A recent Law 360 story by Hailey Konnath, “Facebook Slams $12M Atty Fees Request in Data Breach Row,” reports that Facebook opposed a $12 million attorney fees request from counsel representing users who settled a dispute with the company over a 2018 cyberattack, slamming the lawyers for accruing a hefty bill while pursuing claims that didn't win money for their clients.  The users sued Facebook Inc. in California federal court alleging it negligently allowed the cyberattack, which affected roughly 29 million individuals.  The social media giant and the class of users reached a nonmonetary settlement resolving the case last year, and U.S. District Judge William Alsup gave it his blessing in November.

Under the deal, Facebook agreed to reform its security protocols but not to pay monetary damages.  The users' attorneys at Tadler Law LLP, Cohen Milstein Sellers & Toll PLLC and Morgan & Morgan Complex Litigation Group asked for $12 million in fees and costs, including a $2.1 million bonus.  But Facebook said in its opposition that such a request for a settlement that yielded no monetary recovery to the class is not supported by law.  In just over 16 months, the users' attorneys managed to assemble a "very sizable bill" that they now ask be paid without scrutiny, according to Facebook's motion.

Notably, the class' attorneys have refused to provide project-level or even chronological time records, Facebook said.  But even the figures they have submitted show the dispute wasn't handled efficiently, it argued.  Facebook said that more than 100 timekeepers from 17 different firms billed the matter, with partners billing for tasks like "document management."

"This top-heavy staffing yields a blended hourly rate that is 35.8% higher than the average awarded in other recent data breach settlements, and stands in stark contrast to the court's instructions," Facebook said.  The company added that "there can be no doubt that substantial swaths of [the class counsel's] litigation efforts were unsuccessful." 

Named plaintiffs in the case went from 17 to one, only two out of 10 claims survived Facebook's dismissal bid, a star identify theft expert was struck from the record and no damages class was certified, Facebook said.  "Any award to class counsel should be commensurate with the reasonable level of effort necessary to secure the specific settlement achieved here -- and should not reward wasteful efforts that did not benefit the class," it said.