Case Information
*1 IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF TEXAS DALLAS DIVISION DAVID HARRELL, individually and on §
behalf of all others similarly situated, §
§
Plaintiff, §
§
V. § No. 3:24-cv-1158-L-BN §
WEBTPA EMPLOYER SERVICES, LLC; § (Consolidated with: HARTFORD LIFE AND ACCIDENT § 3:24-cv-1160; 3:24-cv-1164; INSURANCE COMPANY; ANTHEM § 3:24-cv-1172; 3:24-cv-1174; BLUE CROSS LIFE AND HEALTH § 3:24-cv-1179; 3:24-cv-1180; INSURANCE COMPANY; and § 3:24-cv-1206; 3:24-cv-1210; ELEVANCE HEALTH, INC., § 3:24-cv-1235; 3:24-cv-1236; § 3:24-cv-1242; 3:24-cv-1264; Defendants. § 3:24-cv-1322; 3:24-cv-1343) FINDINGS, CONCLUSIONS, AND RECOMMENDATION OF THE
UNITED STATES MAGISTRATE JUDGE
Defendant WebTPA communicated to its customers on March 25, 2024 “that an unauthorized party had infiltrated its computer network and potentially accessed Private Information of certain individuals around and/or between April 18, 2023 and April 23, 2023.” Dkt. No. 64-2, ¶ 5. “The Private Information may have included a combination of names, telephone numbers, physical addresses, dates of birth, dates of death, insurance identifier information, and some Social Security numbers, of approximately 3,000,000 individuals.” Id.
Based on this incident, actions were filed alleging that Defendants failed to safeguard the Private Information.
And, after he ordered lawsuits based on this incident be consolidated, see Dkt. No. 15, United States District Judge Sam A. Lindsay referred the consolidated action *2 to the undersigned United States magistrate judge for pretrial management under 28 U.S.C. § 636(b), see Dkt. No. 20.
A consolidated class action complaint was filed on August 28, 2025. See Dkt. No. 46. About one month later, the parties jointly moved the Court to stay all deadlines pending settlement discussions. See Dkt. No. 58. That motion was granted, and the stay was continued after the parties notified the Court that the action had settled. See Dkt. Nos. 59-63.
Plaintiffs then filed their Unopposed Motion for Preliminary Approval of Class Action Settlement with Incorporated Memorandum of Law [Dkt. No. 64] (the “Motion”) and moved for a hearing on the Motion, see Dkt. No. 66.
The Motion informs the Court that, after the consolidated class action was filed,
Class Counsel prepared written discovery, including interrogatories, document requests, and a comprehensive Fed. R. Civ. P. 30(b)(6) notice. Class Counsel also consulted with multiple data experts to understand how the breach occurred, the type of information involved, and whether the information was published on the Dark Web.
The Parties then decided to focus their resources on exploring settlement and scheduled a mediation with the Honorable Wayne Andersen (Ret.), an experienced data breach mediator….
In advance of the mediation, Plaintiffs propounded informal discovery requests to learn as much as possible in advance of mediation, and WebTPA provided certain information in response to facilitate the mediation. The Parties also exchanged mediation briefs outlining their positions with respect to liability, damages, and settlement-related issues.
The Parties mediated for a full day on January 14, 2025. Although an agreement was not reached that day, the Parties continued negotiating for the next week, and following a mediator’s proposal, agreed upon the material terms of a settlement to settle all claims against the Defendants on January 21, 2025….
Over several weeks, the Parties diligently drafted, negotiated, *3 and finalized the Settlement Agreement, Notices, and Claim Form, and agreed to the Settlement Administrator.
The Settlement Agreement was signed on March 19, 2025.
Dkt. No. 64 at 10-11 (cleaned up).
And, because the undersigned finds that the requested hearing is not necessary, the Court should deny the motion for hearing and grant the Motion for the reasons explained therein and set out below.
Legal Standards
A class action “may be settled, voluntarily dismissed, or
compromised only with the court’s approval.” F ED . R. C IV . P. 23(e). To
approve the settlement, a court must first determine whether the class
should be preliminarily certified for settlement purposes.
Bridges v.
Ridge Nat. Res., LLC
,
If a court preliminarily certifies the class, it then moves to the preliminary fairness evaluation. “First, the Court makes a preliminary fairness evaluation of the proposed terms of settlement submitted by counsel. Second, if the Court determines that the settlement is fair, the Court directs that notice pursuant to Rule 23(e) be given to the class members of a formal fairness hearing, at which arguments and evidence may be presented in support of and in opposition to the settlement.” McNamara , 214 F.R.D. at 426. To secure preliminary approval, the parties must show “that the court will likely be able to ... approve the proposal under Rule 23(e)(2)” and “certify the class for purposes of judgment on the proposal.” F ED . R. C IV . P. 23(e)(1)(B).
Kostka v. Dickey’s Barbecue Rests., Inc.
, Nos. 3:20-cv-03424-K, 3:20-cv-03603-K, 3:21-
*4
cv-00137-K, 3:21-cv-00769-K, 3:21-cv-01962-K, 3:21-cv-01963-K,
Analysis Plaintiffs identified by name and who signed the settlement agreement, see Dkt. No. 64-1, ¶ 52; id. at 42, are the proposed representatives, see id. , ¶ 31, for a settlement class and California settlement subclass defined as:
Settlement Class: All persons in the United States who were sent notification from Defendants that their Private Information was potentially compromised as a result of the Data Incident.
California Settlement Subclass: Those members of the Settlement Class residing in California on April 18, 2023 – April 23, 2023.
Id. , ¶¶ 19, 64.
“Excluded from the Settlement Class are all persons who are governing board members of Defendants, governmental entities, the Court, Court’s immediate family, and Court staff.” Id. , ¶ 64 (cleaned up).
As summarized in the Motion,
[t]he Settlement’s $13,750,000.00 all-cash non-reversionary common *5 Settlement Fund will be the total sum paid to settle this Action and will be used to pay: (1) all Settlement Class Member Benefits; (2) all Settlement Administration Costs; (3) any Service Awards to Class Representatives; and (4) any attorneys’ fees and costs awarded to Class Counsel. Settlement Class Members may elect one of two types of Cash Payments and Medical Monitoring. California Settlement Subclass members may also elect a California Statutory Payment. Additionally, WebTPA has agreed to valuable injunctive relief in the form of additional security measures.
Dkt. No. 64 at 11-12; see also id. at 12-15 (setting out further details).
And the evidence before the Court, a joint declaration of class counsel in
support of the Motion [Dkt. No. 64-2] shows by a preponderance of the evidence that
the Court is likely to certify the class at the final approval stage because the proposed
class meets the four Rule 23(a) prerequisites – numerosity, commonality, typicality,
and adequacy – and where, as here, Plaintiffs “seek monetary damages, the proposed
class [satisfies] Rule 23(b)(3), which requires that ‘questions of law or fact common to
class members predominate over any questions affecting only individual members,
and that a class action is superior to other available methods for fairly and efficiently
adjudicating the controversy.’”
Kostka
,
Numerosity is satisfied because there are approximately 3,000,000 Settlement Class members.
Commonality is met because numerous common issues exist, including: whether Defendants failed to adequately safeguard the Settlement Class’ Private Information; whether WebTPA failed to implement and maintain reasonable security procedures and practices appropriate to the nature and scope of that information; whether WebTPA’s data security systems prior to and during the Data Incident complied with applicable data security laws and regulations; and whether Defendants’ conduct was negligent. These common questions, and others alleged in the Complaint, are central to the causes of action, will generate common answers, and can be addressed classwide. Ultimately, the claims turn on whether Defendant’s security *6 environment was adequate to protect the Settlement Class’ Private Information. That inquiry can be fairly resolved because it revolves around evidence that does not vary between members – at least for purposes of settlement – for all Settlement Class members at once. Indeed, the Settlement Class members each had their Private Information impacted in the Data Incident.
Typicality is satisfied because Plaintiffs’ interests are aligned with the Settlement Class. Plaintiffs’ and Settlement Class members’ claims all stem from the Data Incident and the cybersecurity protocols Defendants had (or did not have) in place to protect their Private Information. All have Article III standing. They all received a notice letter informing them their Private Information may have been compromised as a result of the Data Incident and were therefore impacted by the same purportedly inadequate data security that allegedly harmed the rest of the Settlement Class. Plaintiffs’ respective interests are co-extensive and do not conflict with the interests of the Settlement Class. Plaintiffs each have the same interest in the Settlement, and the absent Settlement Class members have no diverging interests.
Plaintiffs are adequate representatives of the Settlement Class because they have cooperated with Class Counsel and assisted in providing important information in the preparation of the complaints filed in this Action. Plaintiffs’ interests are aligned with the Settlement Class as they seek relief for injuries arising out of the same Data Incident to their Private Information. The Settlement will make all of them eligible for the same Settlement Class Member Benefits. Moreover, the Class Representatives have ably represented the Settlement Class, maintaining contact with Class Counsel, reviewing and approving pleadings, assisting in the investigation of the Action, remaining available for consultation throughout mediation, reviewing the Settlement documents, and answering Class Counsel’s questions.
In this case, key predominating questions are whether Defendants had a duty to exercise reasonable care in safeguarding, securing, and protecting the Private Information and whether Defendants breached that duty. The common issues of fact and law predominate, as there are no individual issues precluding class treatment.
Class treatment is the best method of adjudication, as seen in the fact that every Settlement Class member shall receive relief without the need for numerous (and duplicative) individual cases. Each members claims would be for a relatively small dollar amount such that they would not be interested in filing separate actions. The resolution of approximately three million claims in one class action is far superior to litigating individual lawsuits. Class certification – and class resolution *7 – guarantee an increase in judicial efficiency and conservation of resources over the alternative of individually litigating so many individual cases arising out of the Data Incident. Class Counsel is unaware of any other litigation than the Related Actions.
Dkt. No. 64-2, ¶¶ 31-36.
The Court should therefore preliminarily certify the proposed class for settlement purposes and move to the preliminary fairness evaluation.
At the preliminary approval stage, the Court must ascertain
whether the proposed settlement is likely to be approved as fair,
reasonable, and adequate, and whether the Settlement Class is likely to
be certified for settlement purposes at the final approval stage. F ED . R. C IV . P. 23(e)(1)(B). Traditionally, courts in the Fifth Circuit have
considered the following six factors, from
Reed v. General Motors Corp.
,
in making this determination: (1) the existence of fraud or collusion; (2)
the complexity, expense, and likely duration of the litigation; (3) the
stage of the proceedings; (4) plaintiffs’ probability of success on the
merits; (5) the range of possible recovery; and (6) the opinions of class
counsel, class representatives, and absent class members.
In addition, Rule 23(e)(2), as amended in 2018, provides that, in determining whether a settlement is fair, reasonable, and adequate at the final approval stage, a Court must consider whether:
(A) the class representatives and class counsel have adequately represented the class;
(B) the proposal was negotiated at arm's length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims;
(iii) the terms of any proposed award of attorney’s fees, including timing of payment; and
(iv) any agreement required to be identified under Rule 23(e)(3); and
(D) the proposal treats class members equitably relative to each other.
F ED . R. C IV . P. 23(e)(2). These Rule 23(e)(2) requirements do not “displace any factor” sanctioned by the Fifth Circuit. Id. advisory committee’s note to 2018 amendments. Indeed, the Rule 23(e)(2) requirements overlap significantly with the Reed factors. Accordingly, the Court will consider the Rule 23 requirements as informed by the *8 Reed factors.
Kostka
,
Evidence before the Court also supports the Court’s preliminarily approving the proposed settlement because it meets the Rule 23 requirements as informed by the Reed factors and will likely be found fair at the final approval stage:
Class Counsel has not been paid for their extensive efforts or reimbursed for litigation costs. Class Counsel shall apply to the Court for an award of attorneys’ fees of up to one third of the Settlement Fund, plus reimbursement of costs, which shall be paid from the Settlement Fund. Class Counsel will formally request attorneys’ fees and costs through an application that will be filed no less than 45 days before the original date set for the Final Approval Hearing with the Motion for Final Approval. The Notices advise the Settlement Class of these intended requests and further information on how to object.
The Settlement is not contingent on approval of the requests for attorneys’ fees and costs or Service Awards, and if the Court grants amounts other than what was requested, the remaining provisions of the Agreement shall remain in force.
With the Court’s approval, the Parties agree to use Kroll Settlement Administration LLC for purposes of disseminating Notice and administering the Settlement. Kroll is a well-respected and reputable third-party administrator that was mutually selected by the Parties and has significant experience with data breach class action settlements. Kroll is highly qualified to manage the entire settlement administration process. Class Counsel will oversee Kroll.
Class Counsel are confident the Settlement warrants the Court’s Preliminary Approval. Its terms are not only fair, reasonable, adequate, and in the best interests of the Settlement Class, but also are an extremely favorable result with substantial benefits. The Agreement provides significant and concrete benefits to approximately 3,000,000 individuals.
Class Counsel and Defendant’s Counsel have fully evaluated the strengths, weaknesses, and equities of the Parties’ respective positions and believe the proposed settlement fairly resolves their respective differences.
The risks, expense, complexity, and likely duration of further litigation support preliminary approval of the Settlement. Any settlement requires the parties to balance the merits of the claims and defenses asserted against the attendant risks of continued litigation and delay.
Although Plaintiffs are confident in the merits of their claims, the litigation risks cannot be disregarded. Besides the potential that either side will lose at trial, Plaintiffs anticipate substantial additional costs if litigation continues, including experts. Plaintiffs would need to defeat a motion to dismiss, counter a later motion for summary judgement, and both gain and maintain certification of the Settlement Class, with a near inevitable interlocutory appeal attempt. Class Counsel are also pragmatic and understand the legal uncertainties associated with continued litigation, which would be lengthy and expensive. Accordingly, a class action is the superior method of adjudicating this case.
Data breach litigation is often difficult and complex. Recovery, if any, by any means other than settlement would require additional years of litigation and possibly an appeal. Without the Settlement, the Parties faced the possibility of litigating this Action through the completion of fact discovery, class certification, expert discovery, summary judgment, trial, and appeals, which would be complex, time-consuming, and expensive. Continued litigation could impede the successful prosecution of these claims at trial and in an eventual appeal, resulting in zero benefit to the Settlement Class. Further, since the Court had not yet certified a class at the time the Agreement was executed, it is unclear whether certification would have been granted. Briefing class certification would have required the Parties to expend significant resources.
Although the Parties entered into a Settlement relatively early in litigation, the Parties had sufficient visibility into the strengths and weaknesses of their respective cases. Further, the Settlement negotiations were hard-fought, and the Parties expended significant time and energy on this Action.
Under the circumstances, the Settlement represents a highly favorable compromise that balances the merits of Plaintiffs’ claims and the likelihood of succeeding at trial and on appeal with the attendant risks. The inherent uncertainty in litigation presents a risk to Plaintiffs of expending time and money on this case with the possibility of no recovery at all for the Settlement Class.
Dkt. No. 64-2, ¶¶ 37-46;
see also Kostka
,
And, so, the Court should grant the Motion in full.
Recommendation The Court should deny the motion for hearing [Dkt. No. 66] and grant Plaintiffs’ Unopposed Motion for Preliminary Approval of Class Action Settlement [Dkt. No. 64]. Specifically, the Court should enter a preliminary approval order substantially the same as the proposed order attached to the Motion [Dkt. No. 64-3] and thereby preliminarily certify the proposed class; preliminarily approve the proposed settlement as fair; appoint Plaintiffs identified in the settlement agreement as class representatives and their counsel, Jeff Ostrow and Gary Klinger, as class counsel; appoint Kroll Settlement Administration LLC as settlement administrator; approve the proposed notice plan; and set a final fairness hearing.
A copy of these findings, conclusions, and recommendation shall be served on
all parties in the manner provided by law. Any party who objects to any part of these
findings, conclusions, and recommendation must file specific written objections
within 14 days after being served with a copy.
See
28 U.S.C. § 636(b)(1); F ED . R. C IV . P. 72(b). In order to be specific, an objection must identify the specific finding or
recommendation to which objection is made, state the basis for the objection, and
specify the place in the magistrate judge’s findings, conclusions, and recommendation
where the disputed determination is found. An objection that merely incorporates by
reference or refers to the briefing before the magistrate judge is not specific. Failure
to file specific written objections will bar the aggrieved party from appealing the
*11
factual findings and legal conclusions of the magistrate judge that are accepted or
adopted by the district court, except upon grounds of plain error.
See Douglass v.
United Servs. Auto. Ass’n
,
DATED: June 5, 2025
_________________________________________ DAVID L. HORAN UNITED STATES MAGISTRATE JUDGE