JURY TRIAL DEMANDED

PLAINTIFFS' UNOPPOSED MOTION TO APPROVE THE ALLOCATION PLAN AND TO ENTER AN EXPEDITED ORDER GRANTING FINAL APPROVAL

JOHN Z. LEE, District Judge.

Plaintiffs Greater Chautauqua Federal Credit Union, First Choice Federal Credit Union, Gulf Coast Bank & Trust Company, Governmental Employees Credit Union, and Oteen V.A. Federal Credit Union ("Plaintiffs"), by their undersigned counsel, respectfully request that the Court approve the Allocation Plan (as set forth in Exhibit A) and enter the Order and Final Judgment previously submitted with Plaintiffs' Motion for Final Approval. Furthermore, Plaintiffs respectfully request that this unopposed motion be given expedited consideration for the reasons stated at the Final Approval Hearing on May 19, 2017.

At the May 19, 2017 Final Approval Hearing, the Court granted Class Plaintiffs' Motion for Final Approval of Class Action Settlement and Plan of Allocation of Settlement Proceeds, subject to this Court's review and approval of the final allocation plan (ECF No. 147). Pursuant to the Court's request, Plaintiffs hereby submit the Allocation Plan (attached hereto as Exhibit A) for the Court's review and approval.

The purpose of an allocation plan is to provide a fair and equitable distribution of the settlement funds among eligible Settlement Class Members, and the Allocation Plan attached hereto does just that. If approved, the Allocation Plan would grant a settlement award to 3281 Settlement Class Members. This means that over 97% of the Settlement Class Members who filed a claim would receive a settlement award.2

For Tier 1 Claims, the Allocation Plan would provide a settlement award to 251 Settlement Class Members. Each of these Settlement Class Members would receive the maximum payout of $2.38 per card claimed. Collectively, these Settlement Class Members would receive a minimum total payout of $740,515.58 for Tier 1.

For Tier 2 Claims, the Allocation Plan would provide a settlement award to 166 Settlement Class Members. Each of these Settlement Class Members would receive a pro rata amount of the total funds in Tier 2. The minimum total payout under Tier 2 would be $4,294,607.88.3

WHEREFORE Plaintiffs request that the Court grant their unopposed motion and enter the Order and Final Judgment.

EXHIBIT A

KMART FI DATA BREACH SETTLEMENT

Claims Processing Analysis Narrative

Claim Requirements

In the process of submitting claims, Financial Institutions were required to elect which Tier(s) their claims would apply to:

For Tier 1: Non GCAR Eligible Tier Claims, the Financial Institutions (FIs) were required to provide the total number of Non GCAR Eligible Compromised Payment Cards for which the FI received an Alert related to the Kmart Data Breach. Additionally, FIs were required to upload supporting documentation consisting of copies of the Data Breach Alerts that were received for the claimed Non GCAR Eligible Compromised Payment Cards. If these documents were unavailable, FIs were asked to provide as much information as possible.

For Tier 2: All Class Tier Claims, the FIs were required to provide the total amount of fraud damages incurred related to the Kmart Data Breach and the total amount of card reissuance damages incurred related to the Kmart Data Breach. Additionally, FIs were required to upload supporting documentation consisting of proof of all fraud expenses incurred within the Fraud Window on Compromised Payment Cards, and/or supporting documentation of proof of actual costs of replacing physical payment cards on Compromised Payment Cards.

Matching to Original Records

Epiq's processing of submitted Claims consisted of both programmatic and manual aspects. First, Epiq programmatically matched FIs to Original Records1, wherever possible. If a programmatic match could not be found, a manual review of the submission and the existing database would occur, in an attempt to match the submission with an Original Record. As seen in lines 7 and 21, of the Claims Processing Analysis PDF, Epiq matched 140 Tier 1 Claims to Original Records, and 73 Tier 2 Claims to Original Records.

The primary benefit of matching submissions to Original Records was to compare the claimed number of Non GCAR Eligible Compromised Payment Cards against the total number of cards provided in the Visa and MasterCard data files.

Official vs. Unofficial Documents

The most significant undertaking of Epiq's Claims Processing was the review of submitted supporting documents. As no two FIs keep identically formatted records, Epiq devised a protocol for determining documentation type and validity.

Tier 1 Claim's request for Data Breach Alerts resulted in a low variance on the format type of submitted documents. Tier 1 Official Documents are defined as files containing full lists of affected cards, and/or containing the proper alert codes, and/or clearly stating Non GCAR Eligible Compromised Payment Cards. If the number of Non GCAR Eligible Compromised Payment Cards was not clearly stated in the supporting documentation, analysts were instructed to subtract the number of alerted accounts from the number of GCAR eligible accounts. Moreover, screen shots of official documentation were also considered Official Documents. Tier 1 Unofficial Documents are defined as any document that was created by the FI containing only a summary of the affected cards (rather than a list of the affected cards).

Tier 2 Claims did not contain a specific requirement for type or format of supporting documentation; therefore, the variance among the submissions was high. In order to delineate the submission from one another, Epiq defined Tier 2 Official Documents as invoices, bank statements, or fraud reports which contained items or dates that directly corresponded to the data breach and/or Fraud Window. Tier 2 Unofficial Documents are defined as any documents created by the FI, themselves. Examples of Tier 2 Unofficial Documents include FI generated spreadsheets, balance reports, or personal records.

Results

As seen in the green highlighted cells of the Claims Processing Analysis PDF, Epiq recommends paying Claims which provided Official or Unofficial Documents, but not paying Claims that provided no documents, whatsoever, with the exception of Tier 1 Claims that were matched to an Original Record but did not submit any documentation. The reason to include Tier 1 Claims that were matched to an Original Record but did not submit any documentation as eligible for payment, is that Epiq could, at the least, verify those claimed counts against the data provided by Visa and MasterCard. For all other Claims that did not submit any documentation ("deficient" claims), Epiq has no avenue to verify or confirm their claimed counts or amounts.2

Settlement Benefits

Tier 1:

Tier 2:

Updated: May 18, 2017

Kmart FI Data Breach Settlement

Claims Processing Analysis