiple parallel actions were 

also coordinated in California state court, which, on February 28, 2017, were assigned by the 

Judicial Council to a coordination trial judge for coordinated pretrial proceedings, in Yahoo! Inc. 

Private Information Disclosure Cases, JCCP No. 4895 (Orange County Superior Court) (the 

“JCCP Case”). Declaration of Daniel S. Robinson (“Robinson Dec.”), Ex. 3. On March 14, 2017, 

the Orange County Superior Court Presiding Judge assigned the Honorable Thierry P. Colaw 

(Ret.) (“JCCP Court”) to be the coordination trial judge. Id., Ex. 4. Leadership was appointed in 

both the MDL Case and JCCP Case.7Throughout discovery, MDL Class Counsel and JCCP

Class Counsel worked cooperatively in the scheduling and taking of offensive depositions. 

D. Litigation History 

Following centralization, MDL Class Counsel filed a Consolidated Class Action 

Complaint (“CAC”) (ECF No. 80), Defendants moved to dismiss the CAC, (ECF No. 94), and 

 

7 On February 9, 2017, this Court appointed John Yanchunis of Morgan & Morgan Complex 

Litigation Group as Lead Counsel, and Ariana Tadler of Milberg Tadler Phillips Grossman LLP, 

Stuart Davidson of Robins Geller Rudman & Dowd LLP, Gayle Blatt of Casey Gerry Schenk 

Francavilla Blatt & Penfield LLP, and Karen Hanson Riebel of Lockridge Grindal Nauen PLLP, 

to the Plaintiffs’ Executive Committee representing Plaintiffs and putative class members in the 

MDL Case (“MDL Class Counsel”). On May 26, 2017, the JCCP Court approved and entered 

JCCP Case Management Order No. 1 appointing Daniel S. Robinson of Robinson Calcagnie, 

Inc. and Brian Chase of Bisnar | Chase LLP as Co-Lead Counsel, Eric A. Grover of Keller 

Grover LLP as Liaison Counsel, and Jeremiah Frei-Pearson of Finkelstein, Blankinship, FreiPearson & Garber LLP, Neil Fineman of Fineman Poliner LLP, Robert Samini of Samini 

Scheinberg PC, Nathan Smith of Brown Neri Smith & Khan LLP, and Brian Kabateck of 

Kabateck Brown Kellner LLP to the Plaintiffs’ Steering Committee, to represent Plaintiffs and 

putative class Members in the JCCP Case (“JCCP Class Counsel”). Robinson Dec., Ex. 5.

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 9 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

this Court granted in part and denied in part the motion by Order dated August 30, 2017 (ECF 

No. 132). On December 19, 2017, MDL Class Counsel filed a First Amended Consolidated 

Class Action Complaint (“FAC”) (ECF No. 179), Defendants moved to dismiss (ECF No. 205), 

and this Court granted in part and denied in part the motion on March 9, 2018 (ECF No. 215).

Moreover, as to the JCCP action, on May 25, 2017, Yahoo moved to stay the JCCP 

proceeding. After briefing and oral argument on the issue, JCCP Class Counsel filed a 

Consolidated Complaint alleging state law causes of action. Robinson Dec., Ex. 6. The JCCP 

Court ultimately denied Yahoo’s motion to stay on June 23, 2017. Id., ¶ 16. On July 27, 2017, 

Yahoo demurred, which, after briefing and oral argument, the JCCP Court sustained in part and 

overruled in part, with claims for violation of California’s Unfair Competition Law, violation of 

California’s Customer Records Act, negligence, breach of contract, and invasion of privacy 

under the California Constitution proceeding. See id., ¶¶ 16-18 Ex. 7.

Throughout this time, discovery was ongoing. Initially, the parties negotiated for Yahoo 

to begin producing certain documents prior to the start of formal discovery. The parties then 

engaged in extensive discussions to reach a series of stipulated discovery orders (including 

Protective Order (ECF No. 73), ESI protocol (ECF No. 74), Rule 502 Order (ECF No. 76), ESI 

Search Protocol (ECF No. 104)), and multiple rounds of negotiations to reach agreement on 

hundreds of search terms.8 Yahoo then produced, and Plaintiffs reviewed, over 9 million pages 

of documents. Plaintiffs deposed critical information security personnel who worked at Yahoo 

during the relevant time periods, including former Chief Information Security Officers (“CISO”) 

Justin Somaini, Alex Stamos, and Bob Lord; former incident response team leader and interim 

CISO Ramses Martinez; former penetration testing team leader Christopher Rohlf; former Chief 

Information Officer (“CIO”) Jay Rossiter; and multiple days of testimony from Yahoo’s 

corporate representative Sean Zadig. Yanchunis Dec., ¶ 9; Robinson Dec. ¶¶ 22-25. Further, at 

the time the Agreement was reached, Plaintiffs had set deposition dates for former Yahoo Chief 

 

8 During this period, JCCP Class Counsel also entered into a Protective Order, ESI Order, and 

ESI search protocol, and engaged in numerous negotiations with Yahoo regarding the search 

terms that would be used in both the JCCP and the MDL action. Robinson Dec., ¶¶ 20-22. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 10 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 6 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Executive Officer Marisa Mayer and former General Counsel Ronald Bell, and were seeking 

dates for Yahoo co-founder and former Board of Directors member David Filo. Plaintiffs also 

propounded interrogatories, to which Defendants responded. Id., ¶ 10. 

Plaintiffs’ efforts provided them with a thorough understanding of Yahoo’s complex IT 

systems, and the alleged deficiencies within them and its information security department, that 

Plaintiffs allege contributed to the Data Breaches and must be remedied. Id., ¶ 15. 

Eight of the nine named MDL Case Plaintiffs had their devices forensically imaged, they 

all responded to document requests and interrogatories, and they were each deposed. Id., ¶¶ 16, 

28. Plaintiffs also produced for deposition four expert witnesses—James Van Dyke, Mary 

Frantz, Ian Ratner, and Gary Parilis, each of whom previously produced reports. Id., ¶ 17. 

On July 13, 2018, MDL Class Counsel filed a motion for class certification (ECF No. 

248), and Defendants filed an opposition and three Daubert motions (ECF Nos. 295, 301–303). 

JCCP Counsel filed a motion for class certification on August 27, 2018. Robinson Dec., ¶ 30. 

E. Plaintiffs’ Claims and Relief Sought 

Plaintiffs sought several types of equitable and monetary relief in this matter, premised 

on claims arising out of two fundamental allegations: Yahoo’s information security was 

inadequate and that it waited too long to inform users of the Data Breaches. Fundamentally, 

Plaintiffs’ asserted that, despite holding Yahoo’s most valuable information, the UDB was 

improperly protected. 

Accordingly, Plaintiffs sought equitable relief aimed at remediating the information 

security deficits they uncovered. In support of their class certification motion, Plaintiffs 

submitted an expert report setting forth several security controls needed to protect the 

information Yahoo stored, including increased funding and staffing for information security, 

adoption and implementation of the NIST Cybersecurity Framework, as well as increased and 

enhanced executive oversight. Cert. Memo, Exh. 93 at 10–14. Had the case not settled, Plaintiffs 

anticipated seeking an injunction requiring Yahoo to implement these measures, amongst others, 

and/or maintain the security reforms it had already undertaken in response to this litigation. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 11 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 7 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Plaintiffs also sought damages under three complex and novel theories: benefit of the 

bargain and restitution, lost value of Personally Identifiable Information (“PII”), and identity 

theft losses. Cert. Memo at 26-31. As to benefit of the bargain, Plaintiffs’ expert, Gary Parilis, 

supported a conjoint analysis to determine the amount Paid Users and Small Business Users 

overpaid for Yahoo’s services because of the concealed security inadequacies. Id. at 27. 

Plaintiffs proposed two methods of identifying lost value of PII. In the first, statistical 

sampling would determine the PII in an average users’ account and its value in order to calculate 

aggregate damages. In the second, a market-based approach—analyzing the value of PII in 

comparable transactions—would be utilized to determine damages resulting from the diminution 

in value of class members’ PII as a result of the Data Breaches. Id. at 27-30. 

Finally, identity theft losses were proposed to be established through a claims process, 

where: (1) temporally, the identity theft followed the Breach(es) in which the PII was taken, and 

(2) the PII taken must have been the same kind needed to commit the identity theft suffered. 

Cert. Memo at 30–31. Identity theft losses would include, among other things, money spent to 

rectify identity fraud, delayed tax refunds, and fees for fraud-prevention and detection services. 

F. Defendants’ Class Certification Opposition and Daubert Challenges 

Defendants opposed Plaintiffs’ class certification motion and filed three Daubert

motions. ECF Nos. 295, 301–303. Defendants challenged Plaintiffs’ ability to prove they were 

harmed by the cyberattacks on Yahoo, and that Yahoo’s actions caused that harm. Defendants 

asserted that Plaintiffs had no class-wide proof of those elements and that proving each would 

require potentially millions of mini-trials. Because the compromised UDB did not contain the 

type of information that would directly lead to the harms alleged, Defendants pointed out that 

Plaintiffs must rely on the information accessible in email content, which would necessarily vary 

from person to person. Defendants additionally challenged the methodologies set forth in 

Plaintiffs’ expert reports, asserting that: Plaintiffs’ Lost Value of PII damages model was 

unreliable because fictitious information was sometimes provided in connection with Yahoo 

accounts and it is impossible to diminish the value of fake information, amongst other reasons; 

and the benefit of the bargain hypothesis failed because Defendants maintained identical security 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 12 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 8 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

measures for paid and free users, therefore Paid and Small Business Users lost no benefit of their 

bargain. Defendants also proffered their own experts relating to damages and the non-existent, 

or extremely brief, period of vulnerability for any named Plaintiffs’ information on the dark web. 

G. Settlement Negotiations 

On August 14 and September 7, 2018, MDL Class Counsel, JCCP Class Counsel, and 

Defendants engaged in arm’s-length, in-person, day-long mediation sessions under the direction 

of the Honorable Daniel Weinstein (Ret.), Jed Melnick, and Simone Lelchuk of JAMS 

(“Mediators”). In addition, between August 15 and September 7, 2018, counsel for Defendants 

and Plaintiffs engaged in multiple arms-length ongoing settlement negotiations. During the 

second formal mediation session, the parties agreed to terms forming the substance of the 

Settlement. Negotiations of attorneys’ fees, costs, and expenses did not begin until agreement on 

behalf of the Settlement Class had been reached. S.A. § 12.1; Yanchunis Dec., ¶ 20. 

III. THE SETTLEMENT TERMS

A. Proposed Settlement Class 

The Settlement Agreement will provide relief for the following class: 

All U.S. and Israel residents and small businesses with Yahoo accounts at any 

time during the period of January 1, 2012 through December 31, 2016, inclusive; 

provided, however, that the following are excluded from the Settlement Class: (i) 

Defendants, (ii) any entity in which Defendants have a controlling interest, (iii) 

Defendants’ officers, directors, legal representatives, successors, subsidiaries, and 

assigns; (iv) any judge, justice, or judicial officer presiding over this matter and 

the members of their immediate families and judicial staff; and (v) any individual 

who timely and validly opts-out from the Settlement Class.

S.A. § 1.43. This proposed class encompasses approximately a billion accounts, and upwards of 

200 million individuals. Cert. Memo, Ex. 12 at 7. Notably, this definition includes users 

specifically impacted by the 2013, 2014, and Forged Cookie Data Breaches and also extends to 

all Yahoo users from 2012 to 2016, to provide robust protection taking into account the analysis 

in the the expert report of Mary Frantz, that beginning in at least 2012, Yahoo suffered from 

multiple intrusions, from multiple bad actors, which may have resulted in loss of user data or 

misuse of user accounts. Cert. Memo, Ex. 93 at 14–15, 36, 38-39, 44-54. 

B. Business Practice Changes 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 13 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 9 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Enhanced and improved data security is a critical aspect of the Settlement. Specifically, 

Yahoo, and later Oath,

9

have made, and continue to make, substantial enhancements, 

expenditures and improvements to its security environment in response to the litigation, 

including significantly increasing information security expenditures; substantially increasing the 

number of information security team members to multiple times the 2016 level; limiting access 

to the UDB and encrypting UDB backup copies; obtaining enhanced intrusion and anomaly 

detection tools; implementing an annual maturity assessment benchmarked against the NIST 

Cybersecurity Framework; buttressing oversight through an external Board of Advisors to the 

Oath CISO through at least 2019 to assist in maintaining best practices; and retaining pertinent 

security related logs for multiple years. S.A. § 2, Ex. 2. Oath has committed to provide an 

attestation of compliance, and to validate the enhanced security measures for three years.

These measures directly relate to the inadequacies in Yahoo’s information security 

environment Plaintiffs alleged to have identified during discovery. For example, Plaintiffs 

explained in their class certification motion that Yahoo’s information security team (the 

“Paranoids”) was significantly understaffed and underfunded, Yahoo lacked intrusion detection 

systems and had inadequate logging, access to the UDB was liberally granted and backup copies 

of the UDB were regularly created without encryption or auditing. Cert. Memo at 11-17. 

The business practice changes initiated as a result of the litigation and as part of the 

Settlement address these shortcomings. Paranoids headcount and funding is increased, intrusion 

detection systems are augmented, logging is enhanced, access to the UDB is reduced and UDB 

back copies are encrypted, while vulnerability management and patching is increased. 

C. Settlement Fund 

In addition to addressing alleged security deficiencies, the Settlement requires Yahoo to 

pay $50 million into a Settlement Fund. S.A. § 3.1. This fund will be used (a) to reimburse 

Settlement Class Members who have out-of-pocket losses, (b) to compensate Paid and Small 

Business Users up to 25% of the amounts they paid for Yahoo’s email services, and (c) to pay 

 

9 As noted above and in the Agreement, Oath now runs what was Yahoo’s operating business. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 14 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 10 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

for those who already have credit monitoring and choose the alternative cash payment rather than 

Credit Monitoring Services. S.A. §§ 3.2, 5.3, 6.4, 6.5, 6.7.10 Plaintiffs believe the $50 million 

fund will be more than ample to accommodate the amounts drawn from it, Yanchunis Dec., ¶ 25, 

but, in the event it is not, all claims drawn from it will be reduced pro rata. S.A. § 6.9. 

1. Out-of-Pocket Costs

One element available from the Settlement Fund is Settlement Class Members’ Out-ofPocket Costs, meaning “costs or expenditures that a Settlement Class Member actually incurred 

that are fairly traceable to one or more of the Data Breaches,” and 

may include, without limitation: unreimbursed fraud losses or charges; 

professional fees incurred in connection with identity theft or falsified tax returns; 

fees or expenses incurred for, or as a result of, credit freezes; credit monitoring 

that was ordered after January 1, 2012 through the date on which the Credit 

Services become available through this Settlement Agreement; [and] 

miscellaneous expenses such as notary, fax, postage, copying, mileage, and longdistance telephone charges . . . . 

S.A. § 1.29. For Small Business Users, Out-of-Pocket Costs may also include “wages or fees 

paid for the performance of tasks fairly traceable to mitigating the impact of one or more of the 

Data Breaches.” S.A. § 1.29. 

Time spent remedying issues related to one or more of the Data Breaches is likewise 

compensable at the rate of “$25.00 per hour or unpaid time off work at the actual hourly rate of 

that Settlement Class Member, whichever is greater,” and can include up to fifteen hours of time 

for Settlement Class Members with documented Out-of-Pocket Costs, and up to five hours at that 

same rate for Settlement Class Members with undocumented costs. S.A. § 1.29. 

Claims for up to $25,000.00 can be submitted via a single claim form, accompanied by an 

attestation regarding the expenditures incurred and basic documentation (i.e. letter from IRS if 

claiming IRS tax fraud expenses). S.A. §§ 6.1, 6.4; S.A. Ex. 6. Proof of causation is limited to 

establishing the costs are “fairly traceable” to the Data Breaches, meaning: 

 

10 The costs of class notice and settlement administration; at least two years of Credit Monitoring 

Services; all attorneys’ fees, costs, and expenses; and Service Awards are all being paid for 

separately by Yahoo, apart from the Settlement Fund. S.A. §§ 4.8, 10.3, 11.2, 12.2. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 15 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 11 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(i) the Misconduct occurred in January 2012 or thereafter; (ii) the 

Settlement Class Member states that he, she, or it believes the Misconduct 

is connected to one or more of the Data Breaches; and (iii) the Misconduct 

involved possible mis-use of the type of Personal Information accessed in 

one or more of the Data Breaches (i.e., names, email addresses, telephone 

numbers, birth dates, passwords, and security questions of Yahoo account 

holders, or from contents of the Class Member’s email account, such as 

financial communications and records containing credit cards, retail 

accounts, banking, account passwords, IRS documents, and social security 

numbers from transactions conducted by email). 

S.A. § 6.3. Preventative measures, “such as obtaining credit monitoring services or credit 

freezes, shall be deemed fairly traceable to one or more of the Data Breaches if they were 

incurred in January 2012 or thereafter and the Settlement Class Member states that they believe 

the costs were incurred as a result of one or more of the Data Breaches.” S.A. § 6.3.

Out-of-Pocket Costs Claims can be submitted for 270 days after the Preliminary 

Approval Order. S.A. § 6.1. The Settlement Administrator will review claims as they are 

submitted, and if a claim is deemed deficient, will notify the Settlement Class Member within 

fifteen days of that determination, and the Class Member then has 30 days to rectify. S.A. § 6.2. 

2. Paid User and Small Business User Costs 

Paid Users are Settlement Class Members that paid for ad-free or premium email services 

during the Class Period. S.A. § 1.31. Small Business Users are Settlement Class Members that 

paid for Small Business services during the Class Period. S.A. § 1.48. Paid and Small Business 

Users can receive up to 25% of the total amounts paid per year by those users between January 1, 

2012 and December 31, 2016. S.A. §§ 6.5, 6.7. Small Business Users are subject to a cap of $500

per year. S.A. § 6.7.11 Paid and Small Business Users need only submit a Claim Form identifying 

the paid account(s) utilized, and the number of years during the Class Period it was used within 

270 days of the Preliminary Approval Order. S.A. §§ 6.6, 6.8, Ex’s 8-9. Paid and Small Business 

Users remain eligible to submit claims for Out-of-Pocket Costs and for Credit Services or 

Alternative Compensation. S.A. §§ 6.5, 6.7. 

3. Alternative Compensation 

 

11 This cap exceeds the amount any Small Business User paid for email services and impacts, if 

any, only those receiving the highest level merchant solutions. Yanchunis Dec., ¶ 48. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 16 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 12 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Settlement Class Members with no need for Credit Monitoring Services because they 

already have similar protections are eligible for Alternative Compensation in the amount of 

$100. S.A. §§ 5.1-5.3. Depending on participation, the amount could rise to as much as $358.80: 

the full, two-year retail value of the Credit Monitoring Services being offered. Yanchunis Dec., 

¶ 26. To obtain Alternative Compensation, Settlement Class Members need only timely confirm 

the timing and type of credit monitoring services they already have, that they wish to receive the 

Alternative Compensation instead of the Credit Services, and that they will keep their current 

services active for at least one year. S.A. §§ 5.1, 5.2, Ex. 7. 

D. Credit Services 

Separate and apart from the Settlement Fund, Yahoo will also separately pay for two 

years of credit monitoring and identity theft protection services from AllClear ID. S.A. § 4.1, 4.7. 

AllClear is an industry leader with more than 10 years of specialized experience in data breach 

response. It has successfully managed some of the largest data breaches in history and has been 

utilized to notify more than two hundred million people in other breaches. AllClear is the same 

vendor and service that this Court recently approved in the Anthem data breach resolution. The 

Credit Services to be provided by AllClear ID will consist of: 

 Credit monitoring of the Settlement Class Members’ credit file for U.S. residents 

at all three (3) major credit reporting agencies (Experian, Equifax & TransUnion) 

(Single bureau monitoring with TransUnion is activated at the time of enrollment. 

Members will have to login to their online customer portal or call the support 

center to accept the filtering policy to activate triple bureau credit monitoring) ) 

during the duration of the Credit Services Period; 

 VantageScore® 3.0 Credit Score and Credit Report from TransUnion® for U.S. 

residents.

 Fraud Alerts for U.S. residents, which Settlement Class Members can set, renew, 

and remove in their online customer portal, for additional protection against 

identity theft;

 ID Theft Insurance for U.S. residents, which covers certain identity theft related 

expenses incurred by Settlement Class Members up to a limit of $1 million.

 Identity Theft Monitoring for U.S. residents to notify Settlement Class Members 

when stolen identity information has been detected and reported through the 

Internet Fraud Alert system (Dark Web monitoring). 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 17 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 13 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

 Identity Restoration Services that provide professional fraud resolution assistance 

to Settlement Class Members who experience identity theft or fraud, helping them 

with identity recovery and restoration.

 Identity theft scan of Settlement Class Members’ minor children identities, up to 

the age of 18 for U.S. residents;

 Assistance with canceling and replacing credit and debit cards if a wallet is lost or 

stolen;

S.A. § 4.1. This fulsome credit monitoring product is especially important here, where Yahoo 

has not previously made credit monitoring available. Settlement Class Members will be 

encouraged to timely sign up for credit monitoring, and educated about the benefits of doing so. 

S.A. § 4.5. Credit Services can be claimed via a straightforward claim form. S.A. § 4.3, Ex. 7. 

The Credit Services to be provided to the Settlement Class have a retail value of 

$14.95/month.12 Given a class size consisting of nearly a billion U.S. and Israeli accounts and 

approximately 200 million individuals, this is an enormous benefit; potentially amounting to 

billions of dollars of savings to Settlement Class Members were they to obtain similar, or even 

inferior, credit monitoring products on their own. Defendants have committed to providing these 

services for the agreed term to all Settlement Class Members claiming them for the agreed term, 

regardless of the number. These services, offered broadly to claimants, are important to the 

Settlement Class in order to protect them from further identity fraud and losses. 

Because AllClear Credit Services are unavailable in Israel, such Israeli Settlement Class 

Members are eligible for Alternative Compensation without a showing of current credit 

monitoring services. S.A. §§ 4.9, 5.4. The underlying U.S. resident, individual owner(s) of Small 

Business Users are also eligible to claim Credit Services or Alternative Compensation. These 

U.S. resident individuals can obtain all Credit Services in their individual capacity. S.A. § 4.10. 

E. Class Notice and Settlement Administration

Notice to the Settlement Class and the costs of administration will also be separately 

funded by Yahoo. S.A. § 10.3. Heffler, a nationally recognized class action settlement 

administrator has been retained here, subject to the Court’s approval. Due to the large size of the 

 

12 Declaration of AllClear ID at ¶ 5, filed concurrently herewith (hereinafter “AllClear Dec.”). 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 18 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 14 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Class—hundreds of millions of accounts—and reflective of the nature of the Settlement Class 

and the Data Breaches, email addresses are available for most of the Class Members, and 

individual notice will be achieved primarily via email. S.A. Ex. 4 ¶ 15. Notice will also be posted 

in People Magazine and National Geographic, as well Israeli publications, and made via an 

innovative and far reaching digital media notice plan, further explained below. Id. ¶¶ 36-53.

F. Service Awards to Named Plaintiffs 

Because the Settlement resolves both the MDL and JCCP Cases, named plaintiffs in both 

cases have been named as Settlement Class Representatives in the Settlement. S.A. § 1.45. These 

consumers have been integral in litigating this matter. All sixteen representatives have been 

personally involved in the cases and support the Settlement. Yanchunis Dec., ¶¶ 28-29; Robinson 

Dec., ¶ 36. Plaintiffs will separately petition the Court to award each Representative up to $7,500 

(for those whose computers were forensically imaged and who were deposed); $5,000 (for those 

whose computer was forensically imaged but were not deposed); and $2,500 (for those whose 

computers were not forensically imaged and who were not deposed); in recognition of the time, 

effort, and expense they incurred pursuing claims that benefited the entire class. This payment 

will also be made separately by Yahoo, and not reduce the Settlement Fund. S.A. §§ 11.1-11.2. 

G. Attorneys’ Fees, Costs, and Expenses

Plaintiffs will also separately seek an award of attorneys’ fees and reimbursement of 

litigation costs and expenses. This payment too will come from Yahoo outside of the Settlement 

Fund. S.A. § 12.2. The request for an award of attorneys’ fees will not exceed $35 million and 

the request for costs and expenses shall not exceed $2.5 million. S.A. § 12.1. The request for 

fees, costs, and expenses will encompass all effort and expenditures incurred by counsel in both 

the MDL and JCCP Cases. S.A. § 12.1. The motion will be supported with detailed lodestar 

information and an accounting of expenses. Yanchunis Dec., ¶ 41. 

H. Reduction or Residual 

If the Settlement Fund is insufficient to cover all Out-of-Pocket Costs, Paid User Costs, 

Small Business User Costs, and Alterative Compensation payments, all such claims will be 

reduced on a pro rata basis. S.A. § 6.9. Conversely, should there be a residue, surplus funds will 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 19 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 15 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

first be used to increase the Alternative Compensation payments up to the $358.80 individual 

claim cap, (S.A. § 7.1(a))—the full retail value of two years of the Credit Services. AllClear 

Dec., ¶ 5. Next, residual funds will be used to purchase up to five years of additional Credit 

Monitoring Services. S.A. § 7.1(b). If additional funds remain following those two steps, then the 

parties will motion the Court for direction regarding any remainder. S.A. § 7.1(c). 

I. Release 

In exchange for the benefits provided under the Settlement Agreement, Settlement Class 

Members will release any and all claims against Defendants related to or arising from any of the 

facts alleged in the complaints filed in this litigation. S.A. §§ 1.39, 13.1-13.4.13

IV. ARGUMENT

A. The Settlement Class Should Be Preliminarily Certified 

Before assessing the parties’ settlement, the Court should first confirm that the 

underlying settlement class meets the requirements of Rule 23. See Amchem Prods. v. Windsor, 

521 U.S. 591,620 (1997); Manual for Complex Litigation, § 21.632. The requirements are well 

known: numerosity, commonality, typicality, and adequacy—each of which is met here. Fed. R. 

Civ. P. 23(a); Ellis v. Costco Wholesale Corp., 657 F.3d 970, 979-80 (9th Cir. 2011). 

1. The Rule 23(a) Requirements Are Met

The Settlement Class includes nearly a billion accounts, representing some approximately 

200 million individuals, and so readily satisfies the numerosity requirement. See Fed. R. Civ. P. 

23(a)(1). The commonality requirement, which requires that class members’ claims “depend 

upon a common contention,” of such a nature that “determination of its truth or falsity will 

resolve an issue that is central to the validity of each [claim] in one stroke,” is also met. WalMart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). Here, Plaintiffs’ claims turn on whether 

Yahoo’s security environment was adequate to protect Settlement Class members’ Personal 

Information. Cert. Memo at 22-23. The resolution of that inquiry revolves around evidence that 

does not vary from class member to class member, and so can be fairly resolved—whether 

 

13 In MDL proceedings, it is proper to release claims based on facts alleged in the underlying 

MDL complaints. See, e.g., In re: Volkswagen “Clean Diesel”, Case No. 3:15-md-02672-CRB, 

PACER Dkt. No. 3230 at 5-6 (N.D. Cal. May 17, 2017).

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 20 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 16 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

through litigation or settlement—for all class members at once. 

Likewise, typicality and adequacy are satisfied. Each proposed Settlement Class 

Representative alleges he or she was a Yahoo user, with Personal Information stored on the 

UDB, that was exfiltrated during the Data Breaches, and thus they were impacted by the same 

inadequate data security that Plaintiffs allege harmed the rest of the Class. Cert. Memo at 23–25; 

Just Film, Inc. v. Buono, 847 F.3d 1108, 1118 (9th Cir. 2017) (“[I]t is sufficient for typicality if 

the plaintiff endured a course of conduct directed against the class.”). The Settlement Class 

Representatives also have no conflicts with the Settlement class; have participated actively in the 

case, including by sitting for depositions and allowing their devices to be examined; and are 

represented by experienced attorneys who were previously appointed by this Court—or the JCCP 

Court—to represent class members’ interests. See Cert. Memo at 26; Staton v. Boeing Co., 327 

F.3d 938, 957 (9th Cir. 2003) (adequacy satisfied if plaintiffs and their counsel lack conflicts of 

interest and are willing to prosecute the action vigorously on behalf of the class); Yanchunis

Dec., ¶¶ 16, 28, 30, 38-39; Robinson Dec., ¶¶ 2-5, 32. 

2. The Requirements of Rule 23(b) Are Met 

“In addition to meeting the conditions imposed by Rule 23(a), the parties seeking class

certification must also show that the action is maintainable under Fed. R. Civ. P. 23(b)(1), (2) or 

(3).” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1022 (9th Cir. 1998). Here, the Settlement Class 

is maintainable under Rule 23(b)(3), as common questions predominate over any questions 

affecting only individual members and class resolution is superior to other available methods for 

a fair and efficient resolution of the controversy. Id. Plaintiffs’ claims depend, first and 

foremost, on whether Yahoo used reasonable data security to protect their Personal Information. 

Cert. Memo at 22, 31-33. That question can be resolved using the same evidence for all 

Settlement Class Members, and thus is the precise type of predominant question that makes a 

class-wide adjudication worthwhile. See Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036, 1045 

(2016) (“When ‘one or more of the central issues in the action are common to the class and can 

be said to predominate, the action may be considered proper under Rule 23(b)(3) ...’”). 

Importantly, predominance analysis in the settlement context need not consider 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 21 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 17 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

manageability issues because “the proposal is that there be no trial,” and hence manageability 

considerations are no hurdle to certification for purposes of settlement. Amchem, 521 U.S. at 

620. There is only the predominant issue of whether Yahoo failed to properly secure the Personal 

Information taken from it in the Data Breaches and failed to provide timely notice, such that its 

users should now be provided a remedy. Resolution of that issue through individual actions is 

impracticable: the amount in dispute for individual class members is too small, the technical 

issues involved are too complex, and the required expert testimony and document review too 

costly. See Just Film, 847 F.3d 1108 at 1123. Rather, the class device is the superior method of 

adjudicating consumer claims arising from these Data Breaches—just as in other data breach 

cases where class-wide settlements have been approved. See, e.g., In re Anthem, Inc. Data 

Breach Litig., 15-MD-02617-LHK, 2018 WL 3872788, at *11 (N.D. Cal. Aug. 15, 2018); In re 

Linkedin User Privacy Litig., 309 F.R.D. 573, 585 (N.D. Cal. 2015). 

B. The Settlement Should be Preliminarily Approved 

There is “relatively scant appellate authority regarding the standard that a district court 

must apply in reviewing a settlement at the preliminary approval stage.” In re High-Tech 

Employee Antitrust Litig., 2014 WL 3917126, at *3 (N.D. Cal. Aug. 8, 2014). In the past, courts 

have focused only on whether the proposed agreement appears to be non-collusive, is free of 

“obvious deficiencies,” and generally falls within the range of “possible” approval. See, e.g., In 

re Tableware Antitrust Litig., 484 F. Supp. 2d 1078, 1079-80 (N.D. Cal. 2007). Recently, 

however, several courts have criticized the notion that review at the preliminary approval stage 

need only involve a “quick look,” or a watered-down version of final approval. See, e.g.,

O'Connor v. Uber Techs., Inc., 201 F. Supp. 3d 1110, 1122 (N.D. Cal. 2016). 

Proposed revisions to Rule 23—effective on December 1, 2018—further confirm the 

need for a more detailed analysis. Proposed Amended Rule 23(e)(1) states: 

(e) Settlement, Voluntary Dismissal, or Compromise. The claims, 

issues, or defenses of a certified class--or a class proposed to be certified for 

purposes of settlement--may be settled, voluntarily dismissed, or compromised 

only with the court's approval. The following procedures apply to a proposed 

settlement, voluntary dismissal, or compromise:

(1) Notice to the Class.

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 22 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 18 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(A) Information That Parties Must Provide to the Court. The parties 

must provide the court with information sufficient to enable it to 

determine whether to give notice of the proposal to the class.

(B) Grounds for a Decision to Give Notice. The court must direct 

notice in a reasonable manner to all class members who would be 

bound by the proposal if giving notice is justified by the parties' 

showing that the court will likely be able to:

(i) approve the proposal under Rule 23(e)(2); and

(ii) certify the class for purposes of judgment on the proposal.

(2) Approval of the Proposal. If the proposal would bind class members, 

the court may approve it only after a hearing and only on finding that it is fair, 

reasonable, and adequate after considering whether:

(A) the class representatives and class counsel have adequately 

represented the class;

(B) the proposal was negotiated at arm's length;

(C) the relief provided for the class is adequate, taking into account:

(i) the costs, risks, and delay of trial and appeal;

(ii) the effectiveness of any proposed method of distributing 

relief to the class, including the method of processing classmember claims;

(iii) the terms of any proposed award of attorney's fees, 

including timing of payment; and

(iv) any agreement required to be identified under Rule 

23(e)(3); and

(D) the proposal treats class members equitably relative to each other.

Fed. R. Civ. P. 23 (proposed amended Rule 23(e)). Thus, under the proposed rule, notice should 

be given to the class, and hence, preliminary approval should only be granted, where the Court 

“will likely be able to” finally approve the settlement under Proposed Rule 23(e)(2) and certify 

the class for settlement purposes. Id.; see also id. 2018 Amendment Advisory Committee Notes. 

Thus, the proposed rule reflects the factors already used in this Circuit for final 

approval: (1) the strength of the plaintiff’s case; (2) the risk, expense, complexity, and likely 

duration of further litigation; (3) the risk of maintaining class action status throughout the trial; 

(4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the 

proceedings; (6) the experience and views of counsel; (7) the presence of a governmental 

participant; (8) the reaction of the class members to the proposed settlement; and (9) whether the 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 23 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 19 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

settlement is a product of collusion among the parties. In re Bluetooth Headset Products Liab. 

Litig., 654 F.3d 935, 946 (9th Cir. 2011). 

Accordingly, Plaintiffs will undertake here an analysis akin to that required at final 

approval and by the proposed rule, save for recognizing that at least one of those factors—the 

reaction of class members—is not yet known. Each weighs in favor of approval. 

1. The Strength of Plaintiffs’ Case 

While Plaintiffs have built a very strong liability case, the viability of the their causation 

and damages models on a class-wide basis remains subject to vigorous challenge from 

Defendants, subject to Daubert challenges, and is untested on a class-wide basis beyond the 

pleading stages and certainly at trial. 

As to liability, Plaintiffs class certification motion detailed the numerous shortcomings in 

Yahoo’s information security environment, despite its contrary representations. Plaintiffs allege 

Yahoo was well aware that its Paranoids team was understaffed, underfunded, and lacked the 

industry standard tools necessary to protect the valuable information Yahoo held. Cert. Memo at 

11–20. Plaintiffs also established that certain senior executives had contemporaneous knowledge 

of the 2014 Breach, yet failed to provide notice to users until years later. Id. at 18–20. Finally, 

Plaintiffs provided three potential damages models, supported by three well-regarded experts, to 

establish the predominance and manageability of class treatment. Id. at 35–39.

Yet, Defendants raise substantial questions of causation and damages—both as to the 

named plaintiffs individually and as to any ability to prove causation or damages class-wide. 

ECF No. 295 at 7–8, 13–15, 17–18. Defendants lodged multiple challenges to Plaintiffs’ class 

certification motion including attacking Plaintiffs’ Lost Value of PII damages model on the basis 

that fake information is not uncommonly provided in connection with Yahoo accounts and 

“Yahoo cannot be held responsible for a diminution in value if the PII was fake to begin with.” 

Id. at 19. As to benefit of the bargain, Defendants argued that enhanced security was not part of 

any agreement because it “maintained identical security measures for paid users and free users,” 

and hence Paid and Small Business Users lost no benefit of their bargain. Id. at 35. Proving 

actual injury or loss would be difficult on an individual, much less class basis, and recovery (if 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 24 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 20 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

any) for identity theft losses, Defendants urged, would require unavoidable, and unmanageable, 

individual inquiries or mini-trials. Id. at 27–32. 

The range of potential outcomes was thus vast. For instance, Plaintiffs’ expert Ian Ratner 

noted that email log-in information is sold on the Dark Web for approximately $1 per account, 

providing a Lost Value of PII measure. ECF No. 254-9 at 15. But other potentially applicable 

values of account information were much higher: the Ponemon Institute valued it at $8 per 

account; survey respondents valued their passwords at $75.90; hackers charge up to $129 to 

access a single individual account; and similar prior data breach settlements indicate a range of 

$1.02 to $1.46 per user; amongst other approaches. Id. at 15-19. Given the near billion accounts 

at issue here, even a $1 per account valuation could meet resistance from a jury; but these 

estimates do so without accounting for the spectrum of veracity associated with the Personal 

Information at issue. While the legal theory behind the larger numbers may be sound, it is 

untested, and, as a practical matter, Plaintiffs’ counsel recognize that taking such large numbers 

to a jury presents substantial strategic risks. Yanchunis Dec., ¶ 37. 

The Identity Theft/Out-of-Pocket Damages theory, while more tangible, applies to only a 

subset of the Settlement Class, and would require them to come forward individually and 

document their losses—whether through a claims process or otherwise—with respect to a breach 

that happened years before trial. Cert. Memo at 38. Defendants contended that Plaintiffs would 

not be able to prove out-of-pocket damages causally related to the Data Breaches, and not some 

other source. The Settlement recompenses those costs without needing to overcome Defendants’ 

substantial arguments regarding causation. 

2. The Risk, Expense, Complexity, and Duration of Further Litigation

While Plaintiffs believe their case is a strong one, all cases, including this one, are subject 

to substantial risk. This case involves hundreds of millions of individuals, and a complicated and 

technical factual overlay lodged against well-funded and motivated Defendants. The damages 

methodologies, theoretically sound in Plaintiffs’ view, remain untested in a disputed class 

certification setting and unproven in front of a jury. And—as in any data breach, but especially 

one of this scope and age—establishing causation and damages on a class-wide basis is an 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 25 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 21 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

unexplored legal frontier rife with uncertainty. 

Although nearly all class actions involve a high level of risk, expense, and complexity—

undergirding the strong judicial policy favoring amicable resolutions, Linney v. Cellular Alaska 

P’ship, 151 F.3d 1234, 1238 (9th Cir. 1998)—this is an especially complex class in an especially 

risky arcana. Historically, data breach cases faced substantial hurdles in surviving even past the 

pleading stage. See, e.g., Hammond v. The Bank of N.Y. Mellon Corp., 2010 WL 2643307, at *1 

(S.D.N.Y. June 25, 2010) (collecting cases). Even cases of similar wide-spread notoriety and 

implicating data far more sensitive than at issue here have been found wanting. In re U.S. Office 

of Pers. Mgmt. Data Sec. Breach Litig., 266 F. Supp. 3d 1, 19 (D.D.C. 2017) (“The Court is not 

persuaded that the factual allegations in the complaints are sufficient to establish . . . standing.”). 

To the extent the law has gradually accepted this relatively new type of litigation, the 

path to a class-wide monetary judgment remains unforged; particularly in the area of damages. 

For now, data breach cases are among the most risky and uncertain of all class action litigation, 

making settlement the more prudent course when a reasonable deal is available.

By settling now, practical remedies that have been sorely absent become imminently 

available. While the Data Breaches occurred some time ago, credit monitoring services have 

never been offered; while Yahoo had contemporaneous knowledge of the 2014 Breach, data 

security remained inadequate. The Settlement fills both those voids: providing credit monitoring 

services to all Settlement Class Members who desire it and enhancing Yahoo’s data security 

practices. Even if Plaintiffs achieved a successful judgment, injunctive practice changes would 

likely be years away following appeals, and credit monitoring would not have been provided. 

Here then, delay only further injuries the class and increases each members’ risk of harm. 

3. The Risk of Maintaining Class Action Status Through Trial 

While Plaintiffs have moved for class certification and Defendants have responded, none 

of Plaintiffs’ claims had yet been certified. Hundreds of exhibits were submitted along with this 

briefing. Certification of consumer data breach cases is rare—first occurring in Smith v. Triad of 

Alabama, LLC, 2017 WL 1044692, at *6 (M.D. Ala. Mar. 17, 2017)—and unprecedented in a 

case of this size. While certification of additional consumer data breach classes should follow, 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 26 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 22 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

the dearth of direct precedent adds to the risks posed by continued litigation. 

4. The Amount Offered in Settlement 

The $50 million Settlement Fund, coupled with the separate payment for at least two 

years of credit monitoring, service awards, class notice and administration, and attorneys’ fees, 

costs, and expenses is a remarkable outcome. The cash fund available for Settlement Class 

Member claims far out paces such funds in similar cases, as does the individual claim cap.14 

The quality of the credit monitoring product is directly on par with that offered in similar 

data breach settlements, many of which had information that is designated more sensitive under 

the law, and the business practice changes safeguard Settlement Class Members’ information by 

filling the voids identified during discovery in Yahoo’s information security apparatus. 

5. The Extent of Discovery Completed and the Stage of Proceedings 

This agreement was not reached until over two years after the first of the Data Breaches 

was announced. In the interim, significant steps in this litigation were taken. Two motions to 

dismiss were briefed and ruled upon in the MDL Case; one demurrer was briefed and ruled upon 

in the JCCP Case; Plaintiffs reviewed over 9 million pages of documents; they took seven 

depositions, including all three of Yahoo’s relevant CISOs, the head of the Incident Response 

Team at the time of the 2014 Breach, and the CIO; all named plaintiffs from the MDL Case were 

deposed; Plaintiffs produced four expert reports, and all four experts were deposed; Plaintiffs 

filed their motions for class certification and Defendants responded thereto and filed multiple 

Daubert motions. Yanchunis Dec., ¶¶ 8-10, 16-17, 28; Robinson Dec., ¶¶ 24-29, 32. 

Accordingly, Plaintiffs are well informed about their case, its assets and pitfalls, and have had 

the benefit of their experts’ opinions in understanding the business practice changes needed here. 

 

14 See, e.g., In re Anthem, Inc. Data Breach Litig., 15-MD-02617-LHK, 2018 WL 3872788, at 

*6, *18 (N.D. Cal. Aug. 15, 2018) (noting a $15 million fund for out-of-pocket costs with 

$10,000 individual cap, and $13 million allocation for alternative cash payments); In re the 

Home Depot, Inc., Customer Data Sec. Breach Litig., No. 1:14-MD-02583-TWT, 2016 WL 

6902351, at *6 (N.D. Ga. Aug. 23, 2016) ($13 million fund for consumer claims with $10,000 

individual cap); In re Target Corp. Customer Data Sec. Breach Litig., No. MDL 14-2522-PAM, 

2017 WL 2178306, at *2 (D. Minn. May 17, 2017) ($10 million settlement fund with $10,000 

individual cap).

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 27 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 23 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

6. The Experience and View of Counsel 

MDL Class Counsel was appointed over a year-and-a-half ago. ECF No. 58. This group 

has substantial experience litigating complex class cases of various natures, and extensive 

exposure to the highest profile data breach cases in the country. Yanchunis Dec., ¶ 38. Mr. 

Robinson was appointed by the JCCP Court and has similar credentials. Robinson Dec., ¶¶ 2-5. 

Having worked on behalf of the putative class since the Data Breaches were first announced, and 

having dedicated thousands of hours to the case, proposed Settlement Class Counsel endorse the 

Settlement without reservation. Yanchunis Dec., ¶¶ 24, 42; Robinson Dec., ¶¶ 5, 34-35. 

7. The Presence of a Government Participant 

Plaintiffs here pursued their claims independently. Should preliminary approval be 

granted, the United States Attorney General and Attorneys General of each of the States will be 

notified pursuant to the Class Action Fairness Act, 28 U.S.C. § 1715, and given an opportunity to 

raise any objections or concerns they may have. 

8. The Reaction of the Class Members to the Proposed Settlement 

Because notice has not yet been given, this factor is not yet implicated. However, 

Settlement Class Representatives all strongly support the Settlement. Yanchunis Dec., ¶ 29. 

9. Lack of Collusion Among the Parties 

Here, the parties negotiated a substantial Settlement Fund, making available $50 million 

to the Class along with a minimum of two years of robust credit monitoring services. The parties 

did not commence discussion of fees until agreement on all substantive portions of the class 

resolution had been reached, and both the class portion of the resolution and the fees were 

negotiated at arms-length under the direction of the Honorable Daniel Weinstein (Ret.), Jed 

Melnick, and Simone Lelchuk of JAMS. See G. F. v. Contra Costa Cty., 2015 WL 4606078, at 

*13 (N.D. Cal. July 30, 2015) (“[T]he assistance of an experienced mediator in the settlement 

process confirms that the settlement is non-collusive.” (internal quotation marks omitted)).

C. The Proposed Notice Plan Should Be Approved 

Rule 23 requires that prior to final approval, the “court must direct notice in a reasonable 

manner to all class members who would be bound by the proposal.” Fed. R. Civ. P. 23(e)(1). For 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 28 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 24 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

classes certified under Rule 23(b)(3), “the court must direct to class members the best notice that 

is practicable under the circumstances, including individual notice to all members who can be 

identified through reasonable effort.” Fed. R. Civ. P. 23(c)(2)(B). Under proposed amended Rule 

23(c)(2)(B), “[t]he notice may be by one or more of the following: United States mail, electronic 

means, or other appropriate means.” Fed. R. Civ. P. 23(c)(2)(B) (effective Dec. 1, 2018). 

Here, because email addresses are available for the vast majority of Class Members, the 

chief vector of direct, individual notice will be via email. S.A. Ex. 4 ¶ 15. Even prior to the 

above noted proposed change in Rule 23 expressly electronic notice, email notice in similar 

circumstances has been found appropriate. See, e.g., Spann v. J.C. Penney Corp., 314 F.R.D. 

312, 331 (C.D. Cal. 2016). Substitute notice will also be provided by publication People

magazine and National Geographic, with a combined circulation of 6,361,756, and online via 

display adds, and through social media, resulting in a reach rate of 80%. S.A. Ex. 4 ¶¶ 4, 36-56.

Copies of all the notice documents are attached to this preliminary approval motion; they are 

clear and concise, and directly apprise Settlement Class Members of all the information they 

need to know to make a claim. Fed. R. Civ. P. 23(c)(2)(B).

Moreover, on the dedicated Settlement website, Class Members are able to review the 

detailed Long Form Notice, which provides clear and concise information with respect to all the 

relevant aspects of the litigation in English, Spanish and Hebrew. Thus, the Notice provides all 

the information necessary for Settlement Class Members to make informed decisions with 

respect to whether they remain in or opt out of the Settlement Class, or object to the proposed 

Settlement. Yanchunis Dec., ¶¶ 45. The Notice Plan has been developed by a provider with 

significant experience in designing notice plans in large and national class actions similar to this 

one. Yanchunis Dec., ¶ 46-47. Accordingly, the content and method of dissemination of the 

proposed Notice fully comports with the requirements of due process and applicable case law. 

D. Appointment of the Settlement Administrator 

In connection with implementation of the notice plan and administration of the settlement 

benefits, the parties seek the Court to appoint Heffler to serve as the Settlement Administrator. 

Heffler has vast experience in many complex class action lawsuits. The cost of administration is 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 29 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 25 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

being paid by Yahoo outside of the Settlement Fund, and hence will not reduce the amounts 

available for Class Members. 

E. Appointment of Settlement Class Counsel 

Under Rule 23, “a court that certifies a class must appoint class counsel . . . [who] must 

fairly and adequately represent the interests of the class.” Fed. R. Civ. P. 23(g)(1)(B). In making 

this determination, courts generally consider the following: (1) the proposed class counsel's work 

in identifying or investigating potential claims, (2) the proposed class counsel’s experience in 

handling class actions or other complex litigation, and the types of claims asserted in the case, 

(3) the proposed class counsel's knowledge of the applicable law, and (4) the proposed class 

counsel’s resources committed to representing the class. Fed. R. Civ. P. 23(g)(1)(A)(i-iv).

Here, proposed Settlement Class Counsel have extensive experience prosecuting class 

action cases, and specifically data breach cases, and were previously appointment by this Court, 

or by the JCCP Court. See Yanchunis Dec., ¶ 38-39; Robinson Dec., ¶¶ 2-5 & Ex 1. Mr. 

Robinson was appointed as co-lead counsel in the JCCP Case and his inclusion here as Class 

Counsel acknowledges the coordination of the MDL and JCCP Cases throughout discovery, and 

the joint resolution of the matters here through the settlement of the claims in both consolidated 

actions in this case. Accordingly, the Court should appoint John Yanchunis, Gayle Blatt, Stuart 

Davidson, Karen Hanson Riebel, Ariana Tadler, and Daniel S. Robinson as Class Counsel. 

F. Schedule for Final Approval 

Once the Court has ruled on the motion for preliminary approval, the timeline for 

providing notice, opting out of the Settlement Class, and submitting claims will begin to run. 

Plaintiffs provided an agreed-up schedule in their Motion for Preliminary Approval.

V. CONCLUSION 

In light of the significant benefits provided by the Settlement, Plaintiffs respectfully 

request that the Court grant Plaintiffs’ Motion for Preliminary Approval. 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 30 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 26 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

DATED: October 22, 2018 Respectfully submitted,

MORGAN & MORGAN

COMPLEX LITIGATION GROUP

John A. Yanchunis

s/ 

John A. Yanchunis

201 N. Franklin Street, 7th Floor

Tampa, FL 33602

Telephone: 813/223-5505

813/223-5402 (fax)

ROBBINS GELLER RUDMAN

& DOWD LLP

Stuart A. Davidson (Admitted Pro Hac Vice)

120 East Palmetto Park Road, Suite 500

Boca Raton, FL 33432

Telephone: 561/750-3000

561/750-3364 (fax)

sdavidson@rgrdlaw.com

CASEY GERRY SCHENK FRANCAVILLA

BLATT & PENFIELD LLP

Gayle M. Blatt

110 Laurel Street

San Diego, CA 92101

Telephone: 619/238-1811

619/544-9232 (fax)

MILBERG TADLER PHILLIPS 

GROSSMAN LLP

Ariana J. Tadler

One Pennsylvania Plaza, 19th Floor

New York, NY 10119

Telephone: 212/594-5300

212/868-1229 (fax)

LOCKRIDGE GRINDAL NAUEN P.L.L.P.

Karen Hanson Riebel

100 Washington Ave. South, Suite 2200

Minneapolis, MN 55401

Telephone: 612/339-6900

612/339-0981 (fax)

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 31 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 27 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ROBINSON CALCAGNIE, INC.

Daniel S. Robinson (244245)

19 Corporate Plaza Dr.

Newport Beach, CA 92660

Telephone: 949/720-1288 

949/720-1292

drobinson@robinsonfirm.com

Attorneys for Plaintiffs and Proposed Class 

Counsel

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 32 of 33
MEMO ISO PLTFS’ MOTION FOR PRELIMINARY APPROVAL - 16-md-02752-LHK - 28 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CERTIFICATE OF SERVICE

I hereby certify that October 22, 2018, I authorized the electronic filing of the foregoing 

with the Clerk of the Court using the CM/ECF system which will send notification of such filing 

to the e-mail addresses denoted on the attached Electronic Mail Notice List.

I certify under penalty of perjury under the laws of the United States of America that the 

foregoing is true and correct. Executed October 22, 2018. 

/s/ John A. Yanchunis___

John A. Yanchunis

MORGAN & MORGAN COMPLEX 

LITIGATION GROUP

201 N. Franklin Street, 

7th Floor Tampa, FL 33602 

Telephone: 813/223-5505

813/223-5402 (fax)

 

Case 5:16-md-02752-LHK Document 330-1 Filed 10/22/18 Page 33 of 33