In 2013, a historic and horrendous data breach at Target left millions of consumers terrified that their personal information ended up in the wrong hands.  A multi-state investigation quickly ensued and found that hackers had accessed the popular retailer’s gateway server through credentials stolen from a third-party.  Target eventually settled claims issued by 47 states and the District of Columbia for nearly $17 million, but the terms of the agreement were met with objection.In total, Target reported hackers stole data from up to 40 million credit and debit cards of shoppers who had visited its stores during the 2013 holiday season.  The retailer also indicated the total cost of the data breach totaled roughly $202 million.The settlement agreement, which provided for a $10 million fund for customers and $6.75 million for plaintiffs’ attorneys was approved in November 2016.  Under its terms, Target was required to adopt advanced safety measures to secure customer information such as employing an executive to oversee a comprehensive information security program as well as advise its chief executive and board.  The company was also required to hire an independent, qualified third party to conduct a comprehensive security assessment and encrypt card information in order to make it useless if stolen.  Class members with documented losses were scheduled to be compensated from the fund first, and the remainder of the funds were to be distributed among class members with undocumented losses.

Photo by Alexandru Tugui on Unsplash

Objector Lief Olson had argued the named class members should not have been allowed to represent those like him who suffered no losses in the matter.  The district court reconsidered his claims after the Eighth Circuit in February 2017 and ordered it to conduct a more rigorous analysis of class certification.“Over 99 percent of the Target data breach class gets nothing in this multimillion-dollar settlement, so we are glad that the Eighth Circuit recognizes that the District Court cannot rubber-stamp settlements where class counsel cuts corners on procedural fairness, so they can get paid quickly and generously,” objector counsel Melissa Holyoak of the Center for Class Action Fairness in Washington said.Ultimately, the court rejected Olson’s challenge that the named plaintiffs weren’t adequate representatives for the whole class because they received compensation while others didn’t. This time around the Eighth Circuit was satisfied with the court’s conflicts analysis. It also rejected objector Jim Sciaroni’s argument that 29 percent of the total fund was an excessive fee award for class counsel.“All class members had the ability to register for credit monitoring, and all of the compromised payment cards undoubtedly were canceled and replaced by the issuing banks,” Judge Bobby E. Shepherd, nominated to this post by former Presidents George W. Bush, wrote for the U.S. Court of Appeals for the Eighth Circuit. “Any risk of future harm is therefore entirely speculative,” the court added.Vincent J. Esades of Heins Mills & Olson P.L.C. in Minneapolis argued for the class.  Melissa Ann Holyoak of the Competitive Enterprise Institute Center for Class Action Fairness argued for the objection issuers.The decision regarding the objection doesn’t affect a separate $39 million class settlement between Target and banks over losses from the breach, which was approved in May 2016.

Sources:

$17M Target Breach Deal Imperiled by Conflict AllegationsTarget Settles 2013 Hacked Customer Data Breach For $18.5 Million