UNITED STATES DISTRICT COURT                            
                DISTRICT OF MINNESOTA                                


James Morrison, on behalf of himself and all     File No. 23-cv-415 (ECT/ECW) 
others similarly situated,                                                

     Plaintiff,                                                      

v.                                       OPINION AND ORDER                

Entrust Corporation, and Entrust MN                                       
Corporation,                                                              

     Defendants.                                                     
________________________________________________________________________  
Brittany N. Resch and Raina Borrelli, Strauss Borrelli PLLC, Chicago, IL, for Plaintiff 
James Morrison.                                                           

Leslie Kostyshak and Neil K. Gilman, Hunton Andrews Kurth LLP, Washington, D.C., 
and Robert E. Cattanach and Roxanna Gonzalez, Dorsey & Whitney LLP, Minneapolis, 
MN, for Defendants Entrust Corporation and Entrust MN Corporation.        


Plaintiff James Morrison has filed an Unopposed Motion for Final Approval of 
Class Action Settlement, ECF No. 46, and an Unopposed Motion for Award of Attorneys’ 
Fees, Litigation Costs, and Service Awards, ECF No. 39.  As required by Federal Rule of 
Civil Procedure 23(e)(2), a hearing on these motions was held April 4, 2024. 
The motions will be granted.  Plaintiff’s submissions and other materials in the case 
file establish: (1) that class certification is appropriate under Rules 23(a) and 23(b)(3); (2) 
that the proposed settlement is fair, reasonable, and adequate under Rule 23(e)(2); and (3) 
that the requested attorneys’ fees and class-representative payment are reasonable. 
                           I                                         
        Relevant Background Facts and Procedural History             
This case concerns a data security breach.  The Complaint alleges several basic facts 

regarding the breach.  Entrust1 is a cybersecurity vendor providing services including 
securing transactions, identities, and data to various businesses and government entities.  
Compl. ¶ 1.  Plaintiff and members of the conditionally certified class were Entrust 
employees who were required to provide—and provided—private information to Entrust 
to receive employment and compensation.  Id. ¶¶ 20, 128–31.  On June 18, 2022, Entrust 

discovered it had been subjected to a ransomware attack that targeted Entrust’s back-office 
system; Entrust subsequently determined that an unauthorized criminal third party had 
accessed Entrust’s systems and exfiltrated certain employee data.  Id. ¶¶ 36, 38.  A 
ransomware gang claimed responsibility for the cyberattack and released information from 
the breach to a data leak page in August 2022.  Id. ¶ 37.  Entrust began notifying its clients 

of the Data Incident in December 2022.  Id. ¶ 39.                         
In this case, Plaintiff’s core allegation is that Entrust failed to adequately safeguard 
electronically stored private information in connection with the data security incident 
announced by Entrust in December 2022, and Plaintiff brings five claims: negligence; 
negligence  per  se;  declaratory  judgment;  breach  of  implied  contract;  and  unjust 

enrichment.  See id. ¶¶ 95–150.  Plaintiff sought an award of actual, compensatory, and 
statutory damages as well as attorneys’ fees and costs, and any such further relief as may 

1    Plaintiff refers to Defendants Entrust Corporation and Entrust MN Corporation 
collectively as “Entrust,” and that convention will be followed here.     
be deemed just and proper on his own behalf and on behalf of a proposed class.  See id. at 
34–38.  Plaintiff alleged the presence of subject-matter jurisdiction under the Class Action 
Fairness Act, 

(d)(2).  

.                          

No doubt Defendants dispute these allegations and claims, certainly to the extent 
they might be construed to generate liability or damages.2  On April 17, 2023, Defendants 
filed a Rule 12(b)(6) motion to dismiss Plaintiff’s Complaint.  ECF No. 15.  In support of 
this motion, Defendants argued, among other things, that Plaintiff had not alleged facts 
plausibly showing that he suffered damages, an essential element of his negligence and 

breach-of-contract claims.  ECF No. 18 at 6–10.  Defendants argued that Plaintiff also had 
failed to allege facts showing Defendants breached a duty for purposes of his negligence 
claim.  

 at 10–11.  Defendants argued that the federal statutes on which Plaintiff 
grounded his negligence per se claim provided no legal basis for the claim.  

 at 11–14.  
And Defendants challenged the factual and legal bases underlying Plaintiff’s implied-

contract and unjust-enrichment claims.  

 at 14–19.  Plaintiff responded to Defendant’s 
Rule 12(b)(6) motion in an opposition brief filed May 19, 2023.  ECF No. 20.  Soon after 
Plaintiff  filed  his  opposition  brief—on  June  1,  2023—the  parties  participated  in  a 
mediation and reached agreement on material settlement terms.  ECF No. 21 ¶ 5.  The 
parties evidently reached agreement on all settlement terms on June 7.  

. 




2    The parties have made clear that the proposed settlement does not constitute an 
admission of liability by Defendants.  To be clear, the Court notes expressly that, as part 
of this order, it does not find liability or wrongdoing by Defendants.    
On November 30, 2023, District Judge Wilhelmina M. Wright entered an order 
granting preliminary approval of the proposed class action settlement.  ECF No. 35.  In this 
preliminary approval order, Judge Wright: (a) conditionally certified this matter as a class 

action, including defining the class and class claims, 

; (b) appointed Plaintiff as the 
class representative and appointed Raina Borrelli, then of the law firm Turke & Strauss 
LLP, as class counsel, 

; (c) preliminarily approved the settlement agreement, 

; (d) approved the form and manner of notice to the settlement class, 

; (e) set 
deadlines for opt-outs and objections, 

; (f) approved and appointed the settlement 

administrator, 

; and (g) set the date for the final fairness hearing, 

.  
On January 12, 2024, pursuant to the notice requirements set forth in the settlement 
agreement and in the November 30 preliminary approval order, the conditionally certified 
settlement class was notified of the terms of the proposed settlement agreement, of the right 
of settlement class members to opt-out, and the right of settlement class members to object 

to the settlement agreement and to be heard at the final fairness hearing.  ECF No. 49 ¶¶ 7–
8; ECF No. 49-1.                                                          
On April 4, 2024, a final fairness hearing was held to determine, among other 
matters:  (1)  whether  the  conditionally  certified  settlement  class  should  be  certified; 
(2) whether the terms and conditions of the settlement agreement are fair, reasonable, and 

adequate  for  the  release  of  the  claims  contemplated  by  the  settlement  agreement; 
(3) whether the requested attorneys’ fees and class-representative payment are reasonable; 
and (4) whether judgment should be entered dismissing this action with prejudice.  ECF 
No. 55.  Prior to the final fairness hearing, a declaration of compliance with the provisions 
of the settlement agreement and preliminary approval order relating to notice was filed 
with the Court.  ECF No. 49.  The record establishes that settlement class members were 
properly notified of their right to appear at the final fairness hearing in support of or in 

opposition to the proposed settlement agreement, the award of attorneys’ fees, costs, and 
expenses to class counsel, and the payment of a service award to the class representative.  
As of the deadline for objections, no settlement class member had filed an objection. 
“The threshold issue is whether the settlement class satisfies the requirements of 
Federal Rule of Civil Procedure 23(a) and at least one prong of Rule 23(b).  Upon 

determining that the class satisfies Rule 23, the Court will then analyze the Settlement 
itself, as well as any relevant objections.  Finally, the Court will address the award of 
payments  to  class  representatives  and  attorneys’  fees.”    In  re  Uponor,  Inc.,  F1807 
Plumbing Fittings Prod. Liab. Litig., No. 11-MD-2247 (ADM/JJK), 

, at 
*3 (D. Minn. June 29, 2012), aff’d, 

 (8th Cir. 2013).        

                           II                                        
                    Class Certification                              
As our Eighth Circuit Court of Appeals has explained:                
     A district court may not certify a class until it “is satisfied, after 
     a  rigorous  analysis,”  that  Rule  23(a)’s  certification     
     prerequisites are met.  Wal-Mart Stores, Inc. v. Dukes, 

(2011) (quoting Gen. Tel. Co. of Sw. v. Falcon, 

  (1982))  (internal  quotation  marks  omitted).  
     Consistent with the Supreme Court’s premise that “actual, not   
     presumed,  conformance  with  Rule  23(a)  remains  . . .       
     indispensable,”  Falcon,  

,  after  initial   
     certification, the duty remains with the district court to assure 
     that  the  class  continues  to  be  certifiable  throughout  the 
     litigation, Petrovic, 200 F.3d at 1145.  See also Barney v.     
     Holzer Clinic, Ltd., 

 (6th Cir. 1997) (“The  
     district court’s duty to assay whether the named plaintiffs are 
     adequately representing the broader class does not end with the 
     initial certification . . . .”). . . .                          

     Though  the  Supreme  Court  has  not  articulated  what,       
     specifically,  a  “rigorous  analysis”  of  class  certification 
     prerequisites entails, at a minimum the rule requires a district 
     court to state its reasons for certification in terms specific  
     enough for meaningful appellate review.  “[S]omething more      
     than mere repetition of [Rule 23(a)’s] language [is required];  
     there  must  be  an  adequate  statement  of  the  basic  facts  to 
     indicate  that  each  requirement  of  the  rule  is  fulfilled.”  
     Pipefitters Local 636 Ins. Fund v. Blue Cross Blue Shield of    
     Mich., 

 (6th Cir. 2011) (internal quotation    
     marks omitted) (alteration omitted); accord Vizena v. Union     
     Pac. R.R. Co., 

 (5th Cir. 2004) (per curiam)   
     (“[W]hen certifying a class a district court must detail with   
     sufficient specificity how the plaintiff has met the requirements 
     of Rule 23.”).                                                  

In re Target Corp. Customer Data Sec. Breach Litig., 

 (8th Cir. 2017); 
see Kruger v. Lely N. Am., Inc., No. 20-cv-629 (KMM/DTS), 

, at *2 (D. 
Minn. Sept. 1, 2023) (“To certify a Settlement Class for the purpose of settlement the Court 
must conclude that the four prerequisites of Rule 23(a) and at least one of the provisions 
of Rule 23(b) are satisfied.” (citing Comcast Corp. v. Behrend, 

 (2013))); 
see also In re Pork Antitrust Litig., No. 18-cv-1776 (JRT/JFD), 

, at *3 
(D. Minn. Sept. 14, 2022) (“Before granting final approval to a class settlement, the Court 
must ensure that the class proposed by the settlement meets the Rule 23 requirements to 
proceed as a class.”).                                                    
Here, the settlement class is defined as: “All individuals known to reside in the U.S. 
whose Private Information was potentially compromised as a result of the Data Incident 
discovered by Entrust Corp. and/or Entrust MN Corp. on or about June 18, 2022.”  ECF 
No. 35 at 3.  Excluded from the class are the judges presiding over this litigation, members 
of their direct families, and settlement class members who opt out.  

  A close review of 

the materials submitted in support of the unopposed motions and other relevant materials 
in the case file shows that this class satisfies the prerequisites of Rule 23(a) and Rule 
23(b)(3), making certification appropriate.                               
(1) Numerosity.  A class cannot be certified unless it “is so numerous that joinder of 
all members is impracticable.”  Fed. R. Civ. P. 23(a)(1).  “No specific rules govern the 

required size of a class, and what constitutes impracticability depends upon the facts of 
each case.”  Portz v. St. Cloud State Univ., 

 (D. Minn. 2018) 
(cleaned up); see also Paxton v. Union Nat’l Bank, 

, 559 (8th Cir. 1982) (“No 
arbitrary rules regarding the necessary size of classes have been established.”).  “The most 
obvious factor, of course, is the number of potential class members,” and “[o]ther relevant 

factors include the nature of the action, the size of individual claims, the inconvenience of 
trying individual suits, and any other factor that sheds light on the practicability of joining 
all putative class members.”  Alberts v. Nash Finch Co., 

 (D. Minn. 
2007) (citing Paxton, 688 F.2d at 559–60); see also Portz, 

 
(“Practicality of joinder depends on such factors as the size of the class, the ease of 

identifying its members and determining their addresses, the facility of making service on 
them if joined, their geographic dispersion and whether the size of the individual claims is 
so small as to inhibit individuals from separately pursuing their own claims.”) (cleaned up).   
Courts in the Eighth Circuit have routinely found classes exceeding 40 members meet the 
numerosity  requirement  of  Rule  23(a)(1).    See  Murphy  v.  Piper,  No.  16-cv-2623 
(DWF/BRT), 

, at *3 (D. Minn. Sept. 29, 2017) (“In general, . . . ‘a class 

of 40 or more members raises a presumption of impracticability of joinder based on 
numbers alone.’”) (quoting William B. Rubenstein, Newberg on Class Actions § 3.12 (5th 
ed. 2017 Update).  Here, there are 4,172 potential class members.  ECF No. 49 ¶ 4.  
Potential class members reside in forty-seven states, the District of Columbia, and the 
territory of Puerto Rico.  ECF No. 34 ¶ 4.  That large number together with their geographic 

dispersion meet Rule 23(a)’s numerosity requirement.                      
(2) Commonality.  The second prerequisite for class certification is that “there are 
questions of law or fact common to the class.”  Fed. R. Civ. P. 23(a)(2).  “Commonality 
requires a showing that class members ‘have suffered the same injury.’”  Powers v. Credit 
Mgmt. Servs., 

 (8th Cir. 2015) (quoting Gen. Tel. Co. v. Falcon, 

 (1982)).  To satisfy commonality, the class members’ “claims must depend upon 
a  common  contention”  that  is  “capable  of  classwide  resolution—which  means  that 
determination of its truth or falsity will resolve an issue that is central to the validity of 
each one of the claims in one stroke.”  Wal-Mart Stores, Inc. v. Dukes, 

 
(2011).  The Complaint identifies several questions of law and fact centered on Defendant’s 

alleged conduct: (a) “[w]hether Entrust had a duty to use reasonable care in safeguarding 
Plaintiff and the Class’s Sensitive Information”; (b) “[w]hether Entrust failed to implement 
and maintain reasonable security procedures and practices appropriate to the nature and 
scope of the information compromised in the Data Breach”; (c) “[w]hether Entrust was 
negligent  in  maintaining,  protecting,  and  securing  Plaintiff  and  the  Class’s  Sensitive 
Information”; (d) “[w]hether Entrust breached contract promises to safeguard Plaintiff and 
the Class’s Sensitive Information”; (e) “[w]hether Entrust took reasonable measures to 

determine the extent of the Data Breach after discovering it”; (f) “[w]hether Entrust’s 
Breach Notice was reasonable”; (g) “[w]hether the Data Breach caused Plaintiff and the 
Class’s injuries”; and (h) “[w]hat the proper damages measure is.”  Compl. ¶¶ 94(a)–(h).  
At this point, at least, no one disputes that these questions are reasonably susceptible to 
class-wide resolution or that they satisfy Rule 23(a)(2)’s commonality requirement. 

(3)  Typicality.    Rule  23(a)(3)  requires  that  “the  claims  or  defenses  of  the 
representative parties are typical of the claims or defenses of the class.”  The Rule “requires 
a demonstration that there are other members of the class who have the same or similar 
grievances as the plaintiff.”  Paxton, 688 F.2d at 562 (quoting Donaldson v. Pillsbury Co., 

 (8th Cir. 1977)).  Typicality is “fairly easily met so long as other class 

members have claims similar to the named plaintiff.”  DeBoer v. Mellon Mortg. Co., 

, 1174 (8th Cir. 1995).  “Factual variations in the individual claims will not 
normally preclude class certification if the claim arises from the same event or course of 
conduct as the class claims, and gives rise to the same legal or remedial theory.”  Alpern v. 
UtiliCorp United, Inc., 

 (8th Cir. 1996) (citing Donaldson, 

).  Here, Plaintiff’s grievances reflect typical injuries associated with a data breach and 
the disclosure of sensitive personal information.  See Compl. ¶¶ 80–89.  There is no 
suggestion that these alleged injuries are atypical or different in some material respect from 
injuries claimed by absent class members.                                 
(4) Adequacy.  A class representative must “fairly and adequately protect the 
interests of the class.”  Fed. R. Civ. P. 23(a)(4).  “The party moving for certification bears 
the burden to prove that [he] will adequately represent the class,” and “[t]he district court 

must decide whether Rule 23(a)(4) is satisfied through balancing the convenience of 
maintaining a class action and the need to guarantee adequate representation to the class 
members.”  Rattray v. Woodbury Cnty., 

 (8th Cir. 2010) (cleaned up).  
To  demonstrate  adequacy  of  representation,  a  plaintiff  must  show  that  “(1)  the 
representative and its attorneys are able and willing to prosecute the action competently 

and vigorously; and (2) the representative’s interests are sufficiently similar to those of the 
class that it is unlikely that their goals and viewpoints will diverge.”  City of Farmington 
Hills Emps. Ret. Sys. v. Wells Fargo Bank, N.A., 

 (D. Minn. 2012).  
“This inquiry requires the Court to evaluate the adequacy of both the proposed class 
representatives and the proposed class counsel.”  Taqueria El Primo LLC v. Ill. Farmers 

Ins. Co., 

, 993 (D. Minn. 2021).  Here, Mr. Morrison is an adequate 
class representative.  He is a former Entrust employee and a data breach victim.  ECF No. 
30  ¶  2.    He  has  “assisted  in  the  investigation  of  this  case,  reviewed  and  approved 
pleadings,” remained in contact with class counsel, and participated actively in answering 
counsel’s questions.  

.  No information suggests Mr. Morrison might have any 

conflicts that would render him inadequate to represent the class.  Class counsel, who are 
experienced in class-action prosecution, are no doubt adequate under Rule 24(a)(4).  See 
ECF No. 30 ¶¶ 21–23; ECF No. 30-1.                                        
(5) Predominance and superiority.  To obtain certification under Rule 23(b)(3), 
Plaintiff must demonstrate that (1) “questions of law or fact common to class members 
predominate over any questions affecting only individual members and [(2)] that a class 

action is superior to other available methods for fairly and efficiently adjudicating the 
controversy.”  Fed. R. Civ. P. 23(b)(3).  The “pertinent” matters to these inquiries include:  
     (A) the class members’ interests in individually controlling the 
     prosecution or defense of separate actions;                     
     (B)  the  extent  and  nature  of  any  litigation  concerning  the 
     controversy already begun by or against class members;          
     (C)  the  desirability  or  undesirability  of  concentrating  the 
     litigation of the claims in the particular forum; and           
     (D) the likely difficulties in managing a class action.         

    “The  Rule  23(b)(3)  predominance  inquiry  tests  whether  proposed  classes  are 
sufficiently  cohesive  to  warrant  adjudication  by  representation.”    Amchem  Prods.  v. 
Windsor, 

 (citing Charles Alan Wright, Arthur R. Miller, & Mary Kay 
Kane, Federal Practice and Procedure § 1777, at 518–19 (2d ed. 1986)).  By their nature, 
data  breach  claims  ordinarily  involve  many  plaintiffs  who  allege  to  have  suffered 
equivalent injuries resulting from the breach.  And given the size of this class, and that 
asserted  liability  arises  from  a  common  course  of  Entrust’s  alleged  conduct,  class 

resolution is superior to individual litigation.  See Savidge v. Pharm-Save, Inc., --- F. Supp. 
3d ---, No. 3:17-CV-186-CHB, 

, at *27–32 (W.D. Ky. Mar. 29, 2024).  
For all these reasons, then, certification of the settlement class is appropriate. 
                          III                                        
                    Settlement Approval                              
“A district court may approve a class action settlement only after determining that 

it is ‘fair, reasonable, and adequate.’”  In re Uponor, 

 (quoting Fed. R. 
Civ. P. 23(e)(2)).  In assessing whether the proposed settlement is “fair, reasonable, and 
adequate,” the Court considers: “(1) the merits of the plaintiff’s case weighed against the 
terms of the settlement; (2) the defendant’s financial condition; (3) the complexity and 
expense of further litigation, and (4) the amount of opposition to the settlement.”  Marshall 

v. Nat’l Football League, 

 (8th Cir. 2015) (citing In re Uponor, 

).  The first factor is the most important consideration.  

     
The  class  action  settlement  here  includes  several  key  terms.    It  establishes  a 
$375,000 non-reversionary settlement fund, which will be used to pay for benefits to the 
settlement class, notice and administration costs, Plaintiff’s service award, and attorneys’ 

fees and costs.  The settlement provides for two categories of relief for class members: 
(1) reimbursement for extraordinary losses up to $5,000; or (2) a $50 pro rata cash payment 
as an alternative to reimbursement for extraordinary losses.  ECF No. 29-1 ¶ 64.  Class 
members who submit a valid claim will receive a pro rata share of the net settlement fund 
after all settlement administrative expenses (up to three times their initial claim).  Id. ¶ 65.  

The settlement fund also pays the administration and notice expenses, attorneys’ fees up to 
one-third of the total amount of the fund, or $125,000, expenses up to $10,000, and a Court-
approved service award for Mr. Morrison as the class representative of $3,000.  Id. ¶¶ 71, 
99, 101.  Class members who submitted a timely and valid claim will receive a pro rata 
share of the net settlement fund after all settlement administrative expenses have been paid.  
If no additional claims were filed after March 21, 2024, the administrator estimates that 
share to be $150 per claim.  ECF No. 49 ¶ 17.  Even if 790 additional, valid claims were 

filed electing the alternative cash payment, the administrator estimates that share to still be 
$50 per claim.  Id.  In addition to the settlement’s monetary value, Entrust agreed to provide 
class counsel with a confidential declaration outlining information security improvements 
it has undertaken.  ECF No. 29-1 ¶ 77.                                    
Several  considerations  show  that  this  settlement  is  fair  and  reasonable.    The 

settlement bears a reasonable relationship to the case’s merits.  Though the Complaint 
alleged clear and facially cogent factual bases and liability theories, Defendants’ Rule 
12(b)(6) motion identified tenable problems with the case’s merits.  The settlement terms 
strike a reasonable balance between these competing positions.  No doubt further litigation 
would have proven complex and expensive.  It seems reasonable to predict that the case by 

its  nature  would  have  been  heavy  on  electronic  discovery,  associated  nondispositive 
motion practice, and eventually more dispositive motion practice.  The settlement seems 
more reasonable when one considers it was reached in the case’s earliest stages.  That 
enabled the parties to forego substantial expense and it placed the benefits of the settlement 
in  the  hands  of  class  members  much  sooner.    There  has  been  no  opposition  to  the 

settlement.  As noted, the class has 4,172 members.  ECF No. 49 ¶ 4.  The claims 
administrator has sent individual email and mail notice to all but 108 class members.  Id. 
¶¶ 5–8, 13.  The deadline by which to opt out or object was March 12, 2024; fourteen class 
members timely requested exclusion from the settlement, and no class member objected.  
Id. ¶¶ 14, 15.  The process that led to the settlement involved an independent mediator and 
arm’s length negotiations, all but eliminating any possibility that the settlement was the 
product  of  collusion.    And  the  per-class-member  compensation  under  the  settlement 

compares favorably with settlements in like cases.  See ECF No. 48 at 10. 
                          IV                                         
               Attorneys’ Fees and Service Award                     
     “In a certified class action, the court may award reasonable    
     attorney’s fees and nontaxable costs that are authorized by law 
     or by the parties’ agreement.”  Fed. R. Civ. P. 23(h).  The     
     Supreme Court recognizes that “a litigant or a lawyer who       
     recovers a common fund for the benefit of persons other than    
     himself or his client is entitled to a reasonable attorney’s fee 
     from the fund as a whole.”  Boeing Co. v. Van Gemert, 

 (1980).  When calculating attorneys’ fees under   
     the common fund doctrine, “a reasonable fee is based on a       
     percentage  of  the  fund  bestowed  on  the  class.”    Blum  v. 
     Stenson, 

, 900 n.16 (1984).  “In the Eighth Circuit, 
     use of a percentage method of awarding attorney fees in a       
     common-fund  case  is  not  only  approved,  but  also  ‘well   
     established.’”  In re Xcel Energy, Inc., Sec., Derivative &     
     “ERISA” Litig., 

 (D. Minn. 2005)        
     (quoting Petrovic v. Amoco Oil Co., 

 (8th    
     Cir. 1999)); see also Khoday v. Symantec Corp., No. 11-CV-      
     180 (JRT/TNL), 

, at *8-9 (D. Minn. 2016),        
     aff’d sub nom. Caligiuri v. Symantec Corp., 

 (8th   
     Cir. 2017).                                                     

Kruger, 

, at *5.  Here, Plaintiff seeks an attorneys’ fees award of 33.3% 
of the $375,000 non-reversionary settlement fund, or $125,000.  Courts in the Eighth 
Circuit consider several factors depending on the case’s nature to evaluate a fee request’s 
reasonableness.  See In re Target Corp. Customer Data Sec. Breach Litig., 892 F.3d at 977 
& n.7 (citing Johnson v. Ga. Highway Express, Inc., 

, 719–20 (5th Cir. 1974)); 
see also In re Xcel Energy, Inc., Sec., Derivative & “ERISA” Litig., 

.  
Applying several of these factors here shows that Plaintiff’s fees request is reasonable. 
(1) As should be evident from the discussion approving the settlement, above, the 

benefit conferred on the class was substantial.  (2) Plaintiff’s counsel faced a significant 
risk in pursuing the case.  A review of Defendants’ motion to dismiss reveals several 
potentially dispositive issues faced by Plaintiff and his counsel.  (3) Data breach cases, by 
their nature, often raise difficult and often novel issues ranging from jurisdictional Article 
III standing problems to any number of merits-related questions.  This case is no exception.  

And Plaintiff’s counsel pursued the case independently; as far as the record reflects, they 
were  not  aided  by  a  government  investigation.    (4)  The  lawyers  in  the  case—both 
representing Plaintiff and Defendants—are skilled.  This conclusion is drawn safely from 
the lawyers’ advocacy in this case, but it also is drawn from the Court’s familiarity with 
the lawyers and their standing in the legal community.  (5) In light of the early stage at 

which the case settled and the fact that some additional fees will be incurred from this point 
forward, the requested fee compares reasonably with the lodestar computation of Plaintiff’s 
counsel’s fees.  See ECF No. 42 ¶¶ 27–31.  (6) The absence of objectors shows the class 
approves of the settlement and supports the requested fee award.  (7) The request equates 
to 33.33% of the settlement fund, an award within the typical range approved in the Eighth 

Circuit.  See Huyer v. Buckley, 

 (8th Cir. 2017) (noting that courts in the 
Eighth Circuit frequently award attorneys’ fees between 25–36% of the settlement fund); 
Caligiuri v. Symantec Corp., 

, 865–66 (8th Cir. 2017) (affirming 33% fee 
award); In re U.S. Bancorp Litig., 

 (8th Cir. 2002) (approving 36% fee 
award); Khoday, 

, at *17, report and recommendation adopted, 

 (D. Minn. Apr. 22, 2016) (awarding attorneys’ fees of one-third of the 
settlement fund); see also In re Xcel Energy, Inc., Sec., Derivative & “ERISA” Litig., 

 (collecting cases awarding attorneys’ fees of between 25–36%  of 
common fund).                                                             
The requests for $10,000 in expenses and a $3,000 service award for Mr. Morrison 
are also reasonable.  The requested expenses are considerably less than Plaintiff’s counsel 
have actually incurred, and the largest single expense was Plaintiff’s share of the mediation 

fee.  ECF No. 42 ¶ 34.  Mr. Morrison’s involvement in the case is worthy of the requested 
service award.  See ECF No. 43.                                           
Based on the foregoing, and all the files, records, and proceedings herein, IT IS 
HEREBY ORDERED that:                                                      
1.   Plaintiff’s Unopposed Motion for Final Approval of Class Action Settlement 

[Docket No. 46] is GRANTED;                                               
2.   Final certification of the Settlement Class is GRANTED;         
3.   Plaintiffs’  Unopposed  Motion  for  Award  of  Attorneys’  Fees,  Litigation 
Costs, and Service Awards [ECF No. 39] is GRANTED;                        
4.   Class counsel is awarded one-third of the Settlement Fund, or $125,000; 

5.   Class counsel is awarded $10,000 in reasonable expenses;        
6.   Class representative James Morrison is awarded a service award of $3,000 
for his service to the Settlement Class; and                              
7.   Final  approval  of  the  methods  and  forms  of  notice  provided  to  Class 
Members is GRANTED.                                                       
8.   The Court shall retain jurisdiction over the subject matter and the parties with 

respect to the interpretation and implementation of the Settlement Agreement for all 
purposes.                                                                 
       LET JUDGMENT BE ENTERED ACCORDINGLY.                          

Dated:  May 14, 2024          s/ Eric C. Tostrud                          
                         Eric C. Tostrud                             
                         United States District Court                

             UNITED STATES DISTRICT COURT                            
                DISTRICT OF MINNESOTA                                


James Morrison, on behalf of himself and all     File No. 23-cv-415 (ECT/ECW) 
others similarly situated,                                                

     Plaintiff,                                                      

v.                                       OPINION AND ORDER                

Entrust Corporation, and Entrust MN                                       
Corporation,                                                              

     Defendants.                                                     
________________________________________________________________________  
Brittany N. Resch and Raina Borrelli, Strauss Borrelli PLLC, Chicago, IL, for Plaintiff 
James Morrison.                                                           

Leslie Kostyshak and Neil K. Gilman, Hunton Andrews Kurth LLP, Washington, D.C., 
and Robert E. Cattanach and Roxanna Gonzalez, Dorsey & Whitney LLP, Minneapolis, 
MN, for Defendants Entrust Corporation and Entrust MN Corporation.        


Plaintiff James Morrison has filed an Unopposed Motion for Final Approval of 
Class Action Settlement, ECF No. 46, and an Unopposed Motion for Award of Attorneys’ 
Fees, Litigation Costs, and Service Awards, ECF No. 39.  As required by Federal Rule of 
Civil Procedure 23(e)(2), a hearing on these motions was held April 4, 2024. 
The motions will be granted.  Plaintiff’s submissions and other materials in the case 
file establish: (1) that class certification is appropriate under Rules 23(a) and 23(b)(3); (2) 
that the proposed settlement is fair, reasonable, and adequate under Rule 23(e)(2); and (3) 
that the requested attorneys’ fees and class-representative payment are reasonable. 
                           I                                         
        Relevant Background Facts and Procedural History             
This case concerns a data security breach.  The Complaint alleges several basic facts 

regarding the breach.  Entrust1 is a cybersecurity vendor providing services including 
securing transactions, identities, and data to various businesses and government entities.  
Compl. ¶ 1.  Plaintiff and members of the conditionally certified class were Entrust 
employees who were required to provide—and provided—private information to Entrust 
to receive employment and compensation.  Id. ¶¶ 20, 128–31.  On June 18, 2022, Entrust 

discovered it had been subjected to a ransomware attack that targeted Entrust’s back-office 
system; Entrust subsequently determined that an unauthorized criminal third party had 
accessed Entrust’s systems and exfiltrated certain employee data.  Id. ¶¶ 36, 38.  A 
ransomware gang claimed responsibility for the cyberattack and released information from 
the breach to a data leak page in August 2022.  Id. ¶ 37.  Entrust began notifying its clients 

of the Data Incident in December 2022.  Id. ¶ 39.                         
In this case, Plaintiff’s core allegation is that Entrust failed to adequately safeguard 
electronically stored private information in connection with the data security incident 
announced by Entrust in December 2022, and Plaintiff brings five claims: negligence; 
negligence  per  se;  declaratory  judgment;  breach  of  implied  contract;  and  unjust 

enrichment.  See id. ¶¶ 95–150.  Plaintiff sought an award of actual, compensatory, and 
statutory damages as well as attorneys’ fees and costs, and any such further relief as may 

1    Plaintiff refers to Defendants Entrust Corporation and Entrust MN Corporation 
collectively as “Entrust,” and that convention will be followed here.     
be deemed just and proper on his own behalf and on behalf of a proposed class.  See id. at 
34–38.  Plaintiff alleged the presence of subject-matter jurisdiction under the Class Action 
Fairness Act, 

(d)(2).  

.                          

No doubt Defendants dispute these allegations and claims, certainly to the extent 
they might be construed to generate liability or damages.2  On April 17, 2023, Defendants 
filed a Rule 12(b)(6) motion to dismiss Plaintiff’s Complaint.  ECF No. 15.  In support of 
this motion, Defendants argued, among other things, that Plaintiff had not alleged facts 
plausibly showing that he suffered damages, an essential element of his negligence and 

breach-of-contract claims.  ECF No. 18 at 6–10.  Defendants argued that Plaintiff also had 
failed to allege facts showing Defendants breached a duty for purposes of his negligence 
claim.  

 at 10–11.  Defendants argued that the federal statutes on which Plaintiff 
grounded his negligence per se claim provided no legal basis for the claim.  

 at 11–14.  
And Defendants challenged the factual and legal bases underlying Plaintiff’s implied-

contract and unjust-enrichment claims.  

 at 14–19.  Plaintiff responded to Defendant’s 
Rule 12(b)(6) motion in an opposition brief filed May 19, 2023.  ECF No. 20.  Soon after 
Plaintiff  filed  his  opposition  brief—on  June  1,  2023—the  parties  participated  in  a 
mediation and reached agreement on material settlement terms.  ECF No. 21 ¶ 5.  The 
parties evidently reached agreement on all settlement terms on June 7.  

. 




2    The parties have made clear that the proposed settlement does not constitute an 
admission of liability by Defendants.  To be clear, the Court notes expressly that, as part 
of this order, it does not find liability or wrongdoing by Defendants.    
On November 30, 2023, District Judge Wilhelmina M. Wright entered an order 
granting preliminary approval of the proposed class action settlement.  ECF No. 35.  In this 
preliminary approval order, Judge Wright: (a) conditionally certified this matter as a class 

action, including defining the class and class claims, 

; (b) appointed Plaintiff as the 
class representative and appointed Raina Borrelli, then of the law firm Turke & Strauss 
LLP, as class counsel, 

; (c) preliminarily approved the settlement agreement, 

; (d) approved the form and manner of notice to the settlement class, 

; (e) set 
deadlines for opt-outs and objections, 

; (f) approved and appointed the settlement 

administrator, 

; and (g) set the date for the final fairness hearing, 

.  
On January 12, 2024, pursuant to the notice requirements set forth in the settlement 
agreement and in the November 30 preliminary approval order, the conditionally certified 
settlement class was notified of the terms of the proposed settlement agreement, of the right 
of settlement class members to opt-out, and the right of settlement class members to object 

to the settlement agreement and to be heard at the final fairness hearing.  ECF No. 49 ¶¶ 7–
8; ECF No. 49-1.                                                          
On April 4, 2024, a final fairness hearing was held to determine, among other 
matters:  (1)  whether  the  conditionally  certified  settlement  class  should  be  certified; 
(2) whether the terms and conditions of the settlement agreement are fair, reasonable, and 

adequate  for  the  release  of  the  claims  contemplated  by  the  settlement  agreement; 
(3) whether the requested attorneys’ fees and class-representative payment are reasonable; 
and (4) whether judgment should be entered dismissing this action with prejudice.  ECF 
No. 55.  Prior to the final fairness hearing, a declaration of compliance with the provisions 
of the settlement agreement and preliminary approval order relating to notice was filed 
with the Court.  ECF No. 49.  The record establishes that settlement class members were 
properly notified of their right to appear at the final fairness hearing in support of or in 

opposition to the proposed settlement agreement, the award of attorneys’ fees, costs, and 
expenses to class counsel, and the payment of a service award to the class representative.  
As of the deadline for objections, no settlement class member had filed an objection. 
“The threshold issue is whether the settlement class satisfies the requirements of 
Federal Rule of Civil Procedure 23(a) and at least one prong of Rule 23(b).  Upon 

determining that the class satisfies Rule 23, the Court will then analyze the Settlement 
itself, as well as any relevant objections.  Finally, the Court will address the award of 
payments  to  class  representatives  and  attorneys’  fees.”    In  re  Uponor,  Inc.,  F1807 
Plumbing Fittings Prod. Liab. Litig., No. 11-MD-2247 (ADM/JJK), 

, at 
*3 (D. Minn. June 29, 2012), aff’d, 

 (8th Cir. 2013).        

                           II                                        
                    Class Certification                              
As our Eighth Circuit Court of Appeals has explained:                
     A district court may not certify a class until it “is satisfied, after 
     a  rigorous  analysis,”  that  Rule  23(a)’s  certification     
     prerequisites are met.  Wal-Mart Stores, Inc. v. Dukes, 

(2011) (quoting Gen. Tel. Co. of Sw. v. Falcon, 

  (1982))  (internal  quotation  marks  omitted).  
     Consistent with the Supreme Court’s premise that “actual, not   
     presumed,  conformance  with  Rule  23(a)  remains  . . .       
     indispensable,”  Falcon,  

,  after  initial   
     certification, the duty remains with the district court to assure 
     that  the  class  continues  to  be  certifiable  throughout  the 
     litigation, Petrovic, 200 F.3d at 1145.  See also Barney v.     
     Holzer Clinic, Ltd., 

 (6th Cir. 1997) (“The  
     district court’s duty to assay whether the named plaintiffs are 
     adequately representing the broader class does not end with the 
     initial certification . . . .”). . . .                          

     Though  the  Supreme  Court  has  not  articulated  what,       
     specifically,  a  “rigorous  analysis”  of  class  certification 
     prerequisites entails, at a minimum the rule requires a district 
     court to state its reasons for certification in terms specific  
     enough for meaningful appellate review.  “[S]omething more      
     than mere repetition of [Rule 23(a)’s] language [is required];  
     there  must  be  an  adequate  statement  of  the  basic  facts  to 
     indicate  that  each  requirement  of  the  rule  is  fulfilled.”  
     Pipefitters Local 636 Ins. Fund v. Blue Cross Blue Shield of    
     Mich., 

 (6th Cir. 2011) (internal quotation    
     marks omitted) (alteration omitted); accord Vizena v. Union     
     Pac. R.R. Co., 

 (5th Cir. 2004) (per curiam)   
     (“[W]hen certifying a class a district court must detail with   
     sufficient specificity how the plaintiff has met the requirements 
     of Rule 23.”).                                                  

In re Target Corp. Customer Data Sec. Breach Litig., 

 (8th Cir. 2017); 
see Kruger v. Lely N. Am., Inc., No. 20-cv-629 (KMM/DTS), 

, at *2 (D. 
Minn. Sept. 1, 2023) (“To certify a Settlement Class for the purpose of settlement the Court 
must conclude that the four prerequisites of Rule 23(a) and at least one of the provisions 
of Rule 23(b) are satisfied.” (citing Comcast Corp. v. Behrend, 

 (2013))); 
see also In re Pork Antitrust Litig., No. 18-cv-1776 (JRT/JFD), 

, at *3 
(D. Minn. Sept. 14, 2022) (“Before granting final approval to a class settlement, the Court 
must ensure that the class proposed by the settlement meets the Rule 23 requirements to 
proceed as a class.”).                                                    
Here, the settlement class is defined as: “All individuals known to reside in the U.S. 
whose Private Information was potentially compromised as a result of the Data Incident 
discovered by Entrust Corp. and/or Entrust MN Corp. on or about June 18, 2022.”  ECF 
No. 35 at 3.  Excluded from the class are the judges presiding over this litigation, members 
of their direct families, and settlement class members who opt out.  

  A close review of 

the materials submitted in support of the unopposed motions and other relevant materials 
in the case file shows that this class satisfies the prerequisites of Rule 23(a) and Rule 
23(b)(3), making certification appropriate.                               
(1) Numerosity.  A class cannot be certified unless it “is so numerous that joinder of 
all members is impracticable.”  Fed. R. Civ. P. 23(a)(1).  “No specific rules govern the 

required size of a class, and what constitutes impracticability depends upon the facts of 
each case.”  Portz v. St. Cloud State Univ., 

 (D. Minn. 2018) 
(cleaned up); see also Paxton v. Union Nat’l Bank, 

, 559 (8th Cir. 1982) (“No 
arbitrary rules regarding the necessary size of classes have been established.”).  “The most 
obvious factor, of course, is the number of potential class members,” and “[o]ther relevant 

factors include the nature of the action, the size of individual claims, the inconvenience of 
trying individual suits, and any other factor that sheds light on the practicability of joining 
all putative class members.”  Alberts v. Nash Finch Co., 

 (D. Minn. 
2007) (citing Paxton, 688 F.2d at 559–60); see also Portz, 

 
(“Practicality of joinder depends on such factors as the size of the class, the ease of 

identifying its members and determining their addresses, the facility of making service on 
them if joined, their geographic dispersion and whether the size of the individual claims is 
so small as to inhibit individuals from separately pursuing their own claims.”) (cleaned up).   
Courts in the Eighth Circuit have routinely found classes exceeding 40 members meet the 
numerosity  requirement  of  Rule  23(a)(1).    See  Murphy  v.  Piper,  No.  16-cv-2623 
(DWF/BRT), 

, at *3 (D. Minn. Sept. 29, 2017) (“In general, . . . ‘a class 

of 40 or more members raises a presumption of impracticability of joinder based on 
numbers alone.’”) (quoting William B. Rubenstein, Newberg on Class Actions § 3.12 (5th 
ed. 2017 Update).  Here, there are 4,172 potential class members.  ECF No. 49 ¶ 4.  
Potential class members reside in forty-seven states, the District of Columbia, and the 
territory of Puerto Rico.  ECF No. 34 ¶ 4.  That large number together with their geographic 

dispersion meet Rule 23(a)’s numerosity requirement.                      
(2) Commonality.  The second prerequisite for class certification is that “there are 
questions of law or fact common to the class.”  Fed. R. Civ. P. 23(a)(2).  “Commonality 
requires a showing that class members ‘have suffered the same injury.’”  Powers v. Credit 
Mgmt. Servs., 

 (8th Cir. 2015) (quoting Gen. Tel. Co. v. Falcon, 

 (1982)).  To satisfy commonality, the class members’ “claims must depend upon 
a  common  contention”  that  is  “capable  of  classwide  resolution—which  means  that 
determination of its truth or falsity will resolve an issue that is central to the validity of 
each one of the claims in one stroke.”  Wal-Mart Stores, Inc. v. Dukes, 

 
(2011).  The Complaint identifies several questions of law and fact centered on Defendant’s 

alleged conduct: (a) “[w]hether Entrust had a duty to use reasonable care in safeguarding 
Plaintiff and the Class’s Sensitive Information”; (b) “[w]hether Entrust failed to implement 
and maintain reasonable security procedures and practices appropriate to the nature and 
scope of the information compromised in the Data Breach”; (c) “[w]hether Entrust was 
negligent  in  maintaining,  protecting,  and  securing  Plaintiff  and  the  Class’s  Sensitive 
Information”; (d) “[w]hether Entrust breached contract promises to safeguard Plaintiff and 
the Class’s Sensitive Information”; (e) “[w]hether Entrust took reasonable measures to 

determine the extent of the Data Breach after discovering it”; (f) “[w]hether Entrust’s 
Breach Notice was reasonable”; (g) “[w]hether the Data Breach caused Plaintiff and the 
Class’s injuries”; and (h) “[w]hat the proper damages measure is.”  Compl. ¶¶ 94(a)–(h).  
At this point, at least, no one disputes that these questions are reasonably susceptible to 
class-wide resolution or that they satisfy Rule 23(a)(2)’s commonality requirement. 

(3)  Typicality.    Rule  23(a)(3)  requires  that  “the  claims  or  defenses  of  the 
representative parties are typical of the claims or defenses of the class.”  The Rule “requires 
a demonstration that there are other members of the class who have the same or similar 
grievances as the plaintiff.”  Paxton, 688 F.2d at 562 (quoting Donaldson v. Pillsbury Co., 

 (8th Cir. 1977)).  Typicality is “fairly easily met so long as other class 

members have claims similar to the named plaintiff.”  DeBoer v. Mellon Mortg. Co., 

, 1174 (8th Cir. 1995).  “Factual variations in the individual claims will not 
normally preclude class certification if the claim arises from the same event or course of 
conduct as the class claims, and gives rise to the same legal or remedial theory.”  Alpern v. 
UtiliCorp United, Inc., 

 (8th Cir. 1996) (citing Donaldson, 

).  Here, Plaintiff’s grievances reflect typical injuries associated with a data breach and 
the disclosure of sensitive personal information.  See Compl. ¶¶ 80–89.  There is no 
suggestion that these alleged injuries are atypical or different in some material respect from 
injuries claimed by absent class members.                                 
(4) Adequacy.  A class representative must “fairly and adequately protect the 
interests of the class.”  Fed. R. Civ. P. 23(a)(4).  “The party moving for certification bears 
the burden to prove that [he] will adequately represent the class,” and “[t]he district court 

must decide whether Rule 23(a)(4) is satisfied through balancing the convenience of 
maintaining a class action and the need to guarantee adequate representation to the class 
members.”  Rattray v. Woodbury Cnty., 

 (8th Cir. 2010) (cleaned up).  
To  demonstrate  adequacy  of  representation,  a  plaintiff  must  show  that  “(1)  the 
representative and its attorneys are able and willing to prosecute the action competently 

and vigorously; and (2) the representative’s interests are sufficiently similar to those of the 
class that it is unlikely that their goals and viewpoints will diverge.”  City of Farmington 
Hills Emps. Ret. Sys. v. Wells Fargo Bank, N.A., 

 (D. Minn. 2012).  
“This inquiry requires the Court to evaluate the adequacy of both the proposed class 
representatives and the proposed class counsel.”  Taqueria El Primo LLC v. Ill. Farmers 

Ins. Co., 

, 993 (D. Minn. 2021).  Here, Mr. Morrison is an adequate 
class representative.  He is a former Entrust employee and a data breach victim.  ECF No. 
30  ¶  2.    He  has  “assisted  in  the  investigation  of  this  case,  reviewed  and  approved 
pleadings,” remained in contact with class counsel, and participated actively in answering 
counsel’s questions.  

.  No information suggests Mr. Morrison might have any 

conflicts that would render him inadequate to represent the class.  Class counsel, who are 
experienced in class-action prosecution, are no doubt adequate under Rule 24(a)(4).  See 
ECF No. 30 ¶¶ 21–23; ECF No. 30-1.                                        
(5) Predominance and superiority.  To obtain certification under Rule 23(b)(3), 
Plaintiff must demonstrate that (1) “questions of law or fact common to class members 
predominate over any questions affecting only individual members and [(2)] that a class 

action is superior to other available methods for fairly and efficiently adjudicating the 
controversy.”  Fed. R. Civ. P. 23(b)(3).  The “pertinent” matters to these inquiries include:  
     (A) the class members’ interests in individually controlling the 
     prosecution or defense of separate actions;                     
     (B)  the  extent  and  nature  of  any  litigation  concerning  the 
     controversy already begun by or against class members;          
     (C)  the  desirability  or  undesirability  of  concentrating  the 
     litigation of the claims in the particular forum; and           
     (D) the likely difficulties in managing a class action.         

    “The  Rule  23(b)(3)  predominance  inquiry  tests  whether  proposed  classes  are 
sufficiently  cohesive  to  warrant  adjudication  by  representation.”    Amchem  Prods.  v. 
Windsor, 

 (citing Charles Alan Wright, Arthur R. Miller, & Mary Kay 
Kane, Federal Practice and Procedure § 1777, at 518–19 (2d ed. 1986)).  By their nature, 
data  breach  claims  ordinarily  involve  many  plaintiffs  who  allege  to  have  suffered 
equivalent injuries resulting from the breach.  And given the size of this class, and that 
asserted  liability  arises  from  a  common  course  of  Entrust’s  alleged  conduct,  class 

resolution is superior to individual litigation.  See Savidge v. Pharm-Save, Inc., --- F. Supp. 
3d ---, No. 3:17-CV-186-CHB, 

, at *27–32 (W.D. Ky. Mar. 29, 2024).  
For all these reasons, then, certification of the settlement class is appropriate. 
                          III                                        
                    Settlement Approval                              
“A district court may approve a class action settlement only after determining that 

it is ‘fair, reasonable, and adequate.’”  In re Uponor, 

 (quoting Fed. R. 
Civ. P. 23(e)(2)).  In assessing whether the proposed settlement is “fair, reasonable, and 
adequate,” the Court considers: “(1) the merits of the plaintiff’s case weighed against the 
terms of the settlement; (2) the defendant’s financial condition; (3) the complexity and 
expense of further litigation, and (4) the amount of opposition to the settlement.”  Marshall 

v. Nat’l Football League, 

 (8th Cir. 2015) (citing In re Uponor, 

).  The first factor is the most important consideration.  

     
The  class  action  settlement  here  includes  several  key  terms.    It  establishes  a 
$375,000 non-reversionary settlement fund, which will be used to pay for benefits to the 
settlement class, notice and administration costs, Plaintiff’s service award, and attorneys’ 

fees and costs.  The settlement provides for two categories of relief for class members: 
(1) reimbursement for extraordinary losses up to $5,000; or (2) a $50 pro rata cash payment 
as an alternative to reimbursement for extraordinary losses.  ECF No. 29-1 ¶ 64.  Class 
members who submit a valid claim will receive a pro rata share of the net settlement fund 
after all settlement administrative expenses (up to three times their initial claim).  Id. ¶ 65.  

The settlement fund also pays the administration and notice expenses, attorneys’ fees up to 
one-third of the total amount of the fund, or $125,000, expenses up to $10,000, and a Court-
approved service award for Mr. Morrison as the class representative of $3,000.  Id. ¶¶ 71, 
99, 101.  Class members who submitted a timely and valid claim will receive a pro rata 
share of the net settlement fund after all settlement administrative expenses have been paid.  
If no additional claims were filed after March 21, 2024, the administrator estimates that 
share to be $150 per claim.  ECF No. 49 ¶ 17.  Even if 790 additional, valid claims were 

filed electing the alternative cash payment, the administrator estimates that share to still be 
$50 per claim.  Id.  In addition to the settlement’s monetary value, Entrust agreed to provide 
class counsel with a confidential declaration outlining information security improvements 
it has undertaken.  ECF No. 29-1 ¶ 77.                                    
Several  considerations  show  that  this  settlement  is  fair  and  reasonable.    The 

settlement bears a reasonable relationship to the case’s merits.  Though the Complaint 
alleged clear and facially cogent factual bases and liability theories, Defendants’ Rule 
12(b)(6) motion identified tenable problems with the case’s merits.  The settlement terms 
strike a reasonable balance between these competing positions.  No doubt further litigation 
would have proven complex and expensive.  It seems reasonable to predict that the case by 

its  nature  would  have  been  heavy  on  electronic  discovery,  associated  nondispositive 
motion practice, and eventually more dispositive motion practice.  The settlement seems 
more reasonable when one considers it was reached in the case’s earliest stages.  That 
enabled the parties to forego substantial expense and it placed the benefits of the settlement 
in  the  hands  of  class  members  much  sooner.    There  has  been  no  opposition  to  the 

settlement.  As noted, the class has 4,172 members.  ECF No. 49 ¶ 4.  The claims 
administrator has sent individual email and mail notice to all but 108 class members.  Id. 
¶¶ 5–8, 13.  The deadline by which to opt out or object was March 12, 2024; fourteen class 
members timely requested exclusion from the settlement, and no class member objected.  
Id. ¶¶ 14, 15.  The process that led to the settlement involved an independent mediator and 
arm’s length negotiations, all but eliminating any possibility that the settlement was the 
product  of  collusion.    And  the  per-class-member  compensation  under  the  settlement 

compares favorably with settlements in like cases.  See ECF No. 48 at 10. 
                          IV                                         
               Attorneys’ Fees and Service Award                     
     “In a certified class action, the court may award reasonable    
     attorney’s fees and nontaxable costs that are authorized by law 
     or by the parties’ agreement.”  Fed. R. Civ. P. 23(h).  The     
     Supreme Court recognizes that “a litigant or a lawyer who       
     recovers a common fund for the benefit of persons other than    
     himself or his client is entitled to a reasonable attorney’s fee 
     from the fund as a whole.”  Boeing Co. v. Van Gemert, 

 (1980).  When calculating attorneys’ fees under   
     the common fund doctrine, “a reasonable fee is based on a       
     percentage  of  the  fund  bestowed  on  the  class.”    Blum  v. 
     Stenson, 

, 900 n.16 (1984).  “In the Eighth Circuit, 
     use of a percentage method of awarding attorney fees in a       
     common-fund  case  is  not  only  approved,  but  also  ‘well   
     established.’”  In re Xcel Energy, Inc., Sec., Derivative &     
     “ERISA” Litig., 

 (D. Minn. 2005)        
     (quoting Petrovic v. Amoco Oil Co., 

 (8th    
     Cir. 1999)); see also Khoday v. Symantec Corp., No. 11-CV-      
     180 (JRT/TNL), 

, at *8-9 (D. Minn. 2016),        
     aff’d sub nom. Caligiuri v. Symantec Corp., 

 (8th   
     Cir. 2017).                                                     

Kruger, 

, at *5.  Here, Plaintiff seeks an attorneys’ fees award of 33.3% 
of the $375,000 non-reversionary settlement fund, or $125,000.  Courts in the Eighth 
Circuit consider several factors depending on the case’s nature to evaluate a fee request’s 
reasonableness.  See In re Target Corp. Customer Data Sec. Breach Litig., 892 F.3d at 977 
& n.7 (citing Johnson v. Ga. Highway Express, Inc., 

, 719–20 (5th Cir. 1974)); 
see also In re Xcel Energy, Inc., Sec., Derivative & “ERISA” Litig., 

.  
Applying several of these factors here shows that Plaintiff’s fees request is reasonable. 
(1) As should be evident from the discussion approving the settlement, above, the 

benefit conferred on the class was substantial.  (2) Plaintiff’s counsel faced a significant 
risk in pursuing the case.  A review of Defendants’ motion to dismiss reveals several 
potentially dispositive issues faced by Plaintiff and his counsel.  (3) Data breach cases, by 
their nature, often raise difficult and often novel issues ranging from jurisdictional Article 
III standing problems to any number of merits-related questions.  This case is no exception.  

And Plaintiff’s counsel pursued the case independently; as far as the record reflects, they 
were  not  aided  by  a  government  investigation.    (4)  The  lawyers  in  the  case—both 
representing Plaintiff and Defendants—are skilled.  This conclusion is drawn safely from 
the lawyers’ advocacy in this case, but it also is drawn from the Court’s familiarity with 
the lawyers and their standing in the legal community.  (5) In light of the early stage at 

which the case settled and the fact that some additional fees will be incurred from this point 
forward, the requested fee compares reasonably with the lodestar computation of Plaintiff’s 
counsel’s fees.  See ECF No. 42 ¶¶ 27–31.  (6) The absence of objectors shows the class 
approves of the settlement and supports the requested fee award.  (7) The request equates 
to 33.33% of the settlement fund, an award within the typical range approved in the Eighth 

Circuit.  See Huyer v. Buckley, 

 (8th Cir. 2017) (noting that courts in the 
Eighth Circuit frequently award attorneys’ fees between 25–36% of the settlement fund); 
Caligiuri v. Symantec Corp., 

, 865–66 (8th Cir. 2017) (affirming 33% fee 
award); In re U.S. Bancorp Litig., 

 (8th Cir. 2002) (approving 36% fee 
award); Khoday, 

, at *17, report and recommendation adopted, 

 (D. Minn. Apr. 22, 2016) (awarding attorneys’ fees of one-third of the 
settlement fund); see also In re Xcel Energy, Inc., Sec., Derivative & “ERISA” Litig., 

 (collecting cases awarding attorneys’ fees of between 25–36%  of 
common fund).                                                             
The requests for $10,000 in expenses and a $3,000 service award for Mr. Morrison 
are also reasonable.  The requested expenses are considerably less than Plaintiff’s counsel 
have actually incurred, and the largest single expense was Plaintiff’s share of the mediation 

fee.  ECF No. 42 ¶ 34.  Mr. Morrison’s involvement in the case is worthy of the requested 
service award.  See ECF No. 43.                                           
Based on the foregoing, and all the files, records, and proceedings herein, IT IS 
HEREBY ORDERED that:                                                      
1.   Plaintiff’s Unopposed Motion for Final Approval of Class Action Settlement 

[Docket No. 46] is GRANTED;                                               
2.   Final certification of the Settlement Class is GRANTED;         
3.   Plaintiffs’  Unopposed  Motion  for  Award  of  Attorneys’  Fees,  Litigation 
Costs, and Service Awards [ECF No. 39] is GRANTED;                        
4.   Class counsel is awarded one-third of the Settlement Fund, or $125,000; 

5.   Class counsel is awarded $10,000 in reasonable expenses;        
6.   Class representative James Morrison is awarded a service award of $3,000 
for his service to the Settlement Class; and                              
7.   Final  approval  of  the  methods  and  forms  of  notice  provided  to  Class 
Members is GRANTED.                                                       
8.   The Court shall retain jurisdiction over the subject matter and the parties with 

respect to the interpretation and implementation of the Settlement Agreement for all 
purposes.                                                                 
       LET JUDGMENT BE ENTERED ACCORDINGLY.                          

Dated:  May 14, 2024          s/ Eric C. Tostrud                          
                         Eric C. Tostrud                             
                         United States District Court