IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MONTANA BUTTE DIVISION

IN RE: SNOWFLAKE, INC., DATA SECURITY BREACH LITIGATION CASE No.: 2:24-MD-3126-BMM This Document Relates to Defendants: ADVANCE AUTO PARTS, INC. and ADVANCE STORES COMPANY INCORPORATED

ORDER GRANTING PLAINTIFFS’ UNOPPOSED MOTION FOR FINAL APPROVAL OF CLASS ACTION SETTLEMENT AND APPLICATION FOR ATTORNEYS’ FEES, COSTS, AND SERVICE AWARD

THIS CAUSE comes before the Court on Plaintiffs’ Unopposed Motion for Final Approval of Class Action Settlement and Application for Attorneys’ Fees, Costs, and Service Awards (Doc. 545),1 filed on September 8, 2025, requesting entry of an order: (1) granting Final Approval to the Settlement; (2) certifying the Settlement Class for settlement purposes, pursuant to Fed. R. Civ. P. 23(a) and

1 All capitalized terms used herein have the same meanings as those defined in Section II of the Settlement Agreement (“SA”) attached to the Motion for Final Approval as Exhibit A. (See Doc. 415-1.) 23(b)(3); (3) reappointing the Plaintiffs as Class Representatives; (4) reappointing Devlan Geddes, Raph Graybill, John Heenan, Amy Keller and Jason Rathod as Class

Counsel for the Settlement Class; (5) awarding Service Awards to the Class Representatives; (6) awarding attorneys’ fees and costs to Class Counsel; (7) affirming the appointment of Kroll Settlement Administration, LLC as the

Settlement Administrator and approving the payment of the remainder of the Settlement Administration Costs; (8) overruling timely and properly submitted objections, if any; and (9) entering final judgment dismissing the Action with prejudice as to the Defendant and reserving jurisdiction over Settlement

implementation. The Court held a hearing on the Motion for Final Approval on October 23, 2025. Having already analyzed the Settlement in entering the Preliminary Approval

Order (Doc. 436), and having again carefully reviewed the Motion for Final Approval, the proposed Settlement and its exhibits, all relevant filings, the record, and the argument from the Parties’ counsel at the Final Approval Hearing, the Court finds the Settlement Class should be finally certified, the Settlement satisfies the

final approval criteria, and the Application for Attorneys’ Fees, Costs and Service Awards should be granted. BACKGROUND AND PROCEDURAL HISTORY

1. Defendant is an automotive aftermarket parts provider that operates retail stores primarily in the United States. In the course of its business, Defendant stores Personal Information pertaining to employees and candidates for employment,

including, but not limited to, names, email addresses, mailing addresses, dates of birth, driver’s license numbers, Social Security numbers, demographic details, and more.

2. On or about May 23, 2024, Defendant discovered an unauthorized party gained access to its Snowflake cloud data storage application. 3. Commencing on June 24, 2024, Defendant was named in the first of 11

putative class action lawsuits. 4. Before the cases were centralized in this Court, a number of cases were consolidated in the Eastern District of North Carolina with interim class counsel

appointed. The parties in those actions began discussing settlement and scheduled a mediation with Bennett G. Picker, Esq., an experienced data breach mediator, on October 1, 2024. The Related Action plaintiffs propounded mediation discovery requests and received responses, learning a significant amount about the Data

Incident to ensure that their negotiations were adequately informed. Counsel in the Related Actions also exchanged mediation briefs outlining their positions with respect to liability, damages, and settlement-related issues. After a full day of

negotiations at mediation, the Parties made substantial progress but were unable to reach a Settlement. 5. Thereafter, the Judicial Panel on Multidistrict Ligation centralized the Related Actions, along with other actions against Defendant and other actions

against other defendants, under In re Snowflake Inc. Data Security Breach Litigation, No. 2:24 MD-3126-BMM. The Court selected Lead Counsel and an Executive Committee on November 19, 2024.

6. On February 3, 2025, Lead Counsel filed a Representative Class Action Complaint, asserting causes of action against Defendant for (1) negligence; (2) breach of implied contract; and (4) violations of the California Consumer Privacy Act (“CCPA”) against Defendant. (See Doc. 320.) Counsel for Plaintiffs also

consulted with data experts to understand how the Data Incident occurred, the type of information involved, and whether the information was published on the Dark Web.

7. Following the significant progress made before the creation of the MDL, the Parties continued to conduct extensive settlement discussions, culminating in a settlement in principle in early March 2025. Thereafter, on March 11, 2025, the Parties filed a Joint Notice of Settlement and Motion to Stay All

Deadlines Pending Approval of Class Action Settlement. (Doc. 368.) 8. Over the next several weeks, the Parties continued to negotiate at arms’- length over the Settlement’s terms. They also exchanged confirmatory discovery,

interviewed potential administrators, and negotiated the Notice Program and Claims Process. The Parties executed the Agreement in May 2025. 9. On May 15, 2025, Plaintiffs filed their Motion for Preliminary

Approval, which the Court granted on May 22, 2025. (Docs. 415, 434.) The Court amended the Preliminary Approval Order on May 22, 2025, as to the date of the Final Approval Hearing only. (Doc. 436.) The Court entered its Preliminary

Approval Order, which, inter alia (1) preliminarily approved the Settlement; (2) determined that, for purposes of the Settlement only, the Action should proceed as a class action and certified the Settlement Class; (3) appointed Plaintiffs as Class Representatives; (4) appointed Class Counsel; (5) appointed Kroll as Settlement

Administrator; (6) approved the form and manner of Notice and the Notice Program; (7) approved the Claim Process and Claim Form; and (8) set the Final Approval Hearing date.

10. Following Preliminary Approval, as confirmed in declarations by Class Counsel and the Settlement Administrator filed in support of the Motion for Final Approval, the Parties and the Settlement Administrator commenced and completed the Notice Program. Notice was provided to the Settlement Class in accordance with

the Court’s Preliminary Approval Order by direct Email Notice or Postcard Notice, and the Long Form Notice was available to Settlement Class Members on the Settlement Website or on request to the Settlement Administrator. The Settlement

Class was given the opportunity to opt-out or object to the Settlement and to file Claims. The deadline to file Claims was October 8, 2025. JURISDICTION OVER PARTIES AND SETTLEMENT CLASS MEMBERS AND NOTICE OF PROPOSED SETTLEMENT

11. The Court has subject matter jurisdiction over the Action and personal jurisdiction over the Parties and all Settlement Class Members. 12. Pursuant to the Class Action Fairness Act,

, notice was duly provided to via first-class certified mail, to (a) the Attorney General of the United States, (b) the fifty-one (51) state and territorial Attorneys General identified

in the service list for the CAFA Notice (Doc. 545-3, Exhibit B), and (c) via email to the Nevada Attorney General. 13. Pursuant to the Court’s Preliminary Approval Order, the Settlement

Administrator has complied with the approved Notice Program as confirmed in its declaration filed with the Court. The form and method for notifying the Settlement Class of the Settlement and its terms and conditions was in conformity with this Court’s Preliminary Approval Order and satisfied the requirements of Fed. R. Civ.

P. 23(c)(2)(B) and due process, and constituted the best notice practicable under the circumstances. The Court finds that the Notice Program was clearly designed to advise the Settlement Class members of their rights. Further, the Court finds that the

Claims Process set forth in the Agreement was followed and that the process was the best practicable procedure under the circumstances. 14. FINAL CERTIFICATION OF SETTLEMENT CLASS 15. In the Preliminary Approval Order, the Court certified the Settlement

Class pursuant to Fed. R. Civ. P. 23(a) and (b)(3). (Doc. 436.) No circumstances have arisen that justify altering the Settlement Class. Accordingly, final certification of the following Settlement Class is warranted, for settlement purposes:

All persons in the United States whose Private Information was potentially compromised as a result of the Data Incident and who were sent notice of the Data Incident. The Settlement Class is estimated to be approximately 2.3 million individuals.

The Court also grants final certification to the following Settlement Subclass: All Settlement Class Members who are Residents of California. Excluded from the Settlement Class are: (1) all persons who are governing board members of Defendant; (2) governmental entities; (3) the Court, the Court’s immediate family, and Court staff; and (4) any Settlement Class Member who timely and validly requests to opt-out from the Settlement. 16. Based upon information provided, the Settlement Class satisfies numerosity; there are common questions of law and fact, including whether Defendant’s Data Incident potentially compromised Plaintiff’s and Settlement Class Members’ Private Information, satisfying commonality; the proposed Class

Representatives’ claims are typical, in that they are members of the Settlement Class, thereby alleging they have damaged by the same conduct as other Settlement Class Members; the proposed Class Representatives and Class Counsel have fully, fairly and adequately protected the interests of the Settlement Class and will continue to do so; questions of law and fact common to members of the Settlement Class

predominate over questions affecting only individual members for settlement purposes; and a nationwide class for settlement purposes is superior to other available methods for the fair and efficient adjudication of this controversy. Fed. R.

Civ. P. 23(a), (b)(3). 17. The appointments of the Class Representatives, Class Counsel, and the Settlement Administrator are affirmed. FINAL APPROVAL OF SETTLEMENT

18. The Court does hereby finally approve the Settlement as being fair, reasonable, and adequate as to the Settlement Class Members. In making this ruling, the Court considered the Fed. R. Civ. P. 23(e)(2) factors in conjunction with the

Ninth Circuit’s traditional factors set forth in Churchill Vill., L.L.C. v. Gen. Elec.,

, 575 (9th Cir. 2004). 19. The Settlement was negotiated through good faith, informed, and arm’s length negotiations by class action attorneys familiar with the legal and factual issues

at stake. Given the complexity of data breach litigation and with the risks outlined in the Motion for Final Approval, the Settlement provides substantial benefits to all Settlement Class Members and prospective relief by Defendant’s business practice

changes, which would be unavailable if Plaintiffs ultimately lost or were only partially successful. The Settlement Agreement avoids further delay and expense in obtaining recovery.

20. Class Counsel state that, in their view, the Settlement Agreement represents an adequate result. The reaction of the Settlement Class to the Settlement has been very favorable with a significant number of Claims having been submitted.

Importantly, no Settlement Class Members objected to the Settlement. 21. The Settlement treats all Settlement Class Members equitably because they may all claim Settlement Class Member Benefits, and distribution plan for those benefits is fair, reasonable, and adequate.

ATTORNEYS’ FEES AND COSTS 22. The Court finds that Class Counsel and Plaintiffs’ counsel achieved an adequate result for the Settlement Class. The Court finds that this Action required

significant outlays of time and resources for Class Counsel and Plaintiffs’ counsel and was litigated zealously by both Parties. The Court also finds that data breach litigation is ever-evolving and complex and, therefore, presented substantial risks to Plaintiffs and their counsel to succeed.

23. The Court finds that the Settlement Class Members faced a significant risk of no recovery, much of the cost of which would have been borne by Class Counsel and Plaintiffs’ counsel such that they took on significant financial risk on

behalf of the Settlement Class Members. 24. This Court finds the business practice changes Defendant has taken to further secure the Personal Information stored in its computer security systems and

environment also provide value to the Settlement Class. Though that value is not specifically quantifiable to be include in the Rule 23(b)(3) Settlement Fund for purposes of calculating the attorneys’ fee award, the Court finds that it “nonetheless

[is] a substantial benefit with real economic and noneconomic value which justifies the requested fee percentage.” Anderson v. Boyne USA, Inc., No. 2:21-cv-00095- BMM,

, at *3 (D. Mont. June 25, 2025) (citing Staton, 327 F.3d at 964 (9th Cir. 2003)).

25. Thus, Class Counsel is awarded 33.33% of the Settlement Fund or $3,333,000 for attorneys’ fees under the percentage of the recovery method. This Court considered alternative measures for attorneys’ fees, including the lodestar

method, and finds the percentage of recovery method to be to be appropriate, particularly given that the total amount of the Settlement is a fixed amount without any reversionary payment to Defendant. The Court evaluated the attorneys’ fee award under Fed. R. Civ. P. 23(h) and considering the following factors set forth in

Vizcaino v. Microsoft Corp.,

(9th Cir. 2002): (a) the results achieved; (b) the risk of the litigation; (c) the skill required; (d) the quality of the work performed; (e) the contingent nature of the fee and the financial burden; and

(f) awards made in similar cases. The Court concludes awarding 33.33% of the Settlement Fund is fair and within the range of reason. 26. The Court also awards $85,243.79 for reasonable litigation costs

necessarily incurred in the Action. 27. The attorneys’ fees and costs shall be paid from the Settlement Fund in accordance with the Agreement.

SERVICE AWARDS 28. The Court finds that Service Awards of $2,500 each for the Class Representatives is fair and reasonable in light of, inter alia: (i) the time and effort of the Class Representatives to the Action; (ii) the significant financial and reputational

risks faced by the Class Representatives through their initiation and participation in the Action; (iii) the amount of the Service Awards when compared to the Settlement benefits Settlement Class Members who made Valid Claims will receive when

compared to the Settlement Fund and Net Settlement Fund; and (iv) the adequate result achieved for the Settlement Class. The Service Award shall be paid from the Settlement Fund in accordance with the Agreement. SETTLEMENT IMPLEMENTATION

29. Because the Court grants Final Approval of the Settlement set forth in the Agreement as fair, reasonable, and adequate, the Court authorizes and directs implementation of all terms and provisions of the Settlement.

30. All Parties to this Action, including all Settlement Class Members, are bound by the Settlement as set forth in the Agreement and this Final Approval Order. 31. Those individuals who have opted-out of the Settlement (Doc. 581-1)

will not be bound by the Agreement or the Releases contained therein. 32. As of the Effective Date, and in exchange for the relief described in the Agreement, the Releasing Parties shall release the Released Parties from the

Released Claims. 33. Based on the information presented to the Court, the Claims Process has proceeded as ordered and was consistent with the Agreement and Preliminary Approval Order. All Settlement Class Members who submitted Valid Claims shall

receive their Settlement Class Member Benefits pursuant to the Settlement’s terms. All Settlement Class Members who did not submit a Claim, or for whom the Claim is determined to be invalid, shall still be bound by the terms of the Settlement and

Releases therein. 34. Judgment shall be, and hereby is, entered dismissing the Action with prejudice, on the merits. 35. Plaintiffs and all Settlement Class Members and Releasing Parties, and

persons purporting to act on their behalf, are permanently enjoined from commencing or prosecuting (either directly, representatively, or in any other capacity) any of the Released Claims against any of the Released Parties in any

action or proceeding in any court, arbitration forum, or tribunal. 36. The Court hereby retains and reserves jurisdiction over (a) implementation of the Settlement and any distributions to the Settlement Class

Members; (b) the Action, until the Effective Date, and until each and every act agreed to be performed by the Parties shall have been performed pursuant to the terms of the Agreement, including the exhibits appended thereto; and (c) all Parties,

for the purpose of enforcing and administering the Settlement. 37. In the event the Effective Date of the Settlement does not occur, the Settlement shall be rendered null and void to the extent provided by and in accordance with the Agreement, and this Final Approval Order and any other order

entered by this Court in accordance with the terms of the Agreement shall be vacated, nunc pro tunc. In such event, all orders entered and releases delivered in connection with the Settlement shall be null and void and have no further force and effect, shall

not be used or referred to for any purpose whatsoever, and shall not be admissible or discoverable in any proceeding. The Action shall return to its status immediately prior to execution of the Agreement. 38. There being no just reason for delay, the Clerk of Court is hereby

directed to enter final judgment forthwith pursuant to the Fed. R. Civ. P. 58. Accordingly, IT IS ORDERED that Plaintiffs’ unopposed motion for final approval of class action settlement and application for attorneys’ fees, costs, and

service award (Doc. 545) is GRANTED. DATED this 23 day of October 2025.

Brian Morris, Chief District Judge United States District Court

14