A data breach that touched more than 31 million lives has now closed with a payout that ranks among the largest of its kind in American legal history — though not without a judge stepping in to shave down what lawyers wanted to pocket for themselves. A Pennsylvania federal judge granted final approval Wednesday to a $117.5 million settlement stemming from the breach, while trimming roughly $7 million off the attorney fee request in the process.

A Fee Request Cut Down to Size

U.S. District Judge John Younge awarded class counsel less than a third of the total settlement amount in fees, landing at $31.7 million rather than the $39 million attorneys had originally sought — a reduction that, while modest in percentage terms, still represents millions of dollars redirected elsewhere.

The Scale of the Settlement

Judge Younge didn't shy away from putting the deal's significance into context. "The settlement establishes a $117,500,000 nonreversionary common fund for the benefit of approximately 31.5 million settlement class members. This is among the largest data breach class action settlements in United States history and delivers, on a per capita basis, one of the strongest recoveries ever achieved in a major consumer data breach settlement," he said — language that positions this case as a genuine landmark rather than just another privacy suit resolved quietly.

How the Judge Calculated Fees

In determining the attorney fee award, Judge Younge relied on what's known as the "percentage of recovery" method, where a judge assigns fees as a set share of the total settlement, rather than the alternative "lodestar" approach, which multiplies hours worked by an hourly billing rate — essentially choosing to size the reward based on the outcome achieved rather than the labor logged.

The Math Behind the 27% Figure

The judge didn't spell out exactly how he arrived at the specific 27% figure, beyond noting that the Third Circuit treats 25% as the general benchmark for attorney fees in class action cases, with room for adjustments upward or downward depending on the particulars of a given case.

Crediting the Legal Work Behind the Recovery

Judge Younge made clear that both sides had been capably represented throughout the litigation. He went further in crediting the outcome specifically to the plaintiffs' legal team, noting that no parallel government investigation or enforcement action had contributed any portion of the settlement fund. "The entirety of the recovery achieved for the class is attributable to class counsel's efforts," he wrote, adding that while mass arbitrations had been filed in connection with the breach, those proceedings were largely wrapped up by the time the settlement came together and didn't factor into the final result.

Objections Overruled

The settlement also carves out representative awards for the named plaintiffs, along with reimbursements covering litigation costs and expenses. A small number of class members raised objections to both the settlement itself and the attorney fee award, but Judge Younge overruled each of those challenges.

A Case Resolved in Record Time

The judge had granted preliminary approval back in January, and in Wednesday's ruling, he noted the case reached resolution within just two years of being filed — a relatively swift timeline for litigation of this scale and complexity.

How the Breach Unfolded

The litigation traces back to lead plaintiff Kenneth Hasson, who filed the original complaint in Pennsylvania federal court in December 2023. The court later consolidated Hasson's case with 24 similar suits in March 2024, folding a scattered set of complaints into one unified legal front.

The Citrix Bleed Connection

Plaintiffs alleged Comcast failed to adequately protect customer information from an October 2023 breach tied to "Citrix Bleed," a vulnerability affecting Citrix's NetScaler products, which Comcast relied on internally — a flaw that ended up rippling out to touch tens of millions of the company's customers.

Comcast's Response

Comcast has consistently defended its handling of the incident, maintaining it acted appropriately once the breach came to light. "We acted in the best interests of our customers in responding to the Citrix Bleed incident, which impacted thousands of companies worldwide, by quickly patching the vulnerability, alerting customers, and implementing protective measures to keep them safe," the company said in a January statement to Law360. "Though we disagree with the claims, this settlement reflects our commitment to resolving this matter efficiently while continuing to prioritize the security and privacy of our customers."

Representatives for the parties did not immediately respond to requests for comment Thursday.

The Legal Teams

Hasson and the proposed class are represented by co-lead counsel Gary F. Lynch of Lynch Carpenter LLP and Norman E. Siegel of Stueve Siegel Hanson LLP, along with co-liaison counsel Charles E. Schaffer of Levin Sedran & Berman LLP and James A. Francis of Francis Mailman Soumilas PC. Comcast is represented by Paul Bond, Justin Kadoura, Mark S. Melodia, Sophie L. Kletzien, Caitlin F. Saladrigas, William F. Farley and Steven A. Block of Holland & Knight LLP.