This motion concerned the approval of a class action settlement arising from a 2020 ransomware attack on Blackbaud, a cloud software provider, which resulted in the exfiltration of personal data of its customers' constituents.
Despite the data breach, no evidence of actual harm or misuse of the exfiltrated data emerged over four years.
The plaintiff sought certification for settlement purposes and approval of a cy-près settlement of $340,000, to be distributed to two academic institutions focused on internet policy and data security.
The court approved the settlement, finding it fair and reasonable given the low likelihood of success in litigation due to the absence of provable damages and the unlikelihood of establishing claims in negligence or intrusion upon seclusion.
The court also approved an unusual notice plan, dispensing with pre-approval notice to the class due to the impracticality of identifying and notifying class members and the low value of the opt-out right.
However, the court significantly reduced class counsel's requested fees from 33.3% to approximately 17.5% of the settlement amount, citing the case's lack of objective success and to discourage the "churning of bad cases."
