In re Anthem, Inc. Data Breach Litigation

Full title: IN RE ANTHEM, INC. DATA BREACH LITIGATION

Court: UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

Date published: Aug 15, 2018

327 F.R.D. 299 (N.D. Cal. 2018)

Opinion

327 F.R.D. 299 (N.D.Cal. 2018) IN RE ANTHEM, INC. DATA BREACH LITIGATION No. 15-MD-02617-LHK United States District Court, N.D. California, San Jose Division August 15, 2018

[Copyrighted Material Omitted] [Copyrighted Material Omitted] [Copyrighted Material Omitted] [Copyrighted Material Omitted] [Copyrighted Material Omitted]           ORDER GRANTING PLAINTIFFS’ MOTION FOR FINAL APPROVAL OF CLASS ACTION SETTLEMENT Re: Dkt. No. 916-3

         LUCY H. KOH, United States District Judge

          This matter is before the Court on Plaintiffs’ motion for final approval of the proposed class action settlement ("Settlement") between individual and representative Plaintiffs¹ and the Settlement Class they represent (collectively, "Plaintiffs"), and Defendants Anthem, Inc.; Blue Cross Blue Shield Association; and affiliates² (collectively, "Defendants"). ECF No. 916-3 ("Mot."). Defendants do not oppose this motion. The Court held a Final Approval Hearing on February 1, 2018. After that hearing, the parties negotiated an amendment to the Settlement Agreement in April 2018. The Court held another hearing on June 14, 2018. At that hearing, the parties agreed to reopen the claims process until July 19, 2018 to allow additional Settlement Class Members to submit claims and to allow opt outs to revoke their exclusion requests. The Court now addresses the motion for final approval.

1 All named Plaintiffs are identified in paragraphs 12 through 113 of the Fourth Consolidated Amended Class Action Complaint ("FCAC"). See ECF No. 714-3 ("FCAC") ¶¶ 12-113.

2 Defendants are identified in paragraphs 114 through 158 of the FCAC. See FCAC ¶¶ 114-58. The affiliates listed in the Settlement are: Blue Cross and Blue Shield of Georgia, Inc.; Blue Cross Blue Shield Healthcare Plan of Georgia, Inc.; Anthem Insurance Companies, Inc.; Blue Cross of California; Anthem Blue Cross Life and Health Insurance Company; Rocky Mountain Hospital and Medical Service, Inc.; Anthem Health Plans, Inc.; Anthem Health Plans of Kentucky, Inc.; Anthem Health Plans of Maine, Inc.; HMO Missouri, Inc.; RightCHOICE Managed Care, Inc.; Healthy Alliance Life Insurance Company; Anthem Health Plans of New Hampshire, Inc.; Empire HealthChoice Assurance, Inc.; Community Insurance Company; Anthem Health Plans of Virginia, Inc.; HealthKeepers, Inc.; Blue Cross Blue Shield of Wisconsin; Compcare Health Services Insurance Corporation; Amerigroup Corporation; Amerigroup Services, Inc.; Amerigroup Kansas, Inc.; Amerigroup Washington, Inc.; HealthLink, Inc.; UniCare Life & Health Insurance Company; CareMore Health Plan; The Anthem Companies, Inc.; The Anthem Companies of California, Inc.; Blue Cross and Blue Shield of Alabama; USAble Mutual Insurance Company, d/b/a Arkansas Blue Cross and Blue Shield; California Physicians’ Service d/b/a Blue Shield of California; Blue Cross and Blue Shield of Florida, Inc. d/b/a Florida Blue; CareFirst of Maryland, Inc.; Blue Cross and Blue Shield of Massachusetts, Inc.; Blue Cross and Blue Shield of Michigan; BCBSM, Inc. d/b/a Blue Cross and Blue Shield of Minnesota; Horizon Healthcare Services, Inc.; Blue Cross and Blue Shield of North Carolina; Highmark Inc. f/k/a Highmark Health Services; Blue Cross and Blue Shield of Vermont; and Health Care Service Corporation, a Mutual Legal Reserve Company.

          Having considered the motion for final approval, the parties’ Settlement Agreement, the April 2018 amendment to the Settlement Agreement, the record in this case, and the arguments and evidence presented at the Final Approval Hearing and June 14, 2018 hearing, IT IS HEREBY ORDERED as follows:

          Unless otherwise defined herein, all terms that are capitalized herein shall have the meanings ascribed to those terms in the Settlement Agreement.

          The Court has jurisdiction over the subject matter of the Settlement Agreement with respect to and over all parties to the Settlement Agreement, including all Settlement Class Members and Defendants.

          I. The Class Satisfies the Applicable Requirements of Rule 23

          On August 25, 2017, this Court preliminarily certified, for settlement purposes only, the following class:

All Individuals whose Personal Information was maintained on Anthem’s Enterprise Data Warehouse and are included in Anthem’s Member Impact Database and/or received a notice relating to the Data Breach; provided, however, that the following are excluded from the Settlement Class: (i) Defendants, any entity in which Defendants have a controlling interest, and Defendants’ officers, directors, legal representatives, successors, subsidiaries, and assigns; (ii) any judge, justice, or judicial officer presiding over this matter and the members of their immediate families and judicial staff; and (iii) any individual who timely and validly opts-out from the Settlement Class.

ECF No. 903 at 2. Here, the Court provides further elaboration on the reasons for certification and finally certifies the above-defined class.

          Class actions are governed by Rule 23 of the Federal Rules of Civil Procedure. The threshold task in determining whether to certify a class for settlement purposes is to examine whether the four requirements of Rule 23(a) are met. Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 614, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997); Hanlon v. Chrysler Corp., 150 F.3d 1011, 1019 (9th Cir. 1998). Additionally, parties seeking certification must show that the action satisfies at least one subsection of Rule 23(b). Amchem, 521 U.S. at 614, 117 S.Ct. 2231; Hanlon, 150 F.3d at 1022. Many of the qualifying criteria contained in Rule 23(a) and (b) exist to protect the interests of absentee class members and therefore deserve "undiluted, even heightened, attention" in the context of a settlement-only class certification. Amchem, 521 U.S. at 620, 117 S.Ct. 2231; see also Ortiz v. Fibreboard Corp., 527 U.S. 815, 848-49, 119 S.Ct. 2295, 144 L.Ed.2d 715 (1999) (explaining that when a district court "certifies for class action settlement only, the moment of certification requires ‘heightene[d] attention’ to the justifications for binding the class members" (quoting Amchem, 521 U.S. at 620, 117 S.Ct. 2231) ).

         Rule 23(a) provides that a district court may certify a class only if: "(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class." Fed.R.Civ.P. 23(a). That is, the class must satisfy the requirements of numerosity, commonality, typicality, and adequacy of representation to maintain a class action. Mazza v. Am. Honda Motor Co., 666 F.3d 581, 588 (9th Cir. 2012).

         If all four prerequisites of Rule 23(a) are satisfied, the action must also be maintainable under one of the three subsections of Rule 23(b). Hanlon, 150 F.3d at 1022. In the instant case, the parties propose certification pursuant to Rule 23(b)(3). To qualify for certification under that subsection, common questions of law or fact must "predominate over any questions affecting only individual members" and class resolution must be "superior to other available methods for fairly and efficiently adjudicating the controversy." Fed.R.Civ.P. 23(b)(3).

         The Court first addresses whether the Settlement Class meets the requirements of Rule 23(a), then addresses whether the action meets the requirements of Rule 23(b)(3).

         A. Rule 23(a) Requirements

         Rule 23(a) conditions class certification on fulfillment of four requirements: (1) numerosity, (2) commonality, (3) typicality, and (4) adequacy of representation. Mazza, 666 F.3d at 588. The Court takes each requirement in turn.

          1. Numerosity

          Pursuant to Rule 23(a)(1), the class must be "so numerous that joinder of all members is impracticable." In the instant case, that requirement is easily met by the absolute number of Settlement Class Members. Although there is no talismanic numerical cutoff for impracticability of joinder, a class size of forty or more members usually is enough. Corley v. Google, Inc., 316 F.R.D. 277, 290 (N.D. Cal. 2016); see also 1 Newberg on Class Actions § 3:12 (5th ed. 2017). Here, the unfeasibility of bringing all of the class members before one court is readily apparent because the Settlement Class encompasses 79,150,325 members. Mot. at 12; ECF No. 1041 ¶ 4. Beyond sheer size, joinder is also impracticable because the Settlement Class Members are widely dispersed geographically and unlikely to institute their own actions given the relatively small size of each individual claim. 1 Newberg, supra, § 3:12. The Class definitively satisfies the numerosity requirement.

          2. Commonality

          Rule 23(a)(2) states that "[o]ne or more members of a class may sue or be sued as representative parties on behalf of all members only if there are questions of law or fact common to the class." Fed.R.Civ.P. 23(a)(2). This requirement has "been construed permissively, and all questions of fact and law need not be common to satisfy the rule." Ellis v. Costco Wholesale Corp., 657 F.3d 970, 981 (9th Cir. 2011) (citation, internal quotation marks, and alteration omitted). Indeed, "for purposes of Rule 23(a)(2)[,] even a single common question will do." Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 359, 131 S.Ct. 2541, 180 L.Ed.2d 374 (2011) (citation, internal quotation marks, and alteration omitted); Mazza, 666 F.3d at 589 ("[C]ommonality only requires a single significant question of law or fact."). Thus, "[w]here the circumstances of each particular class member vary but retain a common core of factual or legal issues with the rest of the class, commonality exists." Parsons v. Ryan, 754 F.3d 657, 675 (9th Cir. 2014) (quoting Evon v. Law Offices of Sidney Mickell, 688 F.3d 1015, 1029 (9th Cir. 2012) ).

         Here, the parties have identified legal and factual issues common to the underlying claims that are susceptible to class-wide determination. In particular, the Settlement Class Members suffered the same injury— namely, their personal information was stored on the same Anthem data warehouse that was breached by hackers. Indeed, these cases were originally selected for consolidated treatment by the U.S. Judicial Panel on Multidistrict Litigation ("JPML") on the basis that the "actions share factual questions arising from a data security breach that allegedly occurred sometime between December 10, 2014, and February 4, 2015, and resulted in the electronic theft of personally identifiable information and personal health information of, by one estimate, some 80 million current and former health insurance plan members." In re Anthem, Inc., Customer Data Sec. Breach Litig., 109 F.Supp.3d 1364, 1365 (U.S. Jud. Pan. Mult. Lit. 2015). The extensiveness and adequacy of Anthem’s security measures lie at the heart of every claim. Moreover, the answer to those questions does not vary from Settlement Class Member to Settlement Class Member because, as noted, Anthem stored all of the Settlement Class Members’ personal information in one data warehouse. Related factual questions about whether Anthem knew that its data security was inadequate and whether Anthem amply responded to the data breach also apply uniformly across the entire Class. Thus, these common factual contentions "that [are] central to the validity of each one of the claims" can be determined for all Settlement Class Members "in one stroke." Dukes, 564 U.S. at 350, 131 S.Ct. 2541.

         Importantly, too, the common answers to these questions are "apt to drive the resolution" of the legal issues in this case. Abdullah v. U.S. Sec. Assocs., Inc., 731 F.3d 952, 957 (9th Cir. 2013) (quoting Dukes, 564 U.S. at 350, 131 S.Ct. 2541). All of Plaintiffs’ claims are premised on and dependent on the notion that Anthem violated the law by failing to adequately secure the personal information in its data warehouse. In other words, Plaintiffs’ underlying theory of legal liability is the same across the asserted state laws. For example, Plaintiffs contend that Anthem’s inadequate security violated a duty of care to all Settlement Class Members (i.e., negligence) and breached Anthem’s promise to all Settlement Class Members to protect their personal information (i.e., breach of contract). FCAC ¶¶ 433-84. Similarly, Anthem’s deficient security forms the basis for Plaintiffs’ allegations that Anthem is liable under state laws ranging from broad consumer-protection statutes to targeted data-breach statutes. Id. ¶¶ 538-934. Thus, the complaint contains a common contention capable of class-wide resolution— "one type of injury allegedly inflicted by one actor in violation of one legal norm." Vaquero v. Ashley Furniture Indus., Inc., 824 F.3d 1150, 1154 (9th Cir. 2016).

         This scenario is materially distinguishable from the one confronted by the U.S. Supreme Court in Dukes . There, the Supreme Court denied certification of a class of more than a million female Wal-Mart employees who claimed gender discrimination based on the delegation of pay and promotion decisions to individual managers. Dukes, 564 U.S. at 344, 131 S.Ct. 2541. The Supreme Court explained that the plaintiffs "wish to sue about literally millions of employment decisions at once." Id. at 352, 131 S.Ct. 2541. Without some "proof of a companywide discriminatory pay and promotion policy," the Supreme Court held that the plaintiffs had not made the requisite showing of commonality because there was no guarantee that class members were disfavored for the same reasons. Id. at 359, 131 S.Ct. 2541. Here, by contrast, the common injury is "far less abstract, far less dispersed, and far more objective and focused." Vaquero, 824 F.3d at 1154. Unlike the millions of subjective determination made by the mangers in Dukes, the course of conduct challenged here stems from one actor and affects all Settlement Class Members in the same manner. Under these circumstances, commonality is satisfied.

          3. Typicality

          Under Rule 23(a)(3), a representative party must assert claims or defenses that are "typical of the claims or defenses of the class." Fed.R.Civ.P. 23(a)(3). Typicality is satisfied "when each class member’s claim arises from the same course of events, and each class member makes similar legal arguments to prove the defendant’s liability." Rodriguez v. Hayes, 591 F.3d 1105, 1124 (9th Cir. 2010) (citation omitted). This requirement is permissive and requires only that the representative’s claims "are reasonably co-extensive with those of the absent class members; they need not be substantially identical." Meyer v. Portfolio Recovery Assocs., LLC, 707 F.3d 1036, 1042 (9th Cir. 2012) (quoting Hanlon, 150 F.3d at 1020). The purpose of the typicality requirement is to assure that "the interest of the named representative aligns with the interests of the class." Torres v. Mercer Canyons Inc., 835 F.3d 1125, 1141 (9th Cir. 2016) (quoting Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992) ).

          The parties have established typicality. "[T]he broad composition of the representative parties vitiates any challenge founded on atypicality." Hanlon, 150 F.3d at 1020. The class representatives comprise persons from almost every state who were enrolled in plans with either Defendant Anthem (or its affiliates) or Defendant Blue Cross Blue Shield Association (or its associated companies). FCAC ¶¶ 12-113. The class representatives, like the class as a whole, each had different types of personal information stored on Anthem’s system that was exfiltrated during the breach of that system. As the Ninth Circuit has instructed, "it is sufficient for typicality if the plaintiff endured a course of conduct directed against the class." Just Film, Inc. v. Buono, 847 F.3d 1108, 1118 (9th Cir. 2017). Moreover, the lawsuit has a narrow focus— namely, to challenge the sufficiency of Anthem’s data security and receive adequate compensatory damages for the breach of Anthem’s system. In combination with the comprehensive makeup of the class representatives, these limited objectives further confirm that the class representatives’ claims were typical of the entire class’s claims. See Hanlon, 150 F.3d at 1020.

          4. Adequacy of Representation

          Finally, Rule 23(a)(4) asks whether "the representative parties will fairly and adequately protect the interests of the class." Fed.R.Civ.P. 23(a)(4). This inquiry seeks to uncover conflicts of interest between named parties and the class they seek to represent, thereby guarding the due-process right of absent class members not to be bound to a judgment without adequate representation by the parties participating in the litigation. See Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 158 n.13, 102 S.Ct. 2364, 72 L.Ed.2d 740 (1982); Hansberry v. Lee, 311 U.S. 32, 42-43, 61 S.Ct. 115, 85 L.Ed. 22 (1940). Adequacy of representation turns upon resolution of two questions: "(1) do the named plaintiffs and their counsel have any conflicts of interest with other class members and (2) will the named plaintiffs and their counsel prosecute the action vigorously on behalf of the class?" In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 943 (9th Cir. 2015) (citation omitted).

         The Class here does not contain intractable divisions or conflicts. At the fundamental level, all Settlement Class Members are victims of the same event: their personal information was on Anthem’s data warehouse at the time when the breach occurred. For much the same reason, all Settlement Class Members generally seek the same relief: compensation for the harms already incurred as a result of the breach and protection against the use of their personal information going forward. To the extent that there are slight distinctions between Settlement Class Members, the named Plaintiffs are a representative cross-section of the entire Class. See Hanlon, 150 F.3d at 1021 (noting that "[r]epresentatives of other potential subclasses are included among the named representatives"). For instance, the named Plaintiffs have had various forms of information stolen— ranging from home addresses to dates of birth to Social Security numbers— and while some have already experienced fraudulent use of their personal information, others have not. FCAC ¶¶ 7, 12-113. Likewise, the named Plaintiffs differ in whether they have taken action to combat the information theft and what they have done. Id. ¶¶ 12-113. Moreover, the terms of the Settlement Agreement recognize and reflect the variety of interests. Finally, "there is no structural conflict of interest based on variations in state law, for the named representatives include individuals from each state, and the differences in state remedies are not sufficiently substantial so as to warrant the creation of subclasses." Hanlon, 150 F.3d at 1021.

         Objector Leona Boone contends that there is an "intraclass conflict" based on the "disparity of benefits" between Settlement Class Members. Specifically, she notes that some Settlement Class Members receive cash payments while others receive credit monitoring services alone. ECF No. 939 at 1. As the Ninth Circuit has instructed, "all of the Rule 23 standards for class actions must be met without regard to the presence or terms of a pending settlement agreement." Hanlon, 150 F.3d at 1020. However, looking to the Settlement Agreement reinforces, rather than undermines, the conclusion that the named Plaintiffs fairly and adequately represent the interests of the Class. Specifically, the structure of the Settlement reflects that a one-size-fits-all remedy is not warranted in this case. In particular, the Settlement’s main form of relief— credit monitoring— would not be of much value to Settlement Class Members who already have such services, so the Settlement allows them to claim an alternative cash payment. ECF No. 869-8 ("Settlement") ¶¶ 4.7-4.8, 5.3. Similarly, for those Settlement Class Members who already expended resources as a result of the breach, the Settlement sets aside $15 million to reimburse their out-of-pocket costs. Id. ¶ 6.4. The named Plaintiffs fall into these various categories, and the record reflects that the interests of all Settlement Class Members were represented.

         Nor does this case present the kind of problems that led the U.S. Supreme Court to reject certification for lack of adequate representation in Amchem . In Amchem, the parties proposed a settlement to resolve all pending and future asbestos litigation, including claims not yet filed or in existence at the time of settlement. 521 U.S. at 603, 117 S.Ct. 2231. The Supreme Court found that the disparate interests of present and future claimants created insurmountable conflicts for class counsel who could not possibly provide adequate representation to both groups. Id. at 626, 117 S.Ct. 2231. This dual representation was particularly troubling because current claimants wanted to maximize immediate payouts while future claimants wanted to preserve funds for the future. Id. As the Supreme Court summarized, there was "no assurance [t]here— either in the terms of the settlement or in the structure of the negotiations— that the named plaintiffs operated under a proper understanding of their representational responsibilities." Id. at 617, 117 S.Ct. 2231.

         Here, in contrast, the Settlement Agreement is carefully calibrated to provide substantial benefits to all of the Settlement Class Members. For Settlement Class Members who already took corrective or protective measures in response to the data breach, the Settlement sets aside $15 million to reimburse out-of-pocket costs in an amount up to $10,000 for each Settlement Class Member. Settlement ¶ 6.4. The period to submit a request for reimbursement of out-of-pocket costs has not closed; it remains open for a full year after final approval. Id. ¶ 6.1. The Settlement also provides other concrete benefits for Settlement Class Members who have concerns about future misuse of their personal information. For example, all Settlement Class Members (even those who did not submit a claim) are entitled to fraud resolution services. Id. ¶ 4.9. Additionally, Settlement Class Members who submitted a claim for credit monitoring will receive credit monitoring services, which include identity theft insurance. Id. ¶ 4.1. Based on the current claims rate, fraud resolution and credit monitoring services are likely to last more than four years. ECF No. 1042, Ex. A. Settlement Class Members who already have credit monitoring services may opt instead for an alternative cash payment of up to $50 per Settlement Class Member. Settlement ¶ 5.1. Again, based on the current claims rate, Settlement Class Members are likely to receive the maximum $50 payment. ECF No. 1042, Ex. A. Finally, Settlement Class Members whose personal information remains in Anthem’s data warehouse benefit from Anthem’s Settlement obligation to almost triple its annual spending on data security for the next three years and adopt certain cybersecurity controls and reforms. Settlement ¶ 2. Those reforms include changing Anthem’s data retention policies, following specific remediation schedules, and performing annual IT security risk assessments and settlement compliance review. Id. Thus, the instant case does not present an unassailable conflict like the one in Amchem, and "the terms of the settlement" and "the structure of the negotiations" in the instant case account for differences among the Settlement Class Members.

         The second adequacy inquiry examines the vigor with which the named Plaintiffs and Class Counsel will pursue the common claims. The Court specifically selected Class Counsel based on the attorneys’ extensive experience in prosecuting complex class actions. See ECF No. 284. Class Counsel have subjected the case to adversarial testing— including by engaging in extensive discovery, litigating motions to dismiss and discovery motions, and fully briefing class certification and Daubert motions— and has shown a willingness to take the case to trial if necessary. Thus, this is not a case where Class Counsel "could not use the threat of litigation to press for a better offer." Amchem, 521 U.S. at 621, 117 S.Ct. 2231. The named Plaintiffs have also demonstrated their dedication to pursuing and securing the best outcome for the Class. The named Plaintiffs have actively participated in the case by sitting for depositions and, in many instances, allowing their personal computers to be forensically examined by Defendants. The actions on the part of the named Plaintiffs and Class Counsel were taken in advancement of the litigation. See Hanlon, 150 F.3d at 1021. This vigorous prosecution of the case satisfies the Rule 23(a)(4) concerns.

         In sum, the Court finds that Class meets the Rule 23(a) requirements of numerosity, commonality, typicality, and adequacy of representation under the heightened scrutiny mandated in the settlement-only context. The Court now turns to Rule 23(b)(3).

         B. Rule 23(b)(3) Requirements

         As noted above, Rule 23(b)(3) can be broken into two component pieces: (1) predominance, and (2) superiority. Hanlon, 150 F.3d at 1022. The Court analyzes each in turn.

          1. Predominance

          Under Rule 23(b)(3), plaintiffs must show "that the questions of law or fact common to class members predominate over any questions affecting only individual members." Fed.R.Civ.P. 23(b)(3). The Rule 23(b)(3) predominance requirement is "even more demanding" than Rule 23(a)’s commonality counterpart. Comcast Corp. v. Behrend, 569 U.S. 27, 34, 133 S.Ct. 1426, 185 L.Ed.2d 515 (2013). Predominance "tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation." Amchem, 521 U.S. at 623, 117 S.Ct. 2231 (citation omitted). The Ninth Circuit has held that "there is clear justification for handling the dispute on a representative rather than an individual basis" if "common questions present a significant aspect of the case and they can be resolved for all members of the class in a single adjudication." Hanlon, 150 F.3d at 1022. Before certifying a settlement-only class under Rule 23(b)(3), a district court must conduct a rigorous analysis of predominance. Zinser v. Accufix Research Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001). The predominance analysis focuses on "the legal or factual questions that qualify each class member’s case as a genuine controversy, questions that preexist any settlement." Amchem, 521 U.S. at 623, 117 S.Ct. 2231. The ultimate question is whether "the common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aggregation-defeating, individual issues." Tyson Foods, Inc. v. Bouaphakeo, __ U.S. __, 136 S.Ct. 1036, 1045, 194 L.Ed.2d 124 (2016).

          As discussed in some detail with respect to the commonality requirement, Plaintiffs’ case for liability depends, first and foremost, on whether Anthem used reasonable data security to protect Plaintiffs’ personal information. Indeed, the claims rise or fall on whether Anthem properly secured the stolen personal information, such that Anthem’s security should be improved and affected class members should be afforded a remedy. That question can be resolved using the same evidence for all Settlement Class Members because their personal information was all stored on the same Anthem data warehouse that was the subject of the breach. Thus, the focus would remain on the extent and sufficiency of the specific security measures that Anthem employed. This is the precise type of predominant question that makes class-wide adjudication worthwhile. See id. ("When one or more of the central issues in the action are common to the class and can be said to predominate, the action may be considered proper under Rule 23(b)(3) ...." (internal quotation marks and citation omitted) ). Predominance is not defeated simply because "other important matters will have to be tried separately, such as damages." Id. (citation omitted).

         The only perceived threat to predominance is the variation in the state laws underlying Plaintiffs’ causes of action. On that point, the Ninth Circuit’s recent decision in In re Hyundai & Kia Fuel Economy Litigation, 881 F.3d 679, 693 (9th Cir. 2018),³ is a helpful starting point. That case began as a suit by a class of plaintiffs alleging that Hyundai had violated California consumer-protection statutes and common law by falsely advertising the fuel efficiency of its vehicles. In re Hyundai, 881 F.3d at 695. The plaintiffs sought to certify a nationwide class, but Hyundai opposed certification on predominance grounds, arguing that "differences in state consumer protection laws precluded the application of California law to consumers who are not Californians and defeated predominance" and including a lengthy "Appendix of Variations in State Laws" with its opposition. Id. The district court issued a tentative ruling on the motion for class certification in which it concluded that California law could not be applied to out-of-state class members and that variances in state law undercut predominance. Id. at 696. However, before the court could issue a formal decision, the JPML transferred a number of other actions to the same district court. Id. at 697. Soon after the transfer, the parties in the consolidated cases informed the court that they had reached a settlement for a single nationwide class. Id. Although some of the plaintiffs who had unwittingly been consolidated into the MDL proceedings raised the same predominance issues, the court overruled their objections and granted certification without conducting a choice-of-law analysis or addressing variations in state law. Id. at 700. Objectors appealed. Id. at 701.

3 The Court notes that, on July 27, 2018, the Ninth Circuit granted en banc rehearing in In re Hyundai, so the three-judge panel disposition may no longer be cited as precedent. See In re Hyundai & Kia Fuel Econ. Litig., 897 F.3d 1003, 1007 (9th Cir. 2018). However, because In re Hyundai is distinguishable from the instant case, the Court discusses it below.

         The Ninth Circuit vacated and remanded. Id. at 703. The Ninth Circuit held that the district court had committed a legal error in failing to perform a choice-of-law analysis under California law. Id. at 702. Without such an analysis, the district court could not go on to decide whether the variations in state law were sufficiently material to prevent application of California law to all class members and defeat predominance. Id. Emphasizing the district court’s tentative no-predominance decision, the Ninth Circuit faulted the court for "failing to acknowledge, as it had in its tentative ruling, that Hyundai and the [objector] plaintiffs submitted evidence that the laws in various states were materially different than those in California" and could affect the predominance inquiry. Id. In the Ninth Circuit’s view, the district court’s prior indication that predominance was lacking deprived the proceedings of adversarial investigation because Hyundai knew that it faced little risk of facing a nationwide class action. Id. at 702-03. The Ninth Circuit also rejected the suggestion that variations in state law are trial-management issues that do not need to be addressed in the settlement context. Id. at 702. The Ninth Circuit therefore vacated the class certification decision but did not "foreclose[ ] [the district court] from certifying a class (or subclasses) on remand." Id. at 703.

         The Court begins by noting three differences between In re Hyundai and the instant case. First, the district court in In re Hyundai performed no choice-of-law analysis even though the objector plaintiffs asked the court to do one. The majority and dissent in In re Hyundai had a spirited debate about whether the objector plaintiffs squarely raised the issue, but the majority indicated that the objector plaintiffs submitted a memorandum opposing certification that discussed the elements of California’s choice-of-law rules. Id. at 699-700. By contrast, no choice-of-law analysis is requested or needed in the instant case because Plaintiffs here do not assert that "California law ... appl[ies] to all plaintiffs in the[ir] nationwide class" but instead concede that the laws of the fifty States apply. See id. at 702. Second, and relatedly, both Hyundai and the objector plaintiffs made extensive arguments about the differences between state consumer-protection laws. Most prominently, with its opposition to certification, Hyundai submitted "a thirty-four page ‘Appendix of Variations in State Laws,’ which detailed the numerous differences in the burden of proof, liability, damages, statutes of limitations, and attorneys’ fees awards under different state consumer protection laws and common law fraud actions." Id. at 695. The objector plaintiffs made some of the same points by reference to case law. Id. at 699-700. Returning to the instant case, the arguments about state-law variation have not been nearly as fleshed out. As discussed in more detail below, the main contention is a conclusory statement by an objector that "the affected state consumer-protection statutes vary in their coverage." ECF No. 939 at 1.

         Third, and perhaps most important, the district court in In re Hyundai provided a tentative ruling that predominance was lacking on the basis of differing state laws. 881 F.3d at 696. The district court’s tentative decision featured heavily in the Ninth Circuit’s opinion. For example, the Ninth Circuit explained that the district court’s certification ruling, unlike its earlier ruling, did not consider the evidence of material state-law variation filed by Hyundai and the objector plaintiffs. Id. at 702. The Ninth Circuit further identified that the tentative ruling also likely upset the adversarial process and settlement negotiations because Hyundai could be confident that a nationwide class would not be certified for litigation purposes. Id. at 702-03. This case is different. Although the parties completed their briefing on class certification, the Court never issued any ruling or otherwise indicated its leanings. At a minimum, this state of affairs better preserves Plaintiffs’ ability to "use the threat of litigation to press for a better offer." Id. (quoting Amchem, 521 U.S. at 621, 117 S.Ct. 2231).

          All of that said, one primary takeaway from In re Hyundai is that courts should examine differences in the underlying state law as part of the predominance analysis because "in a multi-state class action, variations in state law may swamp any common issues and defeat predominance." Id. at 691 (alteration omitted) (quoting Castano v. Am. Tobacco Co., 84 F.3d 734, 741 (5th Cir. 1996) ). The U.S. Supreme Court too has suggested that in a case involving large disparities between class members, "[d]ifferences in state law [may] compound these disparities." Amchem, 521 U.S. at 624, 117 S.Ct. 2231. However, the Supreme Court has also observed that the predominance standard is "readily met" in consumer class actions. Id. The Ninth Circuit has made clear that "[v]ariations in state law do not necessarily preclude a [nationwide] 23(b)(3) action" because sometimes "the idiosyncratic differences between state consumer protection laws are not sufficiently substantive to predominate over the shared claims." Hanlon, 150 F.3d at 1022-23. With these principles in mind, the Court now turns to their application to this case.

          In an extensive trial plan submitted to the Court, Plaintiffs pinpoint multiple central issues that permeate their claims and identify common evidence that will be used to prove each of these issues. ECF No. 743-13. For example, Plaintiffs list key documents and deposition testimony that would be used to show that "Anthem aggregated millions of people’s [personal information] ... but failed to follow its own policies or reasonable safeguards to protect the [personal information], resulting in the Anthem Data Breach." Id. at 1. Similarly, Plaintiffs note that Anthem’s formal policies will establish that Anthem promised to protect the confidentiality of Class Members’ personal information but failed to disclose the inadequacies in Anthem’s data security. Id. at 2. Additionally, Plaintiffs assert that Class Members were injured by the same exfiltration of their data from Anthem’s database and propose ways to calculate class-wide damages. Id. at 2-3. These critical common issues predominate over any potential individual issues based on state-law variations, as discussed in more detail below with respect to particular causes of action.

         Plaintiffs assert two common-law claims for all Class Members: breach of contract and negligence. The basic elements of breach of contract are the same across states. See In re Conseco Life Ins. Co. LifeTrend Ins. Sales & Mktg. Litig., 270 F.R.D. 521, 529 (N.D. Cal. 2010); cf. Am. Airlines, Inc. v. Wolens, 513 U.S. 219, 233 n.8, 115 S.Ct. 817, 130 L.Ed.2d 715 (1995) (stating that "[b]ecause contract law is not at its core ‘diverse, nonuniform, and confusing,’ we see no large risk of nonuniform adjudication" (citation omitted) ). In their motion for class certification, Plaintiffs submitted that, as a matter of legal interpretation, all of Plaintiffs’ contracts incorporate by reference identical or near-identical contract terms from standardized plan booklets provided to members. ECF No. 743-11 at 19-20. Plaintiffs construe those terms as a promise that Anthem will use reasonable and adequate safeguards to protect personal information. Id. at 19. Thus, the central issue of breach turns on the common question whether Anthem’s security measures are adequate. The Ninth Circuit has certified a nationwide contract class action, explaining that no material differences in state law with respect to interpretation or breach required individualized adjudication. Just Film, 847 F.3d at 1123.

         As with contract law, the common factual and legal issues relevant to Plaintiffs’ negligence claims greatly outweigh any individualized differences. The elements of negligence would be familiar to any law student: (1) duty of care, (2) breach, (3) causation, and (4) damages. Restatement (Second) of Torts § 281 (1965). This case does not implicate any of the state-specific issues that can sometimes creep into the negligence analysis. Plaintiffs allege that Defendants breached a duty of care to their customers because of Anthem’s inadequate security measures. FCAC ¶¶ 436-37. Again, the main issue boils down to the common factual contention of whether Anthem’s data security levels were reasonable. Plaintiffs’ negligence claims would not get bogged down in the individualized causation issues that sometimes plague products-defect cases. Those cases often cannot clear the predominance hurdle because "[n]o single happening or accident occurs to cause similar types of physical harm or property damage." Valentino v. Carter-Wallace, Inc., 97 F.3d 1227, 1231 (9th Cir. 1996). Here, by contrast, the same actions by a single actor wrought the same injury on all Settlement Class Members together. Cf. Amchem, 521 U.S. at 625, 117 S.Ct. 2231 ("Even mass tort cases arising from a common cause or disaster may, depending upon the circumstances, satisfy the predominance requirement."). That is particularly true in light of Plaintiffs’ unifying theory of damages based on the difference in value between the market price of the product Defendants should have provided and the product actually provided. ECF No. 743-13 at 2. Therefore, the adequacy of Anthem’s security measures also permeates Plaintiffs’ negligence claims and is not overwhelmed by state-law distinctions.

         The same conclusion holds for Plaintiffs’ state statutory claims. Objector Leona Boone focuses on one category of these claims and declares (without further elaboration) that "[t]he predominance requirement cannot be met because the affected state consumer-protection statutes vary in their coverage." ECF No. 939 at 1. It is true that the state consumer-protection statutes at issue here are not identical, but the Court concludes that this is a case in which "the idiosyncratic differences between state consumer protection laws are not sufficiently substantive to predominate over the shared claims." Hanlon, 150 F.3d at 1022-23. Plaintiffs’ theories across these consumer-protection statutes are essentially the same. Repeatedly, Plaintiffs assert that Defendants are liable for unfair practices because they "fail[ed] to maintain the privacy and security of [Plaintiffs’] Personal Information." FCAC ¶¶ 539, 545, 551, 558, 567, 577, 598, 605, 630, 642, 650, 657, 666, 675, 683, 690, 697, 705, 712, 718, 726, 34, 743, 751, 759, 767, 784, 793, 799, 810. Thus, the core of Plaintiffs’ case relies on uniform aspects of these state consumer-protection laws. See In re Mex. Money Transfer Litig., 267 F.3d 743, 747 (7th Cir. 2001) (noting that plaintiffs avoided the pitfall of state-law variation by "confin[ing] their theories to federal law plus aspects of state law that are uniform"). Liability is not tied to an element, like reliance, that may sometimes require evaluating each individual Plaintiff’s circumstances. See, e.g., Mazza, 666 F.3d at 596. Rather, because the common issues turn on a common course of conduct by the defendant, "[a] common nucleus of facts and potential legal remedies dominates this litigation." Hanlon, 150 F.3d at 1022.

         In sum, Plaintiffs have established Rule 23(b)(3) predominance.

          2. Superiority

          Rule 23(b)(3) provides four non-exhaustive factors for a court to consider in determining whether a class action is superior to other methods of adjudication. These factors are:

(A) the class members’ interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). "[T]he purpose of the superiority requirement is to assure that the class action is the most efficient and effective means of resolving the controversy." Wolin v. Jaguar Land Rover N. Am., LLC, 617 F.3d 1168, 1175 (9th Cir. 2010) (alteration in original) (citation omitted). In cases where plaintiffs are unable to proceed individually because the disparity between litigation costs and the recovery sought is too high, the class-action device may be an effective means "to pool claims which would be uneconomical to litigate individually." Local Joint Exec. Bd. of Culinary/Bartender Tr. Fund v. Las Vegas Sands, Inc., 244 F.3d 1152, 1163 (9th Cir. 2001) (quoting Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 809, 105 S.Ct. 2965, 86 L.Ed.2d 628 (1985) ); see also 7AA Charles Alan Wright et al., Federal Practice and Procedure § 1779 (3d ed. 2018) ("[I]f a comparative evaluation of other procedures reveals no other realistic possibilities, [the superiority] portion of Rule 23(b)(3) has been satisfied."). Examining the applicable factors, the Court finds that the parties have established superiority.

          The first factor is each class member’s interest in "individually controlling the prosecution or defense of separate actions." Fed.R.Civ.P. 23(b)(3)(A). "Where recovery on an individual basis would be dwarfed by the cost of litigating on an individual basis, this factor weighs in favor of class certification." Wolin, 617 F.3d at 1175. Here, the amount at stake for individual Settlement Class Members is too small to bear the risks and costs of litigating a separate action. Litigation costs would be quite high, given that the case involves complex technical issues and requires substantial expert testimony. These exact circumstances have been held to "point[ ] to the need for class treatment." Just Film, 847 F.3d at 1123. Moreover, many of the legal issues presented in this data-breach case are novel, and Defendants have the resources to strongly contest an individual plaintiff’s contentions. Because individual damages pale in comparison to the costs of litigation, this factor points toward certification.

         The second factor is "the extent and nature of any litigation concerning the controversy already commenced by or against members of the class." Fed.R.Civ.P. 23(b)(3)(B). Pursuant to an order from the JPML, seventeen federal cases filed throughout the country were transferred to this Court for coordinated or consolidated pretrial proceedings. See In re Anthem, 109 F.Supp.3d at 1366. As the JPML articulated, the "actions share[d] factual questions arising from [the same] data security breach" and "[c]entralization [would] eliminate duplicative discovery, prevent inconsistent pretrial rulings, particularly with respect to class certification, and conserve the resources of the parties, their counsel, and the judiciary." Id. at 1365. Since that time, the parties have alerted the JPML to additional actions that involve the same common questions of fact, and the JPML has transferred those additional actions to this Court. See ECF Nos. 2, 8, 10, 20, 168, 377, 419, 436, 440, 469, 510, 734. At the highest point, there were 129 cases pending before this Court. After some dismissals and remands, there are at present 108 actions pending before this Court. See ECF No. 1045. The parties have not identified any other cases that have been brought, and Plaintiffs have represented that "[a]ll federal cases are consolidated in this MDL." ECF No. 719-4 at 13.⁴ Consequently, this factor too weighs in favor of certification.

4 The Court remanded two cases (including one class action) to state court. ECF Nos. 275, 853.

         The third factor is "the desirability or undesirability of concentrating the litigation of the claims in the particular forum." Fed.R.Civ.P. 23(b)(3)(C). When the JPML issued its transfer order, it selected this district as the appropriate transferee district. In re Anthem, 109 F.Supp.3d at 1365. In addition to the numerous actions that were already pending in this district and the support from multiple plaintiffs, the JPML explained that this district "presents a convenient and accessible forum with the necessary judicial resources and expertise to manage this litigation efficiently." Id. The Court also agrees with the JPML’s analysis with respect to Defendants: although Anthem is headquartered in Indiana, the ties to California are significant because Anthem is the largest for-profit health insurer in this state and maintains several offices here. Id. Thus, this factor likewise supports certification.

         The fourth factor is manageability, which requires that courts consider "the likely difficulties in managing a class action." Fed.R.Civ.P. 23(b)(3)(D). However, when "[c]onfronted with a request for settlement-only class certification, a district court need not inquire whether the case, if tried, would present intractable management problems." Amchem, 521 U.S. at 620, 117 S.Ct. 2231. In fact, parties settle precisely to avoid going to trial. Id. In this case, the Court need not address the manageability factor.

         In sum, the predominant issue in this case is whether Anthem properly secured the personal information taken from its data warehouse. That question can be resolved using the same evidence for all Settlement Class Members. Class treatment is the superior method of adjudicating the consumer claims arising from the data breach because the issues cannot practically be resolved through millions of individual trials or settlement negotiations. Indeed, class-wide settlements have been approved in comparable data-breach cases. See, e.g., In re Target Corp. Customer Data Sec. Breach Litig., No. 14-MD-02522-PAM, 2017 WL 2178306, at *9 (D. Minn. May 17, 2017); In re the Home Depot, Inc., Customer Data Sec. Breach Litig., No. 14-MD-02583-TWT, 2016 WL 6902351, at *2 (N.D.Ga. Aug. 23, 2016).

         Accordingly, as all requirements of class certification under Rule 23 are met, the Settlement Class will be certified for the purposes of settlement.

          II. The Settlement Is Fair, Adequate, and Reasonable

          In evaluating a proposed class action settlement under Federal Rule of Civil Procedure 23(e), the standard is whether the settlement "is fundamentally fair, adequate and reasonable." In re Heritage Bond Litig., 546 F.3d 667, 674-75 (9th Cir. 2008); Torrisi v. Tucson Elec. Power Co., 8 F.3d 1370, 1375 (9th Cir. 1993). A district court should generally consider the following factors when making this determination:

(1) the strength of the plaintiff’s case; (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of maintaining class action status throughout the trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) the experience and views of counsel; (7) the presence of a governmental participant; and (8) the reaction of the class members of the proposed settlement.

In re Bluetooth Headset Prods. Liab. Litig., 654 F.3d 935, 946 (9th Cir. 2011) (quoting Churchill Vill., L.L.C. v. Gen. Elec., 361 F.3d 566, 575 (9th Cir. 2004) ). When, as here, a proposed settlement is negotiated prior to formal class certification, courts must also scrutinize the agreement for "evidence of collusion or other conflicts of interest." Id. The Court finds that the Settlement is fair, adequate, and reasonable in light of these factors.

          A. Strength of Plaintiffs’ Case

          First, the Settlement reflects the strength of Plaintiffs’ case as well as Defendants’ position. Courts have noted that legal uncertainty supports approval of a settlement. See, e.g., Browning v. Yahoo! Inc., No. 04-CV-01463-HRL, 2007 WL 4105971, at *10 (N.D. Cal. Nov. 16, 2007) ("[L]egal uncertainties at the time of settlement— particularly those which go to fundamental legal issues— favor approval."). Data-breach litigation is in its infancy with threshold issues still playing out in the courts. In the past three months alone, both the Seventh and Ninth Circuits have issued opinions addressing basic issues of standing in data-breach cases. See In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018); Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018). Similarly here, Plaintiffs raise novel issues on topics such as damages. Although Plaintiffs’ theories withstood motions to dismiss, they have not been tested beyond the pleading stage. Plaintiffs would also face strong contentions from Defendants. For example, a finding that Anthem’s security measures are inadequate is not a forgone conclusion, as Anthem’s program and response to the breach have been praised by industry experts. Having been "exposed to the litigants, and their strategies, positions and proof," Hanlon, 150 F.3d at 1026 (quoting Officers for Justice v. Civil Serv. Comm’n of City & Cty. of S.F., 688 F.2d 615, 626 (9th Cir. 1982) ), the Court finds that the judicial policy favoring compromise and settlement of class action suits is applicable here. See In re Syncor ERISA Litig., 516 F.3d 1095, 1101 (9th Cir. 2008).

          B. Risk, Expense, Complexity, and Likely Duration of Further Litigation

          Second, the risks, expense, complexity, and likely duration of further litigation also support the Court’s final approval of the Settlement. At the time of the Settlement, the following motions were fully briefed but remained pending: Plaintiffs’ Motion for Class Certification, ECF Nos. 719-4, 743-11; Defendants’ motion to exclude testimony of Plaintiffs’ expert, Matthew Strebe, ECF No. 776-3; Defendants’ motion to exclude testimony of Plaintiffs’ expert, Peter Rossi, ECF No. 777-3; Defendants’ motion to exclude testimony of Plaintiffs’ expert, James Van Dyke, and accompanying evidence, ECF No. 778-3; Plaintiffs’ motion to strike the testimony of Defendants’ expert, William Choi, ECF No. 819; Plaintiffs’ motion to strike the testimony of Defendants’ expert, James Mulvenon, ECF No. 820; Plaintiffs’ motion to strike the testimony of Defendants’ expert, Stefan Savage, ECF No. 821; and Plaintiffs’ motion for leave to file a response to Defendants’ statement of recent decision in support of Defendants’ opposition to class certification, ECF No. 847. These class-certification and related Daubert motions are complicated and may have required further input from the parties before resolution by the Court.

         Moreover, if the parties had not reached a settlement, they would have had to prepare for a lengthy and costly trial, which would entail litigating claims under all fifty states’ laws and exploring highly technical subject matter with ten expert witnesses. The risks to both sides are magnified by the fact that the outcome at trial is uncertain. See In re High-Tech Employee Antitrust Litig., No. 11-CV-02509-LHK, 2015 WL 5159441, at *2 (N.D. Cal. Sept. 2, 2015). In addition, any trial outcome would be subject to potential appeals, which at a minimum would have substantially delayed any recovery achieved for the class. See id. The negative effects of delay are especially acute in this context because Anthem’s provision of credit monitoring has recently expired and Plaintiffs’ expert has explained that the need for credit monitoring is most important for the five years following a data breach. ECF 744-24 ("Van Dyke Report") ¶ 46. Correspondingly, in order to effectively fortify the system against future breach, it is imperative that Anthem implement the security measures sooner rather than later. Taken together, these circumstances suggest that further litigation would have been costly and uncertain and would have detrimentally delayed any potential relief for the Class. By contrast, the Settlement provides the Class with timely, certain, and meaningful recovery.

          C. Risk of Maintaining Class-Action Status Throughout Trial

         Third, there was a potential risk that Plaintiffs would not be able to maintain class-action status throughout trial. At the time of Settlement, the Court had not yet ruled on class certification. While there is no obvious reason to treat certification in a data-breach case differently than certification in other types of cases, the dearth of precedent makes continued litigation more risky. The parties have pointed the Court to only one non-settlement data-breach class that has been certified in federal court to date. See Smith v. Triad of Ala., LLC, No. 14-CV-00324-WKW, 2017 WL 1044692, at *16 (M.D. Ala. Mar. 17, 2017). Due to the unsettled nature of the legal questions, Plaintiffs would likely have to contend with changing interpretations of procedural and substantive provisions throughout the course of the case. The Court further notes that trying the case may have presented certain manageability problems with regard to the calculation of individual damages under some of the proposed damages theories. See Six (6) Mexican Workers v. Ariz. Citrus Growers, 904 F.2d 1301, 1304 (9th Cir. 1990). Although those concerns are not class-defeating in the settlement context, Amchem, 521 U.S. at 620, 117 S.Ct. 2231, they would need to be considered if the case were to proceed to trial. These potential difficulties with maintaining class certification in this case counsel in favor of approving the settlement.

          D. Amount Offered in Settlement

         Fourth, the Settlement provides for meaningful consideration— a total of $115 million where the class size is approximately 79.15 million. Whether one looks at absolute or per-capita numbers, the size of this fund is significant. According to the parties, this gross settlement amount is the largest settlement ever reached in a data-breach class action in the United States. They point to two other settlements in consumer class actions involving data breaches: (1) the district court in the Home Depot data breach approved a $27.2 million settlement fund for a class of more than 52 million consumers, and (2) the district court in the Target data breach approved a $23.3 million settlement fund for a class of approximately 110 million consumers. See ECF No. 944-1 ("Cervantez Reply Decl."), Ex. B; In re Target Corp., 2017 WL 2178306; In re the Home Depot, Inc., 2016 WL 6902351. The Court notes that these settlement figures for the consumer cases in the Home Depot and Target data breaches are not perfect comparators because they represent a small fraction of what the defendants paid as a result of the data breaches. Both Home Depot and Target engaged in large settlements with separate classes of financial institutions and even larger settlements with credit card companies, such as Visa and MasterCard, and their issuers outside of court litigation. For example, in In re Target, in addition to the consumer class settlement, there was a $39 million settlement with a separate class of financial institutions. Memorandum of Law in Support of Financial Institution Plaintiffs’ Motion for Final Approval of Class Action Settlement at 2, In re Target, No. 14-MD-02522-PAM (D. Minn. Apr. 11, 2016), ECF No. 745. Similarly, in In re The Home Depot, in addition to the consumer class settlement, there was an approximately $25 million settlement with a separate class of financial institutions. Final Order on Plaintiffs’ Motion on Attorneys’ Fees, Expenses, and Service Awards at 1, In re The Home Depot, No. 14-MD-02583-TWT, 2017 WL 9605207 (N.D.Ga. Oct. 11, 2017), ECF No. 345. Additionally, Home Depot and Target both entered into much larger settlements with credit card companies, such as Visa and MasterCard, and their issuers outside of court litigation. See, e.g., Hadley Malcolm, Target settles with Visa over data breach, USA Today (Aug. 18, 2015 1:54 p.m.), https://www.usatoday.com/story/money/2015/08/18/target-settles-visa-over-data-breach/31911123 (stating that Target entered into a $67 million settlement with Visa and was working on a similar settlement with MasterCard); Home Depot Settles Data Breach Suit for $25M, Lexology (Mar. 30, 2017), https://www.lexology.com/library/detail.aspx?g=12388973-7b1a-42ae-a32a-f00d8c59e7ea ("Home Depot ... obtained releases from some MasterCard and Visa issuers, paying out $14.5 million in premiums on top of more than $140 million in payments to the larger issuers under the card brand recovery processes."). Nevertheless, the Court concludes that the $115 million fund here is a substantial result.

         Another useful comparator is Plaintiffs’ valuation of their own claims. One of Plaintiffs’ damages theories focuses on the economic cost of losing the confidentiality of one’s private information and posits that the black market price for that information provides a good measure. ECF No. 743-11 at 13. Under that measure, Plaintiffs’ expert indicated that damages could be valued at $10 per individual, while Defendants’ expert put damages at $4 per individual. Id. Employing Plaintiffs’ figure, damages total approximately $792 million. Thus, the $115 million Settlement Fund represents approximately 14.5% of the projected recovery that Settlement Class Members would be entitled to if they prevailed on their claims. The Court finds that this percentage is within the range of reasonableness after taking into account the costs and risks of litigation. See, e.g., Betancourt v. Advantage Human Resourcing, Inc., No. 14-CV-01788-JST, 2016 WL 344532, at *5 (N.D. Cal. Jan. 28, 2016) (concluding that a settlement providing 9.7% of the total potential recovery was within the range of reasonableness); Stovall-Gusman v. W.W. Granger, Inc., No. 13-CV-02540-HSG, 2015 WL 3776765, at *4 (N.D. Cal. June 17, 2015) (concluding that a settlement providing 10% of the total potential recovery was within the range of reasonableness); see also Linney v. Cellular Alaska P’ship, 151 F.3d 1234, 1242 (9th Cir. 1998) (noting that a settlement may be adequate even if it "amount[s] to a fraction of the potential recovery" (citation omitted) ).

          In the plan of distribution for the Settlement, these funds are available to all Settlement Class Members as benefits. Even without submitting a claim, every Settlement Class Member receives fraud resolution services. Settlement ¶ 4.9. A sum of $15 million is set aside to reimburse up to $10,000 for each Settlement Class Member who incurred out-of-pocket costs as a result of the data breach. Id. ¶ 6.4. Additionally, the Settlement Agreement allows Settlement Class Members to submit claims for either credit monitoring or alternative cash payments. The credit monitoring lasts for at least two years beyond the two years that Anthem has already provided. Id. ¶¶ 4.7-4.8. For Settlement Class Members who already have credit monitoring, the alternative cash payments can reach $50 per Settlement Class Member. Id. ¶ 5.3. There is no possibility of reversion to Defendants.

          Moreover, the Settlement offers relief beyond monetary compensation. As part of the Settlement Agreement, Anthem is required to make changes to its data security systems and policies that are the subject of the instant suit. In particular, Anthem must nearly triple its annual spending on data security for the next three years and implement cybersecurity controls and reforms recommended by Plaintiffs’ cybersecurity experts. Id. ¶ 2. For example, Anthem must change its data retention policies, follow specific remediation schedules, and do annual IT security risk assessments and settlement compliance review. Id. This nonmonetary relief benefits millions of Settlement Class Members, including those who did not submit a claim form. The Court finds that this nonmonetary relief further weighs in favor of final approval.           E. Extent of Discovery Completed and Stage of Proceedings

         Fifth, the extent of discovery completed and the stage of proceedings support approval. The factual investigation and legal analysis in the three years of this litigation were substantial. The parties litigated two motions to dismiss, and Plaintiffs filed four complaints. The parties otherwise engaged in extensive motion practice, including fifteen discovery motions, and reached a settlement after all briefing on class certification and Daubert motions was complete. At the time of Settlement, the parties had already completed class-certification discovery, fact discovery, and expert discovery. In the course of discovery, Class Counsel reviewed 3.8 million pages of documents; deposed 18 percipient fact witnesses, 62 corporate designees, and 6 defense experts; produced reports from 4 experts and defended their depositions; and produced over 100 named Plaintiffs for depositions and produced 29 of those named Plaintiffs’ computers for forensic examinations. This exchange of information and progress in the litigation confirm that the parties have a good sense of the strength and weaknesses of their respective cases in order to "make an informed decision about settlement." In re Mego Fin. Corp. Sec. Litig., 213 F.3d 454, 459 (9th Cir. 2000) (quoting Linney, 151 F.3d at 1239). Extensive discovery is also indicative of a lack of collusion, as the parties have litigated the case in an adversarial manner. 4 Newberg on Class Actions § 13:50 (5th ed. 2018).

          F. Experience and Views of Counsel

          Sixth, the views of Class Counsel weigh in favor of final approval. The Court appointed competent and experienced counsel who have done extensive work in all types of complex class actions. See ECF No. 284. Class Counsel are thus able to make educated assessments about the risks and possible recoveries in the current dispute. Plaintiffs’ counsel endorses the Settlement as fair, adequate, and reasonable.

          G. Presence of Governmental Participant

         Seventh, there is no government participant in this case, so this factor plays at best a minor role here. It is true that, pursuant to the Class Action Fairness Act, 28 U.S.C. § 1715, the U.S. Attorney General and Attorneys General of each State have been notified of the Settlement and given an opportunity to raise concerns, but none of these government officials have come forward with any complaints. ECF No. 916-32 ("Geraci Decl.") ¶¶ 2-5. Plaintiffs also point out that eight state insurance commissioners entered into a separate agreement with Anthem that is far less extensive than the Settlement. Mot. at 23. These considerations may weakly support approval, but they are not particularly probative.

          H. Reaction of Class Members to Proposed Settlement

          Eighth, the reaction of the Settlement Class Members supports the Court’s final approval of the Settlement. Out of 79,150,325 Settlement Class Members, only 28 submitted objections (less than 0.00004% of the Class, or about one in every 2,826,797 Settlement Class Members). ECF Nos. 944-2, 1041 ¶ 4. The remaining five responses do not object to or comment on the Settlement. One is a motion for the Court to appoint counsel to assist Jeffrey Walton in crafting and filing an objection. ECF No. 904 at 1. The Court denied that motion, ECF No. 905, and Jeffrey Walton successfully submitted an objection, see ECF No. 936. Two letters, submitted by Christopher Shaw (on behalf of his daughter) and Louis Hose, respectively, are requests for exclusion from the Settlement. ECF Nos. 910, 914. The individuals have been excluded. ECF No. 1041, Ex. A. Another response from Andrew Tantiwassadakra contains irrelevant information suggesting that Anthem’s postcard is a phishing scam. ECF No. 911. Finally, Eva Contreraz filed a letter asking to "claim any portion of the Settlement that may be due [her] as a class member." ECF No. 923 at 1.

         In addition, only 406 Settlement Class Members have opted out of the Settlement (about 0.0005% of the Class). ECF No. 1041 ¶ 7. Such low rates of objections and opt-outs are "indicia of the approval of the class." Hughes v. Microsoft Corp., No. 98-CV-01646, 2001 WL 34089697, at *1, *8 (W.D. Wash. Mar. 26, 2001) (finding indicia of approval where nine out of 37,155 class members— or just over 0.02%— submitted objections and "less than 1%" opted out); see also Churchill Vill., 361 F.3d at 577 (affirming district court’s approval of settlement where 45 of 90,000 class members— or 0.05%— objected to the settlement and 500 class members— or 0.56%— opted out); Sugarman v. Ducati N. Am., Inc., No. 10-CV-05246-JF, 2012 WL 113361, at *3 (N.D. Cal. Jan. 12, 2012) (noting that objections from 42 of 38,774 class members— more than 0.1 percent— is a "positive response"). As described in more detail below, the response rate from the Class has been relatively low. Only about 1.8% of the Settlement Class Members have submitted claims. ECF No. 1041 ¶ 4. Plaintiffs represent that this percentage compares favorably to the claims rates of approximately 0.2% and 0.23% in the In re Home Depot and In re Target data-breach actions, respectively. ECF No. 1007-1 ¶ 13. Although Plaintiffs do not specify, presumably these were the claims rates for the consumer class settlements in In re Home Depot and In re Target .

         The Court has considered each objection and the arguments made by the objectors at the Final Approval Hearing. The Court appreciates the concerns expressed by the objectors. However, the Court concludes that none of the objections warrant rejection of the Settlement. See Browne v. Am. Honda Motor Co., No. 09-CV-06750-MMM, 2010 WL 9499072, at *15 (C.D. Cal. July 29, 2010) ("The fact that there is opposition does not necessitate disapproval of the settlement. Instead, the court must independently evaluate whether the objections being raised suggest serious reasons why the proposal might be unfair." (alteration and citation omitted) ). Overall, the positive response from the Class favors approval of the Settlement.⁵

5 Settlement Class Members Alex Andrianopoulos, Andrew and Dannette Coddington, Ann Deibel, Marna Drum, Marie Hurt, Kelly Kress, Robert Leslie, Teresa Mayo, Adam Schulman, and John Stone also objected to the request for attorney’s fees or the request for Class Representative service awards. These objections will be addressed separately in the Court’s order on fees.

         13 of the 28 objections expressly argue that the Settlement is too low or otherwise insufficient. The objectors are Amitabho Chattopadhyay, Ann Deibel, Madonna Graham, Robert Leslie, Sharon McClellan, Timothy Mitchell, Joseph Orlowske, Daniel Pflug, Luis Prada, John Stone,⁶ Stacey Talbott, Jeffrey Walton, and Eric and Mara Ziecker. ECF Nos. 907; 912; 913; 919; 920; 922; 933; 934; 936; 944-14 ("Supp. KCC Decl."), Exs. E, G, H; 952. For example, Joseph Orlowske believes that "[t]he fraud resolution service is nice" but (joined by Amitabho Chattopadhyay, Ann Deibel, and Sharon McClellan) laments that $115 million does not go far enough in penalizing Anthem’s behavior. ECF Nos. 912 at 1-3, 919 at 7-9, 922 at 3, 933 at 1. Other objectors dispute what relief would be sufficient. Daniel Pflug, Madonna Graham, Robert Leslie, Timothy Mitchell, John Stone, and the Zieckers simply state that two years of credit monitoring is inadequate. ECF Nos. 920 at 1; 934 at 1; Supp. KCC Decl., Ex. E at 1; Supp. KCC Decl., Ex. G at 1; Supp. KCC Decl., Ex. H at 2; 952 at 2. Sharon McClellan and Stacey Talbott maintain that only lifetime credit monitoring would be enough. ECF Nos. 907 at 1, 922 at 1. Luis Prada goes further, arguing that class members need a lifetime of identity theft insurance. ECF No. 913 at 1.

6 The Court notes that John Stone’s letter appears to be an opt-out notice. ECF No. 920 at 1 (stating the reasons that he and his family "want to be excluded from this settlement"). Indeed, John and Erika Stone are listed in the report of excluded Settlement Class Members. ECF No. 1041, Ex. A. Accordingly, the Court need not consider John Stone’s objection because he is not a Settlement Class Member. Moore v. Verizon Commc’ns Inc., No. 09-CV-01823-SBA, 2013 WL 4610764, at *9 (N.D. Cal. Aug. 28, 2013) ("[A] court need not consider the objections of non-class members because they lack standing."); S.F. NAACP v. S.F. Unified School Dist., 59 F.Supp.2d 1021, 1032 (N.D. Cal. 1999) ("[N]onclass members have no standing to object to the settlement of a class action."). Because the substance of his objection overlaps with other objections, it is included in the Court’s discussion below.

          In objecting to the relief provided under the Settlement, none of these Settlement Class Members adequately take into account the risks and delays involved in proceeding to summary judgment or trial. They ignore that the Settlement provides the class with a timely, certain, and meaningful recovery, while further litigation and any subsequent appeal are uncertain, would entail significant additional costs, and in any event would substantially delay any recovery achieved. "[T]he very essence of a settlement is compromise, a yielding of absolutes and an abandoning of highest hopes." Linney, 151 F.3d at 1242 (quoting Officers for Justice, 688 F.2d at 624). "Estimates of what constitutes a fair settlement figure are tempered by factors such as the risk of losing at trial, the expense of litigating the case, and the expected delay in recovery (often measured in years)." Browne, 2010 WL 9499072, at *12. Thus, "[t]he fact that a proposed settlement may only amount to a fraction of the potential recovery does not, in and of itself, mean that the proposed settlement is grossly inadequate and should be disapproved." Linney, 151 F.3d at 1242 (internal quotation marks and citation omitted).

         Relatedly, these objectors do not sufficiently account for the fact that the Settlement is likely to send a strong message to Defendants. A settlement does not need to provide for all possible recoverable damages to deter wrongdoing. See, e.g., United States v. New Jersey, No. 87-CV-02331-HAA, 1995 WL 1943013, at *14 (D.N.J. Mar. 14, 1995) ("The $7.125 million settlement amount satisfies the United States’ desire to provide a reasonable amount of compensation to identifiable victims of alleged discrimination and sends a strong message to deter discrimination by other employers."). That conclusion has added force because the Settlement imposes additional obligations on Anthem that redound to the benefit of the Class. As discussed above, the Settlement requires Anthem to make changes to its data security systems and policies. Anthem must almost triple its annual spending on data security for the next three years and adopt certain cybersecurity controls and reforms, such as changing its data retention policies, following specific remediation schedules, and performing annual IT security risk assessments and settlement compliance review. Settlement ¶ 2. These mandatory changes constitute additional relief to the Class over and above the Settlement Fund itself.

         More to the point, the objections about the unsatisfactory length of credit monitoring are counteracted by the record. Based on current figures, it appears that Settlement Class Members who requested credit monitoring will receive at least four years’ worth of credit monitoring. ECF No. 1042, Ex. A. In combination with Anthem’s voluntary provision of two years of credit monitoring, Settlement Class Members look to have credit monitoring services for a total of at least six years, which includes what Plaintiffs’ expert deemed to be the period of heightened risk of identity theft— namely, five years after the breach. Van Dyke Report ¶ 46.⁷ Moreover, to protect customers’ data moving forward, Anthem must significantly increase its annual spending and make particular cybersecurity changes to protect its data. In light of this factual backdrop, there is a sufficient basis to conclude that the credit monitoring in the Settlement Agreement adequately addresses the concerns of the litigation.

7 Indeed, another pair of objectors, Dannette and Andrew Coddington, suggests that the Settlement provides too much credit monitoring given that "the most immediate danger from the breach has lessened with time." ECF No. 927 at 3; see also id. at 4 ("Further credit monitoring is less urgent and not of as much value to class members as the first two years of monitoring.").

         One objector, Amitabho Chattopadhyay, contends that the result here is inadequate because California’s Confidentiality of Medical Information Act, Cal. Civ. Code § 56 et seq., provides for $1,000 in statutory damages plus attorneys’ fees up to $1,000, an amount greater than the largest alternative cash payment that can be distributed to each Settlement Class Member through this Settlement. ECF No. 919 at 8 (citing Cal. Civ. Code § § 56.35-.36). While such recovery may theoretically have been possible, the Settlement represents a fair and adequate compromise in light of significant risks faced by the Class and the delay in any potential recovery from proceeding with litigation. Even if Plaintiffs were to prevail after further litigation, recovery would be delayed by the time needed to resolve motions for class certification and summary judgment, conduct a trial, and possibly defend against any appeals.

         That certain Settlement Class Members evaluate the risks differently, or would prefer to go to trial despite those risks, does not prevent the Court from granting final approval to the Settlement. See Browne, 2010 WL 9499072, at *15 ("The fact that there is opposition does not necessitate disapproval of the settlement." (alteration and citation omitted) ). Accordingly, these objections are overruled.

          Along the same lines, three objectors assert that the credit monitoring services offered in the Settlement are of less value than the alternative cash payments. These objectors are Leona Boone, Sean Cowdrey, and Kelly Kress. ECF Nos. 925, 930, 939. For example, Sean Cowdrey suggests that the credit monitoring is of "little value" because many Settlement Class Members received such services from Equifax after the 2017 data breach. ECF No. 930 at 1. Kelly Kress raises a similar concern that the credit monitoring "cannot be combined with any other credit monitoring package, or staggered upon another plan already in place." ECF No. 925 at 4. Finally, Leona Boone argues that the Settlement Class Members receiving only credit monitoring services are releasing their claims without adequate compensation. ECF No. 939 at 1.

          Obviously, the credit monitoring services themselves confer an economic benefit, as they can retail for $9 to $20 a month. Van Dyke Report ¶ 53. The credit monitoring services offered in this Settlement are more extensive than the services offered by Equifax. The Equifax credit monitoring lasts for one year (whereas the credit monitoring here will likely last more than four years) and does not include either identity restoration services or identity valuation monitoring (which the credit monitoring service here does). Cervantez Reply Decl. ¶ 9. Moreover, the Settlement allows Settlement Class Members to layer their coverage or to stagger coverage by delaying activation of credit monitoring for up to one year under the Settlement. Settlement ¶ 4.4. Beyond these options, Settlement Class Members who already have credit monitoring also qualify to receive an alternative cash payment in lieu of credit monitoring. Id. ¶ 5.1. More broadly, these objections overlook other benefits in the Settlement: all Settlement Class Members receive fraud resolution services, Settlement Class Members may claim reimbursement for out-of-pocket costs, and Anthem must implement key changes to its security and triple its annual spending for the next three years to better protect the personal information of the Class. Id. ¶¶ 2, 4.9, 6.4. On this record, the Court does not agree that the credit monitoring services under the Settlement are of minimal value, and the Court overrules these objections.

         Because one of the primary benefits of the Settlement is the provision of credit monitoring, Kelly Kress objects to the Settlement as "nothing more than a coupon settlement" where "[t]he majority of class members receive zero cash." ECF No. 925 at 2, 3-5. Under the Class Action Fairness Act, coupon settlements receive heightened judicial scrutiny. 28 U.S.C. § 1712(e); In re HP Inkjet Printer Litig., 716 F.3d 1173, 1178 (9th Cir. 2013). However, Kelly Kress’s characterization of the Settlement as a coupon settlement is incorrect. In a coupon settlement, the defendant provides a discount on future purchases of the plaintiffs. See In re Online DVD-Rental, 779 F.3d at 951. Here, in contrast, Settlement Class Members need not hand over any more money to obtain the benefits of the Settlement. Those benefits include credit monitoring services, which, as the Court has just explained, have an intrinsic, tangible value. See Browning v. Yahoo! Inc., No. 04-CV-01463-HRL, 2007 WL 4105971, at *5 (N.D. Cal. Nov. 16, 2007) (finding that the settlement at issue was not a coupon settlement because the credit score and credit monitoring benefits had value to class members). Kelly Kress’s objection to the contrary is overruled.

          Continuing on the topic of credit monitoring, other objectors express concerns that the Settlement’s designated credit monitoring company (Experian) may lack adequate cybersecurity controls. These objectors are Luis Prada and the Zieckers. ECF No. 913 at 1; Supp. KCC Decl., Ex. H at 2. Class Counsel specifically took this consideration into account. In evaluating competing bids and proposals from several vendors of credit monitoring services, Class Counsel carefully vetted and evaluated Experian’s security controls. Cervantez Reply Decl. ¶ 8. Class Counsel also negotiated customary protective provisions that Experian must keep Settlement Class Member data in the United States and cannot use their information for any purpose other than credit monitoring. Id. These controls adequately respond to the objectors’ concerns, and their objections are overruled.

          Objectors lodge two objections to the alternative cash payments. The first, submitted by Dannette and Andrew Coddington, "object[s] to any requirement to prove that a class member already subscribes to credit monitoring before they are eligible for the cash alternative." ECF No. 927 at 3. However, the Settlement does not require anything akin to formal proof. Settlement ¶ 5.1. Instead, in a straightforward claim form, the Settlement Class Member had to "(i) state that he or she has some form of credit monitoring or protection as of the date the Claim Form is submitted, (ii) identify the credit monitoring or protection he or she has and approximately when he or she enrolled, and (iii) not also elect to claim Credit Services on the Claim Form." Id. This non-onerous requirement is a reasonable one to ensure that Settlement Class Members claim the appropriate remedies so as not to upset the careful balance of the Settlement between credit monitoring and alternative cash payments. Indeed, credit monitoring services are closely linked to and curative of the injury suffered by Settlement Class Members, and cash payments serve as an alternative for Settlement Class Members who already have credit monitoring. The Coddingtons’ objection is overruled.

          The second objection, submitted by Sean Cowdrey, claims that alternative cash payments are "an inadequate alternative because the funds available to pay Alternative Compensation Claims depends [sic] on how much money is left in the Settlement Fund after other claims and costs, including plaintiffs’ attorney’s fees, are paid." ECF No. 930 at 1 (emphasis omitted). This objection appears to misunderstand the Settlement Agreement. Although the alternative cash payments are made after other claims and costs have been paid, the Settlement allocates at least $13 million for the alternative cash payments. Settlement ¶ 5.3. Moreover, the amount to be requested in attorneys’ fees is capped at $37.95 million. Id. ¶ 12.1. These structural choices ensure that the fund will be sufficient to pay claims for alternative cash payments. Based on current figures, the fund is sufficient to make the maximum allowable payment of $50 to all Settlement Class Members who submitted a claim. Cervantez Reply Decl. ¶ 3; ECF No. 1042, Ex. A. For these reasons, this objection is overruled.

          The Coddingtons object to the Settlement’s balance between credit monitoring services and alternative cash payments. ECF No. 927. In particular, they identify a "gross disparity" between the value of credit monitoring (which they put at $480 per individual) and the value of cash payments (which they put at $36 per individual). Id. at 2. In their view, this disparity is "clearly intended to steer class members away from the cash alternative and toward the credit monitoring, which will provide Anthem with a far higher credit against the settlement fund." Id. As a preliminary point, the Settlement establishes a $115 million non-reversionary fund, Settlement ¶ 3.1, so Anthem will have to pay that entire amount regardless of how many Settlement Class Members opt for the different benefits under the Settlement. To the extent that the Coddingtons suggest that the Settlement places too much of an emphasis on certain forms of relief over others, the Court disagrees. By purchasing credit monitoring services in bulk, Defendants can offer a significant discount to Settlement Class Members who want such services. That discount redounds to the benefit of the Settlement Class Members seeking alternative cash payments because they are likely to receive $50, an amount greater than what Plaintiffs would receive under one of their proposed damages models. See ECF No. 743-12 at 13 (stating that damages could be valued around $10 per Class Member). In other words, the structure of the Settlement permitted the parties to leverage the presence of these two groups to exact cost-effective credit monitoring options and high alternative cash payments. Accordingly, the Coddingtons’ objection is overruled.

          Some objectors raise concerns with regard to the $15 million fund for out-of-pocket costs. Objections from the Coddingtons and Joseph Orlowske express concern that claims for out-of-pocket costs are likely to exceed $15 million. ECF Nos. 927 at 4, 933 at 1. However, based on the claims submitted up until January 25, 2018, the Settlement Administrator does not anticipate that $15 million will be an insufficient amount. Supp. KCC Decl. ¶ 12. Moreover, in April 2018, the parties adopted an amendment to the Settlement that addresses these concerns. As part of the amendment, any funds left over after claims, expenses, and costs are paid will first be used to supplement the $15 million fund for out-of-pocket costs. ECF No. 1007-2 ¶ 4.8. Thus, these objections are overruled.

         Several other objectors believe that the one-year limitation on the period to submit a claim for out-of-pocket costs will cut off recovery for unforeseen future losses. These objectors are Ann Douglas, John Stone, and the Zieckers. ECF Nos. 920 at 1; Supp. KCC Decl., Ex. C at 1; Supp. KCC Decl., Ex. H at 2. As these objectors acknowledge, the period to submit a request for reimbursement of out-of-pocket costs continues for one year after final approval. Settlement ¶ 6.1. The objectors do not raise any specific reason to think that the timeline is insufficient. While it might be preferable for the claim period to last longer, that concern comes down to weighing risk against benefit. Class Counsel aptly point out that it would have been difficult to prove harm that has not yet occurred at trial. Cf. Abuan v. Gen. Elec. Co., 3 F.3d 329, 334 (9th Cir. 1993). Moreover, these objections fail to appreciate that the Settlement does provide some protections against future identity fraud. For example, all Settlement Class Members (even those who did not submit a claim) are entitled to fraud resolution services throughout the pendency of credit monitoring, which is likely to last more than four years. Settlement ¶ 4.9. Settlement Class Members who submitted a claim for credit monitoring also receive identity theft insurance. Id. ¶ 4.1. Accordingly, these objections are overruled.

         Next, three objectors complain that the procedure for obtaining out-of-pocket costs is overly burdensome. For example, Marie Hurt contends that families are unlikely to have the necessary supporting documentation to make a claim. Supp. KCC Decl., Ex. F at 2-3. Leona Boone calls the process "needlessly prohibitive" and "intentionally vague." ECF No. 939 at 1. Amitabho Chattopadhyay asserts that California small claims court offers a superior alternative. ECF No. 919 at 8-9. In reality, the claims process is easy to navigate. Under the Settlement, Settlement Class Members can recover expenses for preventative measures incurred after February 2015 by stating that such expenses were related to the breach and for corrective measures incurred after February 2015 by stating that the wrongdoing was related to the breach and involved the personal information accessed in the breach. Settlement ¶ 6.3.⁸ Although Settlement Class Members must also submit supporting documentation, the Settlement requires only "documentation [that] should naturally exist and have been retained or is obtainable." Id. ¶ 6.1. In addition to eliminating the need to prove causation, this mode of substantiation is significantly less than what Class Members would have had to produce at trial. See ECF No. 743-13 at 3. Also, if the Settlement Class Member’s out-of-pocket claim is deemed incomplete, the Settlement Administrator must contact that individual, identify any deficiencies, and provide 30 days to cure. Settlement ¶ 6.2. Accordingly, these objections are overruled.

8 Contrary to the claims of objectors Amitabho Chattopadhyay and Timothy Mitchell, ECF No. 919 at 1; Supp. KCC Decl., Ex. G at 1, the Settlement explicitly covers both "credit freezes" and "falsified tax returns." Settlement ¶ 6.3.

         A number of objectors take issue with Anthem’s data-security reform. Three objectors— Amitabho Chattopadhyay, Kelly Kress, and Adam Schulman— argue that the redaction of the details of Anthem’s cybersecurity improvements interferes with their ability to weigh the value of the Settlement. ECF Nos. 919 at 7, 924 at 9, 925 at 3. The Court appreciates the gravity of these contentions but notes its prior ruling that Anthem demonstrated compelling reasons to seal these materials. ECF No. 902 at 4; see also Kamakana v. City & Cty. of Honolulu, 447 F.3d 1172, 1178 (9th Cir. 2006). As the Court explained, "if specific information regarding Anthem’s cybersecurity practices were disclosed, this could allow cyberattackers greater opportunity to defeat these defenses and substantially harm both Anthem and putative class members." ECF No. 902 at 4. Similarly, this Court held that "disclosing specific funding levels could allow Anthem’s competitors to have an advantage over Anthem in providing cybersecurity services." Id. Although these limited categories of information are not publicly disclosed, the Class does have access to significant details about the improvements, including that Anthem must triple its annual spending on data security for the next three years and implement cybersecurity controls and reforms (such as data retention policies, specific remediation schedules, annual IT security risk assessments, and settlement compliance review). Settlement ¶ 2. The available information permits the Class to make an informed judgment about the value of the Settlement, and the Court has scrutinized the value of the Settlement in light of the objectors’ concerns. The Court reiterates that compelling reasons support sealing the identified material in the Settlement Agreement and overrules these objections.

          Four objectors— Amitabho Chattopadhyay, the Coddingtons, Robert Leslie, and Jeffrey Walton— argue that the changes to Anthem’s data-security practices are worthless. ECF Nos. 919, 927, 936, 952. Amitabho Chattopadhyay contends that Anthem would have inevitably changed its practices to avoid future liability, and Robert Leslie asserts that the proposed enhancements will not be effective unless there is accountability. ECF Nos. 919 at 7, 952 at 1-2. The Coddingtons and Jeffrey Walton add that Anthem was required under a regulatory settlement to spend $260 million on security improvements. ECF Nos. 927 at 4, 936 at 8. The latter point seems to be factually inaccurate, as the regulatory settlement mentioned $260 million as the total amount already spent by Anthem. See ECF No. 916-23 at 2. Regardless, "[t]he minimum cybersecurity expenditures required over the course of the next three years in this settlement represent new money, not the money Anthem already spent." Cervantez Reply Decl. ¶ 10. Even if Anthem would have independently improved its cybersecurity measures, the Settlement represents a binding contractual obligation for Anthem to implement specific cybersecurity measures recommended by Plaintiffs’ expert. See id. ¶ 11. Moreover, Plaintiffs will hire a cybersecurity expert to review Anthem’s annual cybersecurity reports for compliance. Cervantez Reply Decl. ¶ 24. Accordingly, these objections are overruled.

          Two objectors request that certain terms related to cybersecurity be added into the Settlement. Jeffrey Walton asks that Anthem create a seat for a Chief Information Security Officer, install particular people on its Risk Committee, and publicize confidential security audits. ECF No. 936 at 4-5, 14-15. Luis Prada concurs that annual public security audits are a necessity. ECF No. 913 at 1. Even assuming that the Court would have the power to order Anthem to take these actions, Plaintiffs did not request such relief in the FCAC. Thus, Jeffrey Walton and Luis Prada do not present a valid basis on which to object because the Court’s denying approval would not advance their agendas. Their objections also appear to misperceive the Court’s role at this stage: the Court may grant or deny approval of the Settlement, not revise its terms. See Manual for Complex Litigation (Fourth) § 21.61 (2004) ("The judicial role in reviewing a proposed settlement is critical, but limited to approving the proposed settlement, disapproving it, or imposing conditions on it. The judge cannot rewrite the agreement."); ECF No. 900-7 ("Filing an objection means asking the Court to deny approval to the Settlement. You can’t ask the Court to order a larger settlement— it can only approve or deny the Settlement."). These objections are overruled on that basis.

         Lastly, two objectors— Amitabho Chattopadhyay and Robert Grondona— raise concerns about the scope of the release. ECF Nos. 919, 931. Amitabho Chattopadhyay argues that the release is too broad and does not enumerate all released claims. ECF No. 919 at 9-10.⁹ Robert Grondona worries that the release will extinguish his claims arising out of a 2011 Anthem breach because that breach is mentioned in at least one of the underlying actions. ECF No. 931 at 1. However, the release is consistent with Ninth Circuit law.

9 At the same time, Amitabho Chattopadhyay challenges the restrictions contained in the Settlement Agreement’s non-disparagement provision, which states that "Settlement Class Representatives, Class Counsel, Defendants, and Defendants’ counsel agree not to ... defame, disparage or in any way criticize the personal or business reputation, practices, or conduct of the Parties and their respective counsel concerning all Released Claims, as well as the litigation of this Action, the Settlement, this Settlement Agreement, and any discussions, interactions, or negotiations of the Settlement." Settlement ¶ 18.21. But the provision does not prevent Amitabho Chattopadhyay from speaking out against the Settlement, as that provision by its terms does not apply to unnamed Settlement Class Members.

         As the Court covered in detail at the preliminary approval hearing, the Ninth Circuit allows federal courts to release not only those claims alleged in the complaint, but also claims "based on the identical factual predicate as that underlying the claims in the settled class action." Hesse v. Sprint Corp., 598 F.3d 581, 590 (9th Cir. 2010) (citation omitted). The breadth of the release in the Settlement Agreement is commensurate with that legal standard: it covers "any claim, liability, right, demand, suit, obligation, damage, including consequential damages, losses or costs, punitive damages, attorneys’ fees and costs, actions or causes of action, of every kind or description ... related to or arising from any of the facts alleged in any of the Actions." Settlement ¶ 1.32. Courts in this district have approved releases with equivalent language. See Custom LED, LLC v. eBay, Inc., No. 12-CV-00350-JST, 2013 WL 6114379, at *4 (N.D. Cal. Nov. 20, 2013) (approving release of claims "arising out of or relating in any way to any of the legal, factual, or other allegations made in the Action, or any legal theories that could have been raised based on the allegations of the Action"); see also Chavez v. PVH Corp., No. 13-CV-01797-LHK, 2015 WL 581382, at *5 (N.D. Cal. Feb. 11, 2015) (indicating a willingness to approve a release of claims "arising from, or related to the facts occurring during the Settlement Class Period as alleged in the Second Amended Complaint"). Thus, these objections are overruled.

          I. Evidence of Collusion or Conflict of Interest

         Ninth, and finally, the Court finds no evidence of collusion or other conflicts of interest. Collusion is not evident from the face of the Settlement Agreement. Nor are there any of the standard "subtle signs that class counsel have allowed pursuit of their own self-interests and that of certain class members to infect the negotiations." In re Bluetooth, 654 F.3d at 947. Class Counsel are paid from the same fund as Plaintiffs. See id. Furthermore, the funds cannot revert to Defendants under any circumstances. See id. More broadly, the Settlement was negotiated at arms’ length over several full-day mediation sessions with the help of an experienced mediator— Judge Layn Phillips— and the final terms stem from his mediator’s proposal. Courts in this district have recognized that "the assistance of an experienced mediator in the settlement process confirms that the settlement is non-collusive." G. F. v. Contra Costa Cty., No. 13-CV-03667-MEJ, 2015 WL 4606078, at *13 (N.D. Cal. July 30, 2015) (alteration and citation omitted). The Court is satisfied that the Settlement was reached after arm’s length negotiations by capable counsel and was not a product of fraud, overreaching, or collusion among the parties.

         Accordingly, the Court finds that the Settlement is fair, adequate, and reasonable within the meaning of Rule 23(e) of the Federal Rules of Civil Procedure.

          III. The Notice Program Was Appropriate

         Federal Rule of Civil Procedure 23(c)(2)(B) requires that the settling parties provide Settlement Class Members with "the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort." The notice must "clearly and concisely state in plain, easily understood language" the following: (1) "the nature of the action"; (2) "the definition of the class certified"; (3) "the class claims, issues, or defenses"; (4) "that a class member may enter an appearance through an attorney if the member so desires"; (5) "that the court will exclude from the class any member who requests exclusion"; (6) "the time and manner for requesting exclusion"; and (7) "the binding effect of a class judgment on members under Rule 23(c)(3)."

         The Court finds that the Notice Plan has been fully implemented in compliance with this Court’s Order, ECF No. 903, and complies with Federal Rule of Civil Procedure 23(c)(2)(B). Notice was sent by mail and email, published in two magazines, and advertised online. The various forms of Notice, which were reviewed and approved by this Court, provided clear descriptions of who is a member of the Class and Settlement Class Members’ rights and options under the Settlement. The Notices explained the conduct at issue in the litigation, how to receive money from the Settlement, how to opt out of the Settlement, how to object to the Settlement, how to obtain copies of relevant papers filed in the case, and how to contact Class Counsel and the Settlement Administrator. See ECF No. 900-7 (containing redlined versions of Notice responding to Court’s comments at preliminary approval hearing).

          The Court approved this Notice Plan. ECF No. 903. Pursuant to the Settlement Agreement and this Court’s order, notice was mailed to 54.9 million Settlement Class Members. Supp. KCC Decl. ¶ 2. Because 6.98 million postcards were returned by the Post Office, the Settlement Administrator performed address searches on all returned mail, after which 2.2 million postcards were re-mailed. ECF No. 1007-3 ¶ 13. Notice was also sent by email to 5.15 million Settlement Class Members. Geraci Decl. ¶ 13. To reach the over 23 million remaining Settlement Class Members with no known mailing or email address, the Settlement Administrator provided notice in two other ways. First, the Settlement Administrator published notice in two widely circulated magazines— People and Good Housekeeping. Id. ¶ 14. Second, the Settlement Administrator purchased more than 180 million advertising impressions across popular websites— Twitter, LinkedIn, Instagram, Google Display Network, and Facebook— that directed observers to the case website. Id. ¶ 15. These ads were designed to target the relevant Settlement Class Members. The Settlement Administrator estimates that "the combined individual and media notice efforts reached approximately 87.5% of likely class members on average 2.1 times each." Id. ¶ 16. All of these alternative routes of communication support a finding that Settlement Class Members received adequate notice of the Settlement.

          Class Members could submit a Claim Form through the Settlement Website or by mail. ECF No. 869-14. To claim credit monitoring services, Class Members who received a postcard notice could simply fill out and return the pre-paid postcard claim form. Id. Class Members claiming alternative cash payments or out-of-pocket costs were required to submit minimal additional information. For an alternative cash payment, Class Members had to submit a claim form confirming the timing and type of their current credit monitoring services. Id. For out-of-pocket costs, Class Members had to submit a claim form accompanied by basic documentation of the costs incurred. Id. Claimants were offered two options to receive payment: direct deposit into the claimant’s bank account or payment by check. Id.

          Settlement Class Members also had a variety of methods by which to view relevant documents, contact the Settlement Administrator or Class Counsel, opt out of the Settlement, or object to the Settlement. These methods included mail, telephone, email, and the Settlement Website. For example, the website received 1,026,168 visits, and 556,207 claim forms were submitted online. Supp. KCC Decl. ¶ 7. Additionally, the Settlement Administrator received 101,127 calls on the toll-free number dedicated to providing information to and answering questions from Settlement Class Members. Id. ¶ 8. To further assist Settlement Class Members with the claims process, Class Counsel engaged a call center that provided live telephone support. ECF No. 944-1 ("Cervantez Reply Decl.") ¶ 12. That call center has received approximately 100 calls per day. Id. Class Counsel further responded to calls from Settlement Class Members and reached out to any Settlement Class Members who raised technical issues. Id.

         Unfortunately, despite these extensive notice efforts, only 1.41 million Settlement Class Members out of the approximately 79.15 million Settlement Class Members, or about 1.8% of the total Class, have submitted claims. ECF No. 1041 ¶ 4; see also ECF No. 1007-1 ¶ 5 ("Class Counsel expected a higher overall claims rate...."). Nevertheless, the Court is convinced that the notice program provided the best notice that is practicable under the circumstances and complied with due process. Notably, "neither Rule 23 nor the Due Process Clause requires actual notice to each individual class member." Briseno v. ConAgra Foods, Inc., 844 F.3d 1121, 1128 (9th Cir.), cert. denied sub nom. ConAgra Brands, Inc. v. Briseno, __ U.S. __, 138 S.Ct. 313, 199 L.Ed.2d 206 (2017); see also Shutts, 472 U.S. at 812, 105 S.Ct. 2965 ("The notice must be the best practicable, ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.’ ") (quoting Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306, 314-15, 70 S.Ct. 652, 94 L.Ed. 865 (1950) ). Courts in this district have approved notice plans nearly identical to the one here as reasonably designed to inform absent class members of the action. See, e.g., Lilly v. Jamba Juice Co., 308 F.R.D. 231, 239 (N.D. Cal. 2014) (accepting notice plan that provided notice by mail for class members whose addresses were obtainable and notice through internet and print media for class members whose addresses were not); see also Briseno, 844 F.3d at 1128 (citing Seventh Circuit case for the proposition that notice may be accomplished through third parties or paid advertising when individual notice by mail is not possible).

          8 individuals have objected to (or commented on) the Notice: John Cappellini, Amitabho Chattopadhyay, Dale Chott, Marna Drum, Thomas Frankel, Alan Hood, Marie Hurt, and John Stone. ECF Nos. 906; 908; 919; 920; Supp. KCC Decl., Exs. B, D, F; 953. Several question the accuracy of the notice process. Dale Chott, Marie Hurt, and John Stone suggest that the process was faulty because some members of their families received notice while others did not; John Cappellini says that he received a notice addressed to another person. ECF Nos. 908 at 2; 920; Supp. KCC Decl., Ex. B at 6; Supp. KCC Decl., Ex. F at 2-3. Upon review, the Settlement Administrator represents that none of these instances reflect errors in the notice or claims administration. Supp. KCC Decl. ¶¶ 15, 19, 22, 23. In each case, the correct family members received notices, and those who did not are not Settlement Class Members. Id. ¶¶ 15, 19, 22. The notice that allegedly was sent to the wrong address reflects the correct name listed in the Class database. Id. ¶ 23. To the extent that these individuals object to the Notice, their objections are overruled.

          Another three individuals have qualms with the form of the Notice. Marna Drum, Thomas Frankel, and Alan Hood contend that the postcards should not have required Settlement Class Members to expose information (such as their email addresses) via open mail. ECF Nos. 906 at 1; Supp. KCC Decl., Ex. D at 1; 953 at 1. Thomas Frankel also expresses confusion about the information on the postcard and how to contact a representative for assistance. ECF No. 906 at 1. The Court and the parties carefully crafted the postcard to provide clear information to Settlement Class Members. Although Settlement Class Members could fill in their email addresses on the postcards to make a claim, there was no requirement to do so. Indeed, Settlement Class Members had the option of filing a claim online. While Thomas Frankel and Marna Drum also had problems contacting the Settlement Administrator and using the website, Class Counsel helped all Settlement Class Members who reported such technical problems— including Thomas Frankel and Marna Drum— and asked the Settlement Administrator to address problems within twenty-four hours. Cervantez Reply Decl. ¶ 12. Both Thomas Frankel and Marna Drum successfully submitted claims. Id. Even if their comments can be construed as objections, they are overruled.

          Finally, Amitabho Chattopadhyay suggests that Notice was inadequate because it did not inform Settlement Class Members that the Settlement bars them from suing Defendants under California’s Confidentiality of Medical Information Act. ECF No. 939 at 11. Preliminarily, the various forms of Notice provided a non-technical description of the release. For example, the first page of the long form Notice stated that "Settlement Class Members will release any and all claims they may have against Defendants and every other person or entity (with certain limited exceptions) related to regarding the Data Breach." ECF 900-7, Ex. B-10b at 1. The postcard Notice, email Notice, and publication Notice similarly indicated that non-excluded Settlement Class Members would forfeit their claims. Id., Exs. B-10a, B-10c, B-10d. Under Ninth Circuit law, the notice need not single out or perform "detailed analysis of the statutes or causes of action forming the basis for the plaintiff class’s claims." Lane v. Facebook, Inc., 696 F.3d 811, 826 (9th Cir. 2012). The standard is that the notice must "generally describe the terms of the settlement in sufficient detail to alert those with adverse viewpoints to investigate and to come forward and be heard." Id. (alteration omitted) (quoting Rodriguez v. West Publ’g Corp., 563 F.3d 948, 962 (9th Cir. 2009) ). The long form Notice explicitly referred interested Settlement Class Members to the relevant paragraphs of the Settlement Agreement containing the release, thereby facilitating the requisite investigation and assessment. Amitabho Chattopadhyay’s objection is overruled.

          One final point merits discussion. After the Court expressed concerns at the February 1, 2018 Final Approval Hearing about the amount of money that would be awarded cy pres in light of the low response rate, the parties negotiated an amendment to the Settlement Agreement in April 2018. ECF No. 1007-2. That amendment eliminates a four-year cap on credit monitoring services and provides that excess funds be further distributed to the Class before being directed to cy pres. Id. ¶ 4.8. Specifically, after all other claims, expenses, and costs are paid, any remaining funds will be used to pay out-of-pocket costs in excess of the total $15 million reserve and then to extend credit monitoring and fraud resolution services beyond four years until there are insufficient funds to pay for at least another full month. Id. Only if funds remain at that point will any amount (which cannot exceed $416,666.66) be distributed to the cy pres recipients.

          The adoption of the April 2018 amendment raises the question whether additional notice to the Class is warranted. As the Manual for Complex Litigation provides, "[i]f the fairness hearing leads to substantial changes adversely affecting some members of the class, additional notice, followed by an opportunity to be heard, might be necessary." Manual for Complex Litigation (Fourth) § 21.61 (2004). The pertinent question here is whether the changes adversely affect class members. When the modification makes the settlement less desirable, notice may be required because courts cannot be sure whether more class members would have chosen to object to the settlement or exclude themselves from the class. In contrast, when the modification makes the settlement more valuable to the class, courts have routinely concluded that notice is unnecessary. See, e.g., Knuckles v. Elliott, No. 15-CV-10175, 2016 WL 3912816, at *5 (E.D. Mich. July 20, 2016); Klee v. Nissan N. Am., Inc., No. 12-CV-08238-AWT, 2015 WL 4538426, at *5 (C.D. Cal. July 7, 2015); Keepseagle v. Vilsack, 102 F.Supp.3d 306, 313 (D.D.C. 2015); see also Shaffer v. Cont’l Cas. Co., 362 Fed.Appx. 627, 631 (9th Cir. 2010) ("Although changes were made to the release after potential class members received the notice, the changes did not render the notice inadequate because they narrowed the scope of the release."). The rationale is that class members who received adequate notice of the original settlement and decided not to opt out would not opt out of a more-favorable settlement. Klee, 2015 WL 4538426, at *5; In re Prudential Ins. Co. of Am. Sales Practices Litig., 962 F.Supp. 450, 473 n.10 (D.N.J. 1997), aff’d, 148 F.3d 283 (3d Cir. 1998).

         Knuckles is instructive. In that case, out of the $7.9 million total settlement fund, $14 would be paid to each class member who filed a claim, with the unclaimed remainder directed to cy pres. Knuckles, 2016 WL 3912816, at *2. At the fairness hearing, the district court expressed concern because only ten percent of the class had filed claims, meaning that ninety percent of the settlement fund would go to cy pres. Id. at *5. At the court’s suggestion, the parties modified the settlement to require a pro rata distribution of the entire settlement fund to those who had already filed claims, rather than directing the unclaimed remainder to cy pres. Id. The court cited to numerous decisions holding that notice of an amendment to a class action settlement is required only where the amendment might have a "material adverse effect on the rights of class members." Id. (citation omitted). The court determined that notice of the modification was unnecessary because it "involve[d] changes to the agreed upon cy pres distribution" and "improve[d] the deal for Class members." Id. at *6. The court reasoned that "Class members who will receive a larger distribution and individuals who failed to opt-out or submit a Proof of Claim form ... need not receive notice of the modification." Id.

         The Court reaches the same conclusion in the present case. The April 2018 amendment implements changes to the cy pres distribution that are directly beneficial to the Class. There is no overriding reason to conclude that those Settlement Class Members who failed to opt out would now choose to do so. That seems especially true given that the April 2018 amendment does not fundamentally change the nature of the relief but instead changes only the quantity. In fact, the claims process for submitting requests for out-of-pocket costs does not end until a year after Final Approval, so all Settlement Class Members may still benefit from the enlargement of the $15 million out-of-pocket fund. Settlement ¶ 6.1. Additionally, the modified Settlement improves the deal for all Settlement Class Members by providing extended credit monitoring services for all Settlement Class Members who submitted a claim and extended fraud resolution services for all Settlement Class Members beyond the four year maximum contemplated in the original Settlement Agreement. These benefits to Settlement Class Members who did not submit a claim make this case even stronger than Knuckles, as the modified settlement there offered enhanced benefits only to those class members who had already filed a claim. 2016 WL 3912816, at *5. On the other side of the ledger, the costs of sending another round of effective notice would be prohibitively expensive and deplete the fund for the Class. See In re Remeron End-Payor Antitrust Litig., No. 02-CV-02007-FSH, 2005 WL 2230314, at *19 (D.N.J. Sept. 13, 2005) ("[A]dditional class notice is not always required because, e.g., of the cost of notice that would take recovered money from the class."). Indeed, the cost of postage alone could be upwards of $14 million. See Supp. KCC Decl. ¶ 4. Thus, the Court concludes that notifying the Class of the April 2018 amendment is not required.

         Nevertheless, the Court permitted notification of one subset of individuals— namely, those Settlement Class Members who previously submitted requests to opt out of the Settlement. These individuals stand in the opposite position to the Settlement Class Members because the change to the Settlement could materially affect their decision to opt out. Thus, they deserved an opportunity to reconsider their decisions based on the terms of the amended Settlement. This course of action has been followed in cases presenting similar circumstances. See Knuckles, 2016 WL 3912816, at *6; Klee, 2015 WL 4538426, at *5; In re Nat’l Football League Players’ Concussion Injury Litig., 307 F.R.D. 351, 386 (E.D. Pa. 2015), aff’d, 821 F.3d 410 (3d Cir. 2016). Accordingly, the Court ordered the Settlement Administrator to alert the 420 opt outs and allow them 30 days to rejoin the Settlement Class by revoking their requests for exclusion. See ECF No. 1041 ¶ 1. At the hearing on June 14, 2018, the Court approved (with some minor modifications) the parties’ suggested letter and revocation form to be mailed to those 420 individuals. ECF Nos. 1033; 1041, Ex. A. On June 19, 2018, the Settlement Administrator mailed those items to the 420 opt-outs. ECF No. 1041 ¶ 1. The deadline to respond was July 19, 2018. ECF No. 1041, Ex. A. As of July 23, 2018, the Settlement Administrator has received 14 revocations of exclusion requests. ECF No. 1041 ¶ 7. Therefore, the revised total number of opt outs is 406. Id.

          During the 30-day window for opt outs to revoke their exclusion requests, the Court also reopened the claims process. This action was not legally required, but the Court found it prudent to afford Settlement Class Members who failed to file a claim form for credit monitoring or alternative cash payments an opportunity to do so in light of the April 2018 Amendment. Moreover, the Court designed the process to minimize administrative costs. In particular, the claims process was held open from June 19, 2018 to July 19, 2018. See ECF No. 1041 ¶¶ 2-3. The Court selected an inexpensive form of notice— namely, posting an update on the Settlement Website— and scrutinized the parties’ suggested language. ECF No. 1041, Ex. B. The Settlement Administrator updated the website with the Court-approved language on June 19, 2018. ECF No. 1041 ¶ 2. At midnight on July 19, 2018, the Settlement Administrator closed the claims filing mechanism for credit monitoring and alternative cash payments. Id. ¶ 3. Comparing current figures to previously reported figures, it appears that 392 additional claims were submitted during the reopened claims process. Compare id. ¶ 4, with ECF No. 1029 ¶¶ 2, 4.

         In sum, the Court finds that the Notice Plan was fully implemented and complies with both due process and Rule 23.

          IV. The Distribution Plan is Fair, Adequate, and Reasonable

          The Court finds that the distribution plan is fair, adequate, and reasonable. "A plan of allocation that reimburses class members based on the type and extent of their injuries is generally reasonable." In re Cathode Ray Tube (Crt) Antitrust Litig., No. 07-CV-05944-JST, 2016 WL 721680, at *21 (N.D. Cal. Jan. 28, 2016) (citing In re Citric Acid Antitrust Litig., 145 F.Supp.2d 1152, 1154 (N.D. Cal. 2001) ); see also In re Oracle Sec. Litig., No. 90-CV-00931-VRW, 1994 WL 502054, at *1 (N.D. Cal. June 18, 1994) ("A plan of allocation that reimburses class members based on the extent of their injuries is generally reasonable."). For this reason, "an allocation formula need only have a reasonable, rational basis, particularly if recommended by experienced and competent counsel." Rieckborn v. Velti PLC, No. 13-CV-03889-WHO, 2015 WL 468329, at *8 (N.D. Cal. Feb. 3, 2015) (quoting Vinh Nguyen v. Radient Pharm. Corp., No. 11-CV-00406, 2014 WL 1802293, at *5 (C.D. Cal. May 6, 2014) ).

         The distribution plan recommended by Class Counsel passes muster under these standards. The plan is structured to fit the slightly distinct injuries that different Settlement Class Members face. First and foremost, all Settlement Class Members are entitled to fraud resolution services regardless whether they submit a claim. Settlement ¶ 4.9. In this way, all Settlement Class Members— even those who fail to enroll in credit monitoring services— will be able to seek professional help if they fall victim to identify theft during the relevant period of the Settlement. From there, Settlement Class Members can elect other relief through a claims process. Centrally, Settlement Class Members may receive credit monitoring by submitting a straightforward form. Id. ¶¶ 4.7-4.8. The emphasis on this form of relief is logical because it is directly responsive to the ongoing injury resulting from the breach. However, the distribution plan recognizes that some Settlement Class Members may already have credit monitoring and therefore allows these individuals to claim an alternative cash payment so long as they designate their current credit monitoring services. Id. ¶ 5.3. Finally, the distribution plan sensibly creates a separate fund for Settlement Class Members that have already spent money in response to the data breach. Members of that group may request reimbursements (with supporting documentation) for up to $10,000, to be distributed from a $15 million fund. Id. ¶ 6.4.

          A couple other features of the distribution plan round out the picture. As noted above, every Settlement Class Member receives fraud resolution services and any Settlement Class Member who submits a claim receives credit monitoring services. Those services are guaranteed to last for two years, id. ¶ 4.7, but the actual length depends upon the number of claims that are submitted. Under the original Settlement, these services were capped at four years. Id. ¶ 4.8. However, the parties amended the Settlement in April 2018 to allow excess funds to extend credit monitoring and fraud resolution services beyond four years until there are insufficient funds to pay for at least another full month. ECF No. 1007-2 ¶ 4.8. The remaining amount will not revert or be repaid to Defendants under any circumstances. Settlement ¶ 7.1. Instead, that residue (which cannot exceed $416,666.66) will be divided into two equal portions and distributed cy pres to the Center for Education and Research in Information Assurance Security at Purdue University and the Electronic Frontier Foundation. Id.

         4 individuals raise objections to the distribution plan. However, to the extent that their concerns are valid, they have been directly addressed by the April 2018 amendment. First, Teresa Mayo objects that the remaining funds will be given as a cy pres award to the Center for Education and Research in Information Assurance Security at Purdue University and the Electronic Frontier Foundation. ECF No. 932 at 2. In her view, any leftover funds should go to Settlement Class Members. Id. at 3. Before the April 2018 amendment, residual funds would be used to augment alternative cash payments up to $50 and to extend credit monitoring services from two years up to four years. The cy pres recipients would receive any remaining funds. Because of the four-year limit on credit monitoring services and the low response rate from the Settlement Class, at the time of the Final Approval Hearing, approximately $3.3 million would be distributed to the cy pres recipients. ECF No. 960-3. In response, the parties negotiated the April 2018 amendment. Under the amendment, there are additional distributions to the Class. First, after all other claims and expenses have been paid, any remaining funds will be used to supplement the $15 million reserve for out-of-pocket costs. ECF No. 1007-2 ¶ 4.8. Second, if any funds still remain, those funds will be used to pay for as many extra months of credit monitoring services as possible. Id. In this way, excess funds will be distributed to the Class, and an amount no greater than the cost of one month of credit monitoring ($416,666.66, or about 0.5 cents per Settlement Class Member) will be awarded to cy pres recipients. This setup comports with the law’s general preference for cy pres awards to be limited to scenarios where it is not feasible to make further distributions to class members. See Nachshin v. AOL, LLC, 663 F.3d 1034, 1038 (9th Cir. 2011) ("[F]ederal courts frequently use the cy pres doctrine in the settlement of class actions where the proof of individual claims would be burdensome or distribution of damages costly." (internal quotation marks and citation omitted) ); see also Principles of the Law of Aggregate Litig. § 3.07 (Am. Law Inst. 2010); In re BankAmerica Corp. Sec. Litig., 775 F.3d 1060, 1064 (8th Cir. 2015); Klier v. Elf Atochem N. Am., Inc., 658 F.3d 468, 475 (5th Cir. 2011).

          Although Teresa Mayo does not appear to object to the specific cy pres recipients selected, the Court briefly addresses this issue for thoroughness. Under Ninth Circuit law, cy pres distribution "must be guided by (1) the objectives of the underlying statute(s) and (2) the interests of the silent class members." Nachshin, 663 F.3d at 1039. For example, the cy pres distribution might "(1) address the objectives of the underlying statutes, (2) target the plaintiff class, or (3) provide reasonable certainty that any member will be benefitted." Id. at 1040. However, courts may not force settling parties to "select a cy pres recipient that the court or class members would find ideal." Lane v. Facebook, Inc., 696 F.3d 811, 821 (9th Cir. 2012).

          Both the Center for Education and Research in Information Assurance Security at Purdue University and the Electronic Frontier Foundation fit the bill. The Center for Education and Research in Information Assurance Security at Purdue University is recognized as "one of the world’s leading centers for research and education in areas of information security." About CERIAS, Ctr. for Educ. & Res. in Info. Assurance Security, https://www.cerias.purdue.edu/site/about/#prevention (last visited Aug. 15, 2018). The center’s research focus areas include "assured identity and privacy" and "prevention, detection and response." Id. The Electronic Frontier Foundation is a nonprofit organization that champions user privacy and technology development. About EFF, Electronic Frontier Found., https://www.eff.org/about (last visited Aug. 15, 2018). The choice of two nationwide entities takes into account the geographic scope of the Class. These entities are appropriate cy pres recipients in this case because their missions are directly related to the Class’s interests and the objectives of the underlying statutes and causes of actions asserted in this litigation. Having found that the cy pres distribution is appropriately tailored here, the Court overrules Teresa Mayo’s objection.

         Second, Adam Schulman submitted an untimely supplemental objection based on the parties’ representation that then-current figures suggested that approximately $3.3 million would go to cy pres. ECF No. 976 at 1. He argued that the parties were misreading the Settlement Agreement, stating his "belief that any reduction in the fee award would return to the gross fund and would be used to extend class members’ credit monitoring services from that reversion." Id. Putting aside that this objection was filed late, the April 2018 amendment essentially adopts Adam Schulman’s proposal. The residual funds will now be used to extend credit monitoring services for as long as possible so long as "the funds can purchase another additional full month of services." Id. ¹⁰ Adam Schulman’s objection is overruled.

10 The April 2018 amendment identically addresses objector Leona Boone’s comment that credit monitoring is "inexplicably limited to four years." ECF No. 939 at 1.

          Third, and finally, the Coddingtons argue that residual funds should be used to supplement the out-of-pocket fund rather than credit monitoring, and Joseph Orlowske relatedly suggests that the $15 million fund for out-of-pocket costs is too low. ECF Nos. 927 at 4, 933 at 1. These objectors’ worries about the insufficiency of the out-of-pocket fund do not appear to be borne out by the facts. Based on the claims submitted by January 25, 2018, the Settlement Administrator anticipated that the $15 million fund for out-of-pocket costs would not be depleted. Supp. KCC Decl. ¶ 12. In any event, the April 2018 amendment assuages (if not eliminates) any such concerns. As part of the amendment, any funds left over after claims, expenses, and costs are paid will first be used to supplement the $15 million fund for out-of-pocket expenses. ECF No. 1007-2 ¶ 4.8. On this basis, Joseph Orlowske’s and the Coddingtons’ objections are overruled.

         In sum, the Court finds that the distribution plan "reimburses class members based on the type and extent of their injuries." In re Cathode Ray Tube, 2016 WL 721680, at *21. There are no valid objections to the distribution plan, in large part because the parties’ April 2018 amendment adopted the objectors’ recommendations. Examining the distribution plan in its entirety, the Court concludes that the distribution plan is reasonable.

          IT IS SO ORDERED.