Orrick to Pay $8 Million to Settle Data Breach Class Claims

Orrick, Herrington & Sutcliffe LLP will pay $8 million to settle consolidated class action claims over a data breach that impacted approximately 461,100 people.

Class counsel asked the US District Court for the Northern District of California to approve the settlement in an unopposed motion filed Thursday.

The agreement also calls for an award of attorneys’ fees of up to 25% of the settlement fund, and costs up to $50,000. The lead plaintiffs may seek service awards up to $2,500 each under the terms of the agreement.

The hack is part of a wave of cyberattacks against law firms, including Proskauer Rose, Kirkland & Ellis, K&L Gates, and Loeb & Loeb.

Hackers “infiltrated and accessed” Orrick’s “inadequately protected computer systems” on March 13, 2023, “and stole the sensitive personal information of over hundreds of thousands” of individuals, according to the consolidated complaint.

The plaintiffs alleged they suffered damages from the breach, including “identity theft, attempted identity theft, misuse of their PII, and a flood of spam telephone calls from unknown persons.”

The law firm’s “failure to protect the Breach Victims’ Personal Information,” allowed cyber criminals “to steal everything they could possibly need to commit nearly every conceivable form of identity theft,” the complaint alleged.

The motion seeks certification of a settlement class of “All persons whose Personal Information was compromised by the Data Breach discovered on or about March 13, 2023,” and a subclass of California residents whose PIN was compromised by the breach.

Plaintiff Dennis Werley filed the first complaint in the Northern District of California on Aug. 11. The court consolidated related actions and appointed William B. Federman with Federman & Sherwood as interim lead class counsel in December. The plaintiffs filed a consolidated class action complaint on Jan. 5.

Alston & Bird LLP represents Orrick.

The case is In re Orrick Herrington & Sutcliffe LLP Data Breach Litig., N.D. Cal., No. 23-cv-04089, 4/11/24.