In Re: Post Meds, Inc. Data Breach Litigation

Background

PostMeds, Inc., described in the opinion as a digital pharmacy that fulfills mail-order prescriptions, experienced a data breach that exposed customers' personally identifiable and protected health information. The information allegedly included names, birth dates, Social Security numbers, diagnosis and treatment information, prescription information, medical record numbers, and health-insurance information. The breach affected approximately two million customers, and PostMeds notified affected customers in October 2023.

The plaintiffs alleged that the breach resulted from PostMeds' failure to implement reasonable cybersecurity measures. They brought claims under California and Illinois consumer-protection and privacy laws, along with negligence, breach of implied contract, and unjust enrichment claims. After informal discovery and mediation, the parties reached a settlement. The plaintiffs filed an unopposed motion for preliminary approval, which the court considered after a hearing on October 24, 2024.

Proposed Settlement

The proposed settlement class consists of all United States residents who were sent notice that their private information was potentially compromised in the PostMeds data incident. The proposed class includes approximately two million people.

PostMeds would create a $7.5 million settlement fund. Each class member could submit a claim for up to $4,000 in qualifying out-of-pocket losses. In addition, each class member could choose either a cash payment from the fund or one year of data-protection services from Financial Shield Services. After payment of approved out-of-pocket claims, notice and administration expenses, attorneys' fees and costs, and any service awards, the remaining funds would be distributed equally on a proportional basis among eligible cash claimants. At the hearing, the parties stated that individual cash payments were expected to range from $45 to $240.

The settlement would release claims related to the data incident, including claims whether known or unknown, and would waive class members' rights under Section 1542 of the California Civil Code. A settlement administrator would send notice by email when an email address was available and by first-class mail when email delivery was unavailable. A settlement website would provide the complaint, claim form, notice, and relevant deadlines. Class members could opt out by submitting a written exclusion request or object to the settlement.

Class counsel could seek attorneys' fees of up to one-third of the fund, or $2.5 million, plus reasonable costs and expenses. The 24 class representatives could seek service awards of up to $1,500 each. The opinion states that fees, costs, and service awards would be paid from the settlement fund.

Provisional Class Certification

For settlement purposes, the court found that the proposed class satisfied Federal Rule of Civil Procedure 23. The court found numerosity because joining an estimated two million people would be impracticable. It found commonality because the case presented shared questions about PostMeds' duty to protect personal information, whether PostMeds breached that duty, the reasonableness of its security measures, and whether its conduct was willful or reckless.

The court found typicality because the plaintiffs alleged injuries based on the same security breach and alleged course of conduct affecting the class. It also found adequate representation, stating that it was unaware of conflicts between the plaintiffs or their counsel and other class members and that counsel had prosecuted the case vigorously.

For Rule 23(b)(3), the court found that common questions about PostMeds' alleged misconduct and the resulting harm predominated over individualized issues. It also found that a class action was superior because common adjudication would promote judicial efficiency in a case involving approximately two million class members.

The court appointed the plaintiffs as class representatives and appointed Gary M. Klinger, James J. Pizzirusso, and Jill M. Manning as co-lead class counsel.

Preliminary Settlement Approval

The court applied the preliminary-approval standard, under which a settlement need only appear potentially fair at this stage. The court considered whether the settlement resulted from serious and informed negotiations without improper collusion, avoided improper preferential treatment, fell within the range of possible approval, and lacked obvious deficiencies.

The court found no clear signs of collusion. It noted that the agreement had no provision requiring the defendant to refrain from challenging a fee request and no provision returning unclaimed funds to PostMeds. Although the agreement allowed counsel to seek one-third of the fund—more than the 25-percent benchmark the court discussed—the court found that most of the fund would remain for class members and stated that it would scrutinize any fee request carefully at final approval.

The court found that the possible service awards were not inherently unreasonable, while stating that it would ultimately decide whether each award was appropriate based on the representative's role and responsibilities. The court also found that the settlement benefits were within the possible approval range, considering the $7.5 million fund, the projected cash payments or data-protection services, and the risks of continued litigation. The court identified no obvious deficiencies.

Notice and Order

The court found that the proposed notice process was reasonably designed to inform class members of the settlement. It also found that the notice content satisfied due-process requirements by providing information about the action, the class, the claims, the right to appear through an attorney, the exclusion procedure, and the binding effect of a class judgment.

The court GRANTED the plaintiffs' motion for preliminary approval of the class-action settlement. It directed the parties to meet and confer and submit a schedule within seven days for notice, fee and service-award requests, opt-out and objection deadlines, the final-approval motion, and the final fairness hearing. The parties were also directed to implement the proposed notice plan. The opinion does not state that the court granted final approval of the settlement.