Show Your Work: California Federal Court Denies Preliminary Approval Of Data Breach Class Action Settlement

Duane Morris Takeaways: On September 16, 2026, in Jimenez, Jr., et al. v. OE Federal Credit Union, Case No. 24-CV-02746 (N.D. Cal. Sept. 16, 2026), U.S. District Judge Jon S. Tigar of the U.S. District Court for the Northern District of California denied plaintiffs’ motion for preliminary approval of a class action settlement in a data breach case involving over 220,000 individuals. The decision is a significant reminder that courts will scrutinize class action settlements for obvious deficiencies, and that plaintiffs seeking preliminary approval must “show their work” by providing detailed information about the relative value of their claims and the strengths and weaknesses of their case.

Case Background

Plaintiffs Daniel Jimenez Jr., Mark Hendren, and Erica Jaramillo are current or former customers of OE Federal Credit Union (“OEFCU”), which is described as “the country’s largest labor-based credit union.” Order at 1. OEFCU possessed its customers’ personally identifiable information (“PII”) and protected health information (“PHI”), including full names, Social Security numbers, dates of birth, bank and financial account information, driver’s license numbers, medical procedure information, and health insurance information. Id. Sometime between August 19, 2023 and October 29, 2023, OEFCU suffered a ransomware attack and data breach resulting in unauthorized access to the PII/PHI of the named plaintiffs and the putative class.

Plaintiffs filed suit alleging claims for negligence, breach of implied contract, invasion of privacy, unjust enrichment, violation of the California Unfair Competition Law, violation of the California Consumer Privacy Act, violation of the California Customer Records Act, and declaratory relief. They brought claims on behalf of themselves and a class of all persons identified as being impacted by the data breach. After OEFCU moved to dismiss, the Court granted the motion in part and denied it in part, dismissing several claims with leave to amend and the declaratory relief claim with prejudice.

The parties subsequently engaged in mediation and reached a proposed class settlement. Under the proposed settlement, OEFCU agreed to establish a non-reversionary settlement fund of $2,300,000. Id. at 3. Each class member could submit a claim of up to $5,000 for reimbursement of out-of-pocket losses traceable to the data incident. Settlement class members were also entitled to submit a claim for a pro rata cash payment from the net settlement fund, estimated at approximately $50 per claimant. California class members could claim an additional $75, subject to reduction based on the total number of claimants. The settlement agreement proposed to deduct $766,666.66 in attorney’s fees (one-third of the common fund), $5,000 each to the three class representatives as service awards, and undetermined amounts for litigation costs and settlement administration costs. Id.

The Court’s Decision

Judge Tigar denied the motion for preliminary approval, identifying seven deficiencies that collectively prevented a finding that the settlement fell “within the range of possible approval” under Rule 23(e)(2). See In Re Tableware Antitrust Litig., 484 F. Supp. 2d 1078, 1079 (N.D. Cal. 2007).

Adequacy of Relief — Rule 23(e)(2)

The first four deficiencies all bore on whether the proposed settlement provided adequate relief to the class. The Court began by questioning the use of a claims-made distribution process, noting that because OEFCU could readily identify class members from its own records, requiring them to submit claims was unnecessary and would predictably depress the actual payout — “[t]he effect of not simply distributing relief to the known class members is that the defendant will likely pay out much less than it would if there were no claiming process.” Order at 6. The Court noted that claims-made settlements are appropriate when it is the best or only option available, as is often the case with consumer class actions. Id. The Court faulted Plaintiffs for providing no information about the maximum potential recovery at trial, offering instead only boilerplate that the settlement “provides significant relief” and “is well within the range of other data breach settlements.” Relatedly, Plaintiffs supplied only generic statements about the “high level of risk, expense, and complexity” of continued litigation rather than a careful analysis of the claims and defenses — falling short of the Court’s requirement that movants “show their work by explaining the relative value of their claims in significant detail.” Order at 7–8 (quoting Haralson, 383 F. Supp. 3d at 970). Finally, the Court observed that the estimated $50 per-member pro rata payment was unsupported by evidence. Order at 8. After subtracting attorney’s fees alone, the actual per-member recovery was closer to $6, and would decline further once administration costs, incentive awards, and out-of-pocket reimbursement claims were accounted for — the Court noted that if just over 300 claimants sought the full $5,000 reimbursement, the pro rata share could dwindle to nothing for remaining class members. Order at 8.

Equitable Treatment — Rule 23(e)(2)(D)

The fifth deficiency concerned the settlement’s differential treatment of class members. The settlement provided California class members a higher recovery than non-California members, yet Plaintiffs identified no California subclass with distinct claims that might justify the disparity. Order at 8–9. The Court emphasized that unexplained disparate treatment “increases the likelihood that the settlement agreement does not meet the Rule 23(e) standard.” Id. at 9 (quoting Ferrington v. McAfee, Inc., No. 10-CV-01455, 2012 WL 1156399, at *8 (N.D. Cal. Apr. 6, 2012)).

Accuracy and Procedural Compliance

The final two deficiencies concerned the quality of the submission itself. The Court identified a material discrepancy between the motion’s description of the timing of payments to class members and the actual terms of the settlement agreement. Order at 9–10. The Court also found that the motion failed to comply with the Northern District of California’s Procedural Guidelines for Class Action Settlements — including the requirements to explain anticipated versus maximum class recovery, to identify the settlement administration process and its costs, and to provide information about comparable settlements. Id. at 10; see also Bakhtiar v. Info. Res., Inc., No. 17-CV-04559, 2020 WL 11421997, at *8 (N.D. Cal. Jan. 30, 2020) (“A movant’s failure to address the issues discussed in the Guidelines is a proper ground for denying a motion for preliminary or final approval of a class action settlement.”).

The Court denied the motion without prejudice to Plaintiffs’ filing a revised motion, which it ordered due by November 4, 2026. The Court also reminded the parties that the Ninth Circuit benchmark for attorney’s fees in a successful class action is 25% of the common fund, and that Plaintiffs should justify any deviation from that benchmark. Id.

Implications For Companies

The Jimenez decision is a reminder that courts will closely scrutinize class action settlements at the preliminary approval stage, particularly in data breach litigation impacting consumers. The decision underscores several key points for corporate counsel. Most importantly, parties should closely follow the Court’s Procedural Guidelines for Class Action Settlements as failure to heed those Guidelines can serve as an independent basis for denying preliminary approval.

On a more granular level, the Jimenez decision offers other relevant practice pointers for class action settlements. First, claims-made settlement structures may be disfavored where the class members are readily identifiable from the defendant’s records. Second, plaintiffs seeking preliminary approval must do more than offer boilerplate language about the risks of litigation — they must provide concrete information about the maximum potential recovery and a detailed analysis of the strengths and weaknesses of their claims. Third, settlements that provide differential treatment to subsets of class members without explanation may face heightened scrutiny under Rule 23(e)(2)(D). Companies facing data breach class actions should work closely with counsel to ensure that any settlement submissions provide the level of detail and analysis that courts increasingly require before granting preliminary approval.