Wright et al. v. Crossroads Trading Co., Inc.

The most important factor is the strength of the plaintiffs’ case on the merits, balanced against the amount offered in settlement. (See Kullar v. Foot Locker Retail, Inc. (2008) 168 Cal.App.4th 116, 130.)

II.

Discussion

A. Provisions of the Settlement

This case has been settled on behalf of the following class: All individuals residing in the United States whose Private Information may have been compromised or otherwise impacted in the Data Security Incident, including all those who received notice of the breach. (Declaration of John J. Nelson (“Nelson Decl.”), Ex. 2 (“Agreement”), ¶ 1.47.)

Defendant estimates the Settlement Class as defined includes approximately 60,041 individuals. (Ibid.)

Defendant will pay a non-reversionary common fund amount of $600,000. (See Memorandum, pp. 4:8 – 6:20.)

The common fund amount includes attorney fees and costs of up to one-third of the common fund ($200,000) and a service payment of up to $2,500 for each Representative Plaintiff.

Settlement Class Members will be entitled to make a claim for up to $5,000 in losses incurred, as supported by reasonable documentation, or they may alternatively make a claim for an Alternative Class Payment distributed on a pro rata basis.

The Agreement’s allocation plan is designed to exhaust the Settlement Fund such that monies remaining more than 120 days after the distribution of payments will be distributed evenly to Class Members who cased their initial payments, “whereupon the amount remaining in the Net Settlement Fund, if any, shall be distributed to the Boys & Girls Clubs of Oakland, California.” (Agreement, ¶ 3.11.)

The Agreement provides that Kroll Settlement Administration, LLC (“Kroll”) will serve as the neutral entity that will administer the settlement.

The Court approves of the cy pres designation and appoints Kroll as settlement administrator.

In exchange for the settlement, the class members agree to release Defendant and related entities and persons from “claims or causes of action of every kind and description, which accrued during the Release Period [February 15, 2025, until the entry of a Preliminary Approval Order], including any causes of action in law, claims in equity, complaints, suits or petitions, and any allegations of wrongdoing, demands for legal, equitable or administrative relief (including, but not limited to, any claims for injunction, rescission, reformation, restitution, disgorgement, constructive trust, declaratory relief, compensatory damages, consequential damages, penalties, exemplary damages, punitive damages, attorneys’ fees, costs, interest or expenses)—whether known or unknown—arising from or related to the Data Security Incident in any way, that have or could have been asserted in the State Court Lawsuit or Consolidated Federal Lawsuit.” (Agreement, ¶¶ 1.39; 1.41; 1.42; 4.1.)

The release provisions are appropriately tailored to the factual allegations of the operative pleading. (See Amaro v. Anaheim Arena Management, LLC (2021) 69 Cal.App.5th 521, 538.)

B. Fairness of the Settlement

Plaintiffs contend that the Agreement meets the standards for preliminary approval. (Memorandum, pp. 10:3–16:3; Nelson Decl., ¶ 26.)

Plaintiff asserts that the proposed settlement compares favorably to other data breach settlements. (Memorandum, pp. 11:7–17.)

Plaintiff’s counsel explains that the parties exchanged informal discovery and engaged in armslength negotiations before finalizing the Agreement. (Nelson Decl., ¶¶ 9–11.)

Plaintiff’s counsel contends the Agreement’s claims process is necessary to allow California residents to self-identify in order demonstrate eligibility for the California Statutory Cash Payment and to allow Class Members with documented losses to submit claims for reimbursement of up to $5,000 in losses attributable to the data security incident that prompted this litigation. (Id. at ¶¶ 15–16.)

Counsel asserts they have negotiated a statutory claim benefit of $100 per claimant which is within the CCPA’s statutory damages range of $100 to $750 per individual. (Nelson Decl., ¶ 17; Civ. Code § 1798.150, subd. (a)(1)(A).)

Counsel further explains that the negligence and breach of contract claims are difficult to value because there have to date been no such data breach cases tried to verdict, and that under a market theory, Plaintiffs may have been able to recover up to $25 per person. (Nelson Decl., ¶ 18.)

Counsel asserts that the UCL claim mainly adds injunctive relief only because restitution would be difficult to prove. (Id. at ¶ 19.)

Plaintiffs point to two data breach settlements in which the recoveries equated to $0.10 per member (In re Target Corp. Customer Data Sec. Breach Litig. (D. Minn. May 17, 2017) 2017 U.D. Dist. LEXIS 75455, at *5, aff’d, 892 F.3d 968, 979 (8th Cir. 2018)) and $0.61 per member (In re Yahoo! Inc. Customer Data Sec. Breach Litig. (N.D. Cal. July 22, 2020) Case. NO. 16-MD-02753-LHK, 2020 U.S. Dist. LEXIS 129939, at *47). (Memorandum, p. 11:7-17.)

Based on the Court’s research, recovery in data breach cases can sometimes be higher. (See Berry v. Refresco Bevs. U.S. Inc. (M.D. Fl. April 13, 2026) 2026 U.S. Dist. LEXIS 80342, at *38 (approving settlement with value-per-claim of $30.65); see also Lopez v. NLP, LLC (C.D. Cal. December 4, 2025) 2025 U.S. Dist. LEXIS 270892, at *33-35 (approving settlement with average value per class member of $96.67).

In this case, Plaintiffs’ counsel has sufficiently explained the rationale supporting the settlement amount, including the fact that damages models for class-wide data breach cases remain untested and that few data breach cases have been certified outside the settlement context.

The settlement eliminates the risk of litigation and provides immediate and certain relief.

The recovery amount and structure are reasonable giving the litigation risks and the range of potential damages.

The Court also finds that the consolidated federal action does not bar approval of the proposed settlement because the parties have stipulated to dismiss the federal action without prejudice and plaintiffs filed a notice of dismissal in that action. (Bechuk v. Home Depot USA, Inc., (5th Cir. 2015) 814 F.3d 287 [“notice of dismissal is selfeffectuating and terminates the case in and of itself”]; FRCP 41(a)(1)(A)(ii) [plaintiff may voluntarily dismiss an action without leave of the court by stipulation of all parties].)

The Court has reviewed Plaintiff’s written submissions and is satisfied that the settlement is fair and may be approved.

C. Service Award, Fees and Costs

Plaintiffs will seek service awards of up to $2,500 each. (Memorandum, p. 6:11–20.)

Plaintiffs have submitted declarations describing their participation in this litigation. (Nelson Decl., ¶ 24 and Ex. 4–9.)

The Court is inclined to find that the requested service awards are justified and reasonable, and it will issue its final determination regarding the approved amount in connection with final approval of the settlement.

Class counsel will seek attorney fees of up to one-third of the gross settlement amount ($200,000).

Prior to the final approval hearing, class counsel shall submit lodestar information (including hourly rate and hours worked) as well as evidence of actual litigation costs incurred and settlement administration costs.

D. Conditional Certification of Class

Plaintiff requests the class be conditionally certified for purposes of the settlement.

California Code of Civil Procedure section 382 authorizes certification of a class “when the question is one of a common or general interest, of many persons, or when the parties are numerous, and it is impracticable to bring them all before the court ...”

Plaintiff states there are approximately 60,041 class members who can be identified from a review of Defendant’s records.

The Court finds that there are common questions regarding whether class members were subjected to unlawful conduct and that proposed class may be conditionally certified for settlement purposes.

E. Class Notice

California Rules of Court, rule 3.769, subdivision (f), provides, “If the court has certified the action as a class action, notice of the final approval hearing must be given to the class members in the manner specified by the court. The notice must contain an explanation of the proposed settlement and procedures for class members to follow in filing written objections to it and in arranging to appear at the settlement hearing and state any objections to the proposed settlement.”

Here, the proposed notice plan satisfies due process and the requirements of Rule 3.769.

The notice plan includes a direct mail notice, a settlement website, and a toll-free number.

The form of the notice is generally adequate, subject to the modification set forth below.

It describes the lawsuit, explains the settlement and releases, includes instructions for claiming benefits, and states the settlement amounts, including attorney fees and payment to the named plaintiff.

The notice informs class members that they may appear at the final fairness hearing to make an oral objection.

The following language regarding the final approval hearing shall be added to the notice: Class members may appear at the final approval hearing in person or remotely using the link for Department 19 (Afternoon Session), and should review the remote appearance instructions beforehand: https://santaclara.courts.ca.gov/online-services/remote-hearings

Class members who wish to appear remotely are encouraged to contact class counsel at least three days before the hearing, if possible, so that potential technology or audibility issues can be avoided or minimized.

On the condition that the parties make the above change to the notice prior to its mailing, the notice is approved.

IV.

Conclusion

The Court GRANTS the motion for preliminary approval, VACATES the Case Management Conference set for 2:30 p.m. on May 13, 2026, and sets a final approval hearing for January 13, 2027 at 1:30 p.m. in Department 19.

Plaintiffs shall prepare the order in accordance with California Rules of Court, rule 3.1312.

- oo0oo -

6