A D.C. federal judge gave an early blessing on Tuesday to a $63 million settlement that would allow government workers affected by the 2015 cyberattack on the U.S. Office of Personnel Management to recoup up to $10,000 apiece.
U.S. District Judge Amy Berman Jackson preliminarily approved the settlement between the OPM, contractor Peraton Risk Decision Inc., and a class of current, former and prospective government workers who can show they spent money, or time, responding to the data theft. Peraton conducts background checks for federal agencies.
Judge Jackson found that the deal, which would provide awards between $700 and $10,000 to eligible persons, would confer substantial benefits to the class while avoiding the costs and risks of continuing multidistrict litigation sparked by the hack.
“The settlement falls within the range of possible recovery for the class, compares favorably with the potential recovery as balanced against the risks of continued litigation, does not grant preferential treatment to named plaintiffs or their counsel and has no obvious deficiencies,” she said.
The U.S. government will separately cover the class’s legal fees. These fees will not be subtracted from the fee award, according to the proposed deal.
The settlement resolves the long-running legal claims that have percolated through the U.S. courts in the wake of a June 2015 incident that compromised the financial records, Social Security numbers and other personal information of anyone who underwent a background check at the OPM since 2000. That breach, according to the OPM, affected about 21.5 million people and is believed to be one of the largest ever thefts of personal data from the U.S. government.
The cyberattack, which cybersecurity experts widely agree was carried out on behalf of a foreign government, sparked litigation across the U.S. before being consolidated into multidistrict litigation assigned to the D.C. court.
Judge Jackson had initially tossed the case in its early stages in 2017, saying the workers hadn’t alleged an injury beyond the data theft. But a three-judge panel on the D.C. Circuit rescued the claims in 2019. The hack left victims especially vulnerable to identity theft, and that risk was enough to establish their standing to sue during the pleading stage, the appeals panel said, splitting with several sister circuits.
Under the proposed settlement, the federal government would cover the bulk of the settlement fund — $60 million — while Peraton would contribute $3 million. Judge Jackson will hold a fairness hearing on Oct. 14, where class members critical of the deal will have an opportunity to contest it, according to the Tuesday order.
The employees are represented by Daniel C. Girard, Jordan Elias and Simon S. Grille of Girard Sharp LLP, Peter A. Patterson and David H. Thompson of Cooper & Kirk PLLC, Tina Wolfson of Ahdoot & Wolfson PC, and Gary E. Mason of Mason LLP.
The case is In re: Office of Personnel Management Data Security Breach Litigation, case number 1:15-mc-01394, in the U.S. Distrct Court for the District of Columbia.
