Equifax Faces Multibillion-Dollar Lawsuit Over Hack

Attorneys' fees in a class action have to be approved by the court, and for large class actions the percentage fee tends to be lower than what a privately-retained lawyer would receive. The privately-retained lawyers in NTP's lawsuit against Blackberry got an approximately 1/3 payout of a $600 million settlement. 20-33% is quite typical in a pure contingency situation. Most court-approved fee awards in class actions that large ($100m+) tend to be a lot lower than that, in the 10-20% range. Courts usually will demand that attorneys submit their billing records (or summaries thereof) along with their fee petitions, and will regularly cut down any fee requests that exceed a certain multiple of what the attorneys invested in the case.

This case is typical: https://www.paymentcardsettlement.com/Content/Documents/Orde.... $5.7 billion settlement, about $500 million in attorneys' fees, or less than 10% of the fund. $160 million worth of time invested by the attorneys to get to that point.

> And you can't make any kind of cost argument because a billion dollar case isn't anymore complex than a million dollar case.

That's not true at all. Big dollar value cases involve either large harms to relatively fewer people, or relatively small harms to large numbers of people. The former kind of case often involves complex subject matter, such as financial transactions, medicines, etc. The latter kind of case often involves a very diverse class and complex issues of causation and damages. Consider the TicketMaster lawsuit: the basic theory of damages is that class members would not have purchased the tickets had they known that TicketMaster was marking up things like UPS charges. Well, clearly lots of class members would have purchased the tickets anyway. Coming up with a realistic damages model in that scenario is difficult. Furthermore, in big consumer class actions like that you've got class members in fifty states with fifty different sets of laws.

It really isn't genius at all. At least in my state, either party can object to the small claims status by simply sending a letter. Then it moves over to normal court with normal lawyers. Already you are out the small claims filing fee (yes, you have to pay the court to even bring a small claims case).

Once in normal court, you would need to hire a lawyer, and they would just find some local representation. At this point, you would probably withdraw the case because it isn't worth that investment.

But suppose you kept going. Their local council is going to proxy their attempts to change venue to where they are located. Unless you had a really compelling argument, they would probably win the change of venue. Now you need to find another lawyer somewhere else, and it is probably an expensive locale like New York or LA where they have a firm on retainer. Still want to push the case? Me neither.

By all means, try the small claims route. But don't think for one second that it is a slam dunk.

So let me get this right, this company collects credit information and someone hacked into their web server and stole highly sensitive information about most of the adult american population. Then the executives sold their stock a day before they announced the hack to the public. Besides the troubling fact that you still use social security and credit card numbers as any form of reliable authentication, how aren't there already federal agents searching every square inch of the company and interviewing key employees under oath? But no, nobody is securing this evidence and thus any lawsuit will probably either fail or end in a small settlement of an amount the company will not be significantly hurt by, causing no reason for stronger security in the future of this or any other company.

The kind and amount of information warrant strong regulation in the way the data can be stored and processed (separate monitored networks not reachable from the internet would be the absolute minimum), governmental regulation needs to ensure the security of sensitive personal information like this and regular checks need to be conducted to ensure their adherence, especially in the case of a breach like this after the fact, you can't rely on the company conducting a forensic investigation.

But no of course not. I can already hear Americans preach to me how the free market is great and solves all your problems.

> how aren't there already federal agents searching every square inch of the company

Usually reserved for criminal cases, not civil ones.

> regulation in the way the data can be stored and processed

Have it.

> regular checks need to be conducted to ensure their adherence

Have it.

> I can already hear Americans preach to me how the free market is great and solves all your problems.

Please quote me the "solve all your problems" source.