Morrison v. Entrust Corporation

Background

The case arose from a ransomware attack that Entrust discovered on June 18, 2022. According to the complaint, an unauthorized criminal third party accessed Entrust’s systems and removed certain employee data. A ransomware group later claimed responsibility and released information from the breach to a data-leak page. Entrust began notifying its clients about the incident in December 2022.

James Morrison alleged that Entrust did not adequately safeguard electronically stored private information. He asserted claims for negligence, negligence per se, declaratory judgment, breach of implied contract, and unjust enrichment. He sought damages, attorneys’ fees, costs, and other relief for himself and a proposed class. Entrust disputed the allegations and filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), arguing, among other things, that Morrison had not adequately alleged damages or a breach of duty and that the claims lacked sufficient factual or legal support.

The parties mediated on June 1, 2023, and reached agreement on settlement terms shortly afterward. Judge Wilhelmina M. Wright preliminarily approved the proposed class settlement on November 30, 2023. The court then provided notice to the settlement class and held a final fairness hearing on April 4, 2024. The opinion states that the settlement class contained 4,172 potential members, that fourteen members timely opted out, and that no member objected.

Class Certification

The court granted final certification of the settlement class under Federal Rule of Civil Procedure 23. The class was defined as all individuals known to reside in the United States whose private information was potentially compromised as a result of the data incident discovered by Entrust Corporation and/or Entrust MN Corporation on or about June 18, 2022. The judges presiding over the litigation and members of their direct families were excluded, as were people who opted out.

The court found that the class met Rule 23(a)’s requirements of numerosity, commonality, typicality, and adequacy. The 4,172 potential members were geographically dispersed across forty-seven states, the District of Columbia, and Puerto Rico. The court also found that common questions about Entrust’s security practices, alleged duties, breach, causation, and damages could be resolved for the class; that Morrison’s alleged injuries were typical; and that Morrison and class counsel adequately represented the class.

The court also found that common questions predominated over individual questions and that a class action was superior to individual lawsuits under Rule 23(b)(3). It reasoned that the claims arose from a common course of alleged conduct and that data-breach claims commonly involve many people alleging similar injuries.

Settlement Approval

Under Rule 23(e)(2), the court was required to determine whether the settlement was fair, reasonable, and adequate. The settlement established a $375,000 non-reversionary fund to pay class benefits, notice and administration costs, the service award, and attorneys’ fees and expenses.

The settlement provided two categories of relief: reimbursement for extraordinary losses up to $5,000 or an alternative $50 pro rata cash payment. The opinion states that valid claimants would receive a pro rata share of the net settlement fund after administrative expenses, subject to the settlement’s terms. The administrator estimated that the payment could be approximately $150 per claim if no additional claims were filed after March 21, 2024, or $50 per claim if 790 additional valid claims selected the alternative payment.

The court concluded that the settlement reasonably balanced the strengths and weaknesses of the case, avoided the complexity and expense of further litigation, provided benefits earlier than continued litigation would have, and faced no objections. The court also noted that negotiations involved an independent mediator and were conducted at arm’s length. Entrust agreed to provide class counsel with a confidential declaration describing information-security improvements it had undertaken.

The court expressly stated that the settlement did not constitute an admission of liability and that the order did not find liability or wrongdoing by Entrust.

Fees, Expenses, and Service Award

The court approved class counsel’s request for attorneys’ fees equal to one-third of the settlement fund, or $125,000. It found the request reasonable based on the benefit to the class, the risks and difficulties of the litigation, counsel’s skill, the early settlement, the absence of objections, and the percentage’s consistency with awards commonly approved in the Eighth Circuit.

The court also approved $10,000 in litigation expenses and a $3,000 service award for Morrison as class representative. It found that the expenses were reasonable and that Morrison’s participation supported the service award.

Order

Judge Eric C. Tostrud ordered that:

The order directed that judgment be entered accordingly.