A recent Law 360 story by Brian Dowling, “Class Attys Eye $1.2M After Drizly Data Breach Deal”, reports that attorneys for Drizly customers whose credit card information was allegedly compromised by hackers asked a Massachusetts federal judge to award them $1.2 million in attorney fees and costs for their work on the case the alcohol delivery company has agreed to settle for as much as $7.1 million.

The Boston-based company had agreed to pay the group of class attorneys — from Block & Leviton LLP, Keller Lenkner LLC, Lowey Dannenberg PC, Carlson Lynch LLP and Thompson Consumer Law Group PC — up to $1.2 million, in addition to the settlement funds that are to be paid to about 2.5 million affected consumers.  The attorneys urged U.S. District Judge Leo T. Sorokin to sign off on the about $1.9 million in fees and about $13,000 in costs for their work on the case, which the firms predicted would have been "fiercely contested" and faced significant risks for the customers' claims.

"These risks are compounded by the fact that data breach litigation is a relatively novel area of law," the class counsel said.  "The most immediate risk of a potential adverse ruling involved Drizly's motion to compel arbitration, which was pending when the parties reached this settlement."  The attorneys said even if the customers won on the arbitration question, Drizly would have kicked the issue to the First Circuit to review, dragging out the litigation and increasing the risk that the case could have ended with no benefit to the class.

Altogether, the legal team spent more than 1,100 hours on the case, resulting in a lodestar amount of $670,199, according to the attorneys. The fee request amounts to a "reasonable" multiplier of 1.7 from that number, the attorneys said.  Hourly billing rates for the attorneys ranged from $575 to $1025 for partner-level lawyers, $400 to $800 for associates and $200 to $315 for paralegals and other nonattorney staff, the filing said.  The request also seeks $8,000 in awards to be split between the four named plaintiffs in the class.

A group of Drizly customers filed suit against the alcohol e-commerce company in August 2020 after it warned users of a major data breach the month before. The potential class action suit claimed the company was slow to report the breach, and customers cited evidence they said showed their credit card details had been for sale on the dark web since February 2020.

Drizly, which is being acquired for $1.1 billion by Uber Technologies Inc., in November asked the court to send the dispute to arbitration due to a provision in its terms of service as well as a class action waiver that it said barred the collective action.  The parties met in January — the arbitration question still pending — and agreed to settlement terms within a week.