Kondo, et. al. v. Creative Services, Inc

If you received a notice about this settlement by mail or email, Creative Services, Inc.’s records indicate you may be a member of the Settlement Class. The United States District Court for the District of Massachusetts authorized this Notice because you have the right to know about the proposed Settlement of this class action lawsuit and about all of your rights and options before the Court decides whether to grant final approval of the Settlement. The Notice explains the lawsuit, the Settlement, your legal rights, what benefits are available, who is eligible for them, and how to get them.

The Honorable Denise J. Casper, Federal Judge, of the U.S. District Court for the District of Massachusetts is overseeing this class action. The case is known as Kondo, et. al. v. Creative Services, Inc., 1:22-cv-10438-DJC (D. Mass.) (the “Action”). The people who filed this lawsuit are called the “Plaintiffs” and the entity they sued, Creative Services, Inc., (“CSI”), is called the “Defendant.” The Plaintiffs and the Defendant agreed to this Settlement.

On or about November 26, 2021, CSI discovered, that, as part of a cyberattack cybercriminals may have copied without authorization files from servers under CSI’s custody or control. As a result, Personal Information of approximately 165,210 employees of CSI and its customers may have been accessed by cybercriminals. Impacted Personal Information may have included name, date of birth, Social Security number, financial account number, and/or driver’s license number.

The Plaintiffs claims that CSI failed to adequately protect their Personal Information and other Class Members’ Personal Information and that they and other Class Members were injured as a result. CSI denies these and all other claims made in the Action. CSI denies any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing or that the law has been violated. By entering into the Settlement, CSI is not admitting that it did anything wrong.

In a class action, one or more people called the Class Representatives sue on behalf of all people who have similar claims. Together all of these people are called a Class or Class Members. One court resolves the issues for all Class Members, except for those Class Members who exclude themselves from the Class.

The Settlement Class Representatives in this case are Ryosuke Kondo, Santos Acosta, Kristopher Farley, Edward Del Vecchio, Jorge Cifuentes, Celina Li, Hannah Page, Pasquele Russolillo, Gary Schepis, Daniel Durgin, Valerie Locke, Michael Mercurio, and Lisa MacGillivray.

The Settlement Class Representatives and CSI do not agree about the claims made in this Action. The Action has not gone to trial and the Court has not decided in favor of the Settlement Class Representatives or CSI. Instead, the Settlement Class Representatives and CSI have agreed to settle the Action. The Class Representatives and the attorneys for the Class (“Class Counsel”) believe the Settlement is best for all Class Members because of the risks and uncertainty associated with continued litigation and the nature of the defenses raised by CSI.

The Court has decided that everyone who fits the following description is a member of the Settlement Class:

All persons and entities that utilized CSI’s services whose  personally identifiable information (“PII”) was potentially accessible to a third party in the cybersecurity incident involving Defendant CSI’s computer system that occurred in November 2021.¹

If you received Notice of this Settlement, you have been identified by the Claims Administrator as a Settlement Class Member. More specifically, you are a Settlement Class Member, and you are affected by this Settlement.

You may contact the Claims Administrator if you have any questions as to whether you are a Settlement Class Member.

¹ The Settlement Class specifically excludes: (i) CSI and its respective officers and directors; (ii) all members of the Settlement Class who timely and validly request exclusion from the Settlement Class; (iii) the Judge and Magistrate Judge assigned to evaluate the fairness of this settlement; and (iv) any other Person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding, or abetting the Data Incident or who pleads nolo contender to any such charge.

Yes, the Settlement does not include: (1) the judges presiding over this Litigation, and members of their direct families; (2) the Defendant, its subsidiaries, parent companies, successors, predecessors, and any entity in which the Defendant or its parents have a controlling interest and their current or former officers and directors; and (3) Settlement Class Members who submit a valid Request for Exclusion prior to the Opt-Out Deadline.

If you are still not sure whether you are a Class Member, you may email the Claims  Administrator at info@CreativeServicesDataBreachSettlement.com, or call the Claims Administrator’s toll-free number at 1-888-614-5993, or by writing to: CSI Data Breach Settlement, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

As a Class Member, you are eligible to make a claim for one or more of the following:

• Compensation for Out-of-Pocket Losses: The following compensation available to Settlement Class Members who submit valid and timely claim forms. Claims will be subject to review for completeness and plausibility by a Claims Administrator. Compensation for documented unreimbursed losses, up to a total of $3,000.00 per person, upon submission of a claim and supporting documentation as needed.
• Lost Time: Up to 4 hours of lost time, at $25/hour (not to exceed $100) for time spent dealing with the Data Breach. Class members may submit claims for lost time with an attestation that they spent the claimed time responding to issues raised by the Data Incident.
• Identity Theft Protection and Credit Monitoring: All Eligible Class Members who file a valid Claim Form can sign up for two years of Credit Monitoring/ID Theft Protection Services. The 3-Bureau credit monitoring services includes identity-theft protection insurance.

In addition, CSI has agreed to take certain remedial measures and enhanced security measures as a result of this Action.

You may elect to submit a Claim Form for reimbursement of Out-of-Pocket Losses. If you spent money remedying or addressing identity theft and fraud that was more likely than not related to the Data Security Incident or you spent money to protect yourself from future harm because of the Data Security Incident, and this amount was not otherwise recoverable through insurance, you may make a claim for Out-of-Pocket Losses for reimbursement of up to $3,000.

Out-of-Pocket Losses consist of unreimbursed losses incurred on or after November 2021, that were related to identity theft and fraud and are more likely than not a result of the Data Security Incident, as well as any expenses related to the Data Security Incident. For example, credit card or debit card cancellation or replacement fees, late fees, declined payment fees, overdraft fees, returned check fees, customer service fees, credit-related costs associated with purchasing credit reports, credit monitoring or identity theft protection, costs to place a freeze or alert on credit reports, costs to replace a Social Security number, professional services, and out-of-pocket expenses for notary, fax, postage, delivery, copying, mileage, and long-distance telephone charges. Other losses or costs related to the Data Security Incident that are not insurance reimbursable may also be eligible for reimbursement. To protect the Settlement Fund and valid claims, all Claim Forms submitted that seek payment related to credit or debit card fraudulent transactions will be carefully scrutinized by the Claims Administrator.

Claims for Out-of-Pocket Losses must be supported by third party documentation. Third party documentation means written documents supporting your claim, such as credit card statements, bank statements, invoices, telephone records, and receipts.

To the extent there are any funds remaining, they may be applied to a pro rata increase of the baseline amounts provided to each claimant. To the extent there still remains additional funds, they shall be distributed to a cy pres recipient.

To receive reimbursement for Out-of-Pocket Losses, you must submit a completed Claim Form electing to receive reimbursement for Out-of-Pocket Losses. If you file a Claim Form for Out-of-Pocket Losses and it is rejected by the Claims Administrator and you do not correct it, you will not be eligible for reimbursement of Out-of-Pocket Losses.

In addition to Reimbursement for Out-of-Pocket Losses, you may elect to submit a Claim Form for reimbursement of Attested Lost Time. If you lost time related to your efforts undertaken to respond issues raised by the Data Incident, you may make a claim for Reimbursement for Attested Lost and Expenses for up to four (4) hours of lost time at a rate of $25 per hour, for a maximum of $100.

To the extent there are any funds remaining, they may be applied to a pro rata increase of the baseline amounts provided to each claimant. To the extent there still remains additional funds they shall be distributed to a cy pres recipient.

To receive reimbursement for Attested Time you must submit a completed Claim Form online or by mail electing to receive reimbursement for Attested Time. If you file a Claim Form for Attested Time and it is rejected by the Claims Administrator and you do not correct it, you will not be eligible for reimbursement of Attested Time.

All Eligible Class Members who file a valid Claim Form can sign up for two years of 3-Bureau credit monitoring services that includes identity-theft protection insurance as part of their Settlement Benefits.

To the extent there are any funds remaining, they may be used for up to an additional two years of credit monitoring to Class Members that signed up for credit monitoring (in addition to the credit monitoring allowed above). To the extent there still remains additional funds they shall be distributed to a cy pres recipient.  

Court awarded attorneys’ fees up to a maximum of 33% of the $1.2 million Settlement Fund (i.e., $396,000), reasonable costs and expenses incurred by attorneys for the Class up to $50,000, Administrative Expenses for costs of the settlement administration, and a Service Award of up to $1,500 per Class Representative will be deducted from the Settlement Fund before making payments to Class Members. The Court may award less than these amounts. The remainder of the Settlement Fund (the “Net Settlement Fund”) will be distributed to Participating Settlement Class Members.

In the event that the aggregate value of all claims exceeds the Net Settlement Fund, then the value of such payments shall be applied to a pro rata increase of the baseline amounts provided to each claimant.  To the extent there still remains additional funds, they shall be distributed to a cy pres recipient.

CSI agrees to provide Class Counsel with information concerning the remedial actions taken since the Data Security Incident to enhance its cybersecurity training and awareness programs, data security policies, security measures, including, but not limited to, encryption, monthly vulnerability scans, risk assessments, inside-out penetration tests, annual checks, restrictions to accessing Personal Information, and its monitoring and response capabilities.

The Settlement provides a $1.2 million Settlement Fund and remedial actions to be taken by CSI for the benefit of the Class. This fund does not include the value of CSI’s remedial measures and enhanced security measures. Any court-approved attorneys’ fees, costs, and expenses, Service Awards to the Class Representatives, taxes due on any interest earned by the Settlement Fund, if necessary, and any notice and settlement administration expenses will be paid out of the Settlement Fund, and the balance (“Net Settlement Fund”) will be used to pay for the above Settlement Benefits. Any costs associated with CSI’s remedial and enhanced security measures will be paid by CSI in addition to the Settlement Fund. 

Unless you exclude yourself, you are choosing to remain in the Class as a Participating Settlement Class Member. If the Settlement is approved and becomes final, all of the Court’s orders will apply to you and legally bind you. You will not be able to sue, continue to sue, or be part of any other lawsuit against CSI and related parties about the legal issues in this Action, resolved by this Settlement, and released by the Class Action Settlement Agreement and Release. The specific rights you are giving up are called Released Claims.

In exchange for the Settlement, each of the Settlement Class Representatives and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns, present and former (“Releasing Parties”), shall be deemed to have fully, finally, and forever released, acquitted, and discharged CSI and its present and former predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all of their past, present, and future officers, directors, employees, stockholders, partners, servants, agents, successors, attorneys, advisors, consultants, representatives, insurers, reinsurers, subrogees and the predecessors, successors, and assigns of any of the foregoing (collectively, the “Released Persons”) from any and all Released Claims. This release expressly includes CSI’s insurer with respect to all obligations under any part of the insurance policy applicable to the Released Claims, and from any and all claims arising out of the investigation, handling, adjusting, defense, or settlement of the claim including, without limitation, any claims for negligence, invasion of privacy, violations of various applicable state laws, including, but not limited to Massachusetts state statutes, and other various federal statutes not specified herein.

“Released Claims” means any and all claims or causes of action of every kind and description, including any causes of action in law, claims in equity, complaints, suits, or petitions, and any allegations of wrongdoing, demands for legal, equitable or administrative relief (including, but not limited to, any claims for injunction, rescission, reformation, restitution, disgorgement, constructive trust, declaratory relief, compensatory damages, consequential damages, penalties, exemplary damages, statutory damages, punitive damages, attorneys’ fees, costs, interest or expenses) that the Releasing Parties had, have, or may claim now or in the future to have (including, but not limited to, assigned claims and any and all “Unknown Claims” as defined below) that were or could have been asserted or alleged arising out of the same nucleus of operative facts as any of the claims alleged or asserted in the Litigation, including but not limited to the facts, transactions, occurrences, events, acts, omissions, or failures to act that were alleged, argued, raised, or asserted in any pleading or court filing in the Litigation, including but not limited to those concerning: 1) the disclosure of the Participating Settlement Class Members’ personal information in the Data Security Incident; 2) CSI’s maintenance of the Participating Settlement Class Members’ personal information as it relates to the Data Security Incident; 3) CSI’s security policies and practices as it relates to the Data Security Incident; or 4) CSI’s provision of notice to the Participating Settlement Class Members following the Data Security Incident.

The Released Claims include the release of Unknown Claims. “Unknown Claims” means claims that could have been raised in the Litigation and that any of the Settlement Class Representative or Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns, does not know or suspect to exist, which, if known by him, her, or it, might affect his, her, or its agreement to release CSI and its present and former predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all of their past, present, and future officers, directors, employees, stockholders, partners, servants, agents, successors, attorneys, advisors, consultants, representatives, insurers, reinsurers, subrogees and the predecessors, successors, and assigns of any of the foregoing, or the Released Claims, or might affect his, her or its decision to agree, object, or not to object to the Settlement. Upon the Effective Date, each of the Settlement Class Representative and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns s shall be deemed to have, and shall have, waived any and all provisions, rights and benefits conferred by any law of any state, the District of Columbia or territory of the United States, by federal law, or principle of common law, or the law of any jurisdiction outside of the United States. The Settlement Class Representative and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns acknowledge that they may discover facts in addition to or different from those that they now know or believe to be true with respect to the subject matter of the Release, but that it is their intention to finally and forever settle and release the Released Claims, including but not limited to any Unknown Claims they may have, as that term is defined in this Paragraph.

More information is provided in the Class Action Settlement Agreement and Release.

You must complete and submit a Claim Form online by August 10, 2023, 11:59 pm Pacific Time, or via mail so the form is postmarked by August 10, 2023. Claim Forms may be submitted online, or printed and mailed to the Claims Administrator at the address on the form. Claim Forms are also available by calling 1-888-614-5993 or by writing to CSI Data Breach Settlement, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103. The quickest way to file a claim is online.

If you received a Notice by mail, use your Class Member ID to file your Claim Form. If you lost or do not know your Class Member ID, please call 1-888-614-5993 or email info@CreativeServicesDataBreachSettlement.com to obtain it.

You may submit a claim for Out-of-Pocket Losses and/or Attested Time by submitting a Claim Form on the Settlement Website, or by downloading, printing, and completing a paper Claim Form, and mailing it to the Claims Administrator.

Of the Settlement Benefits provided under the Settlement, you may file a claim for reimbursement for Out-of-Pocket Losses and/or Attested Lost Time and Expenses.

To file a claim for reimbursement of Out-of-Pocket Losses of up to $3,000, you must submit a valid Claim Form electing to receive reimbursement for Out-of-Pocket Losses. To submit a claim for reimbursement of Out-of-Pocket Losses, you may either complete a Claim Form on the Settlement Website by August 10, 2023 or print and mail a completed Paper Claim Form to the Claims Administrator, postmarked on or before August 10, 2023.

The Claim Form requires that you sign the attestation regarding the information you provided and that you include third party documentation, such as credit card statements, bank statements, invoices, telephone records, and receipts.

If your claim for reimbursement of Out-of-Pocket Losses is rejected by the Claims Administrator and you do not correct it, and you will not be eligible for reimbursement of Out-of-Pocket Losses.

Instructions for filling out a claim for reimbursement of Out-of-Pocket Losses are included on the Claim Form. 

The deadline to file a claim for reimbursement of Out-of-Pocket Losses is August 10, 2023. Claims must be filed or postmarked if mailed by this deadline.

To file a claim for reimbursement of Attested Time of up to $100, you must submit a valid Claim Form electing to receive reimbursement for Attested Time. To submit a claim for reimbursement of Attested Lost Time, you may either complete a Claim Form on the Settlement Website by August 10, 2023 or print and mail a completed paper claim form to the Claims Administrator, postmarked on or before August 10, 2023.

The Claim Form requires that you indicate the number of hours (up to 4) lost to efforts undertaken to prevent or mitigate fraud or identity theft following the announcement of the Data Security Incident. The Claim Form also requires that you sign the attestation regarding the information you provided concerning reimbursement of Attested Time.

Instructions for filling out a claim for reimbursement of Attested Time are included on the Claim Form.

The deadline to file a claim for reimbursement of Attested Time is August 10, 2023. Claims must be filed or postmarked if mailed by this deadline.

If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Claims Administrator of your updated information. You may notify the Claims Administrator of any changes by emailing info@CreativeServicesDataBreachSettlement.com, by calling 1-888-614-5993, or by writing to:

Creative Services Data Breach Settlement
c/o Claims Administrator
1650 Arch Street
Suite 2210
Philadelphia, PA 19103

Payment for valid claims for reimbursement for Out-of-Pocket Losses and/or Attested Lost Time, will be provided by the Claims Administrator after the Settlement is approved by the judge and becomes final. You may elect to receive payment for valid claims for Out-of-Pocket Losses and/or Attested Time via Zelle, Venmo, or PayPal instead of a MasterCard pre-paid debit card or check by submitting the appropriate information with your Claim Form filed through the Settlement Website. Anyone who does not elect to receive payment via Zelle, Venmo, or PayPal will receive their payment via a MasterCard pre-paid debit card or check sent through U.S. Mail.

The court approval process may take time. Please be patient and check this site for updates.

None of the money in the $1.2 million Settlement Fund will be paid back to CSI. To the extent there are any funds remaining, they may be applied to a pro rata increase of the baseline amounts provided to each claimant. To the extent there still remains additional funds, they shall be distributed to a cy pres recipient.

Yes, the Court has appointed David Lietz of Milberg Coleman Bryson Phillips Grossman PLLC as Class Counsel to represent you and the Class for the purposes of this Settlement. You may hire your own lawyer at your own cost and expense if you want someone other than Class Counsel to represent you in this Action.

Class Counsel will file a motion asking the Court to award them attorneys’ fees of up to a maximum of 33% of the $1.2 million Settlement Fund (i.e., $396,000), plus reasonable costs and expenses up to $50,000. They will also ask the Court to approve up to $1,500 as a Service Award to each Class Representative for participating in this Action and for their efforts in achieving the Settlement. If awarded, these amounts will be deducted from the Settlement Fund before making payments to Class Members. The Court may award less than these amounts.

Class Counsel’s application for attorneys’ fees and expenses, and the Service Awards, will be made available on the Important Documents page of this Settlement Website before the deadline for you to comment or object to the Settlement. You can request a copy of the application by emailing the Claims Administrator at info@CreativeServicesDataBreachSettlement.com or calling  1-888-614-5993.

To exclude yourself from the Settlement, you must complete and sign a Request for Exclusion. The Request for Exclusion must be in writing and identify the case name Kondo, et. al. v. Creative Services, Inc., 1:22-cv-10438 (D. Mass.); state the name, address, and telephone number of the Class Members seeking exclusion; be physically signed by the Person(s) seeking exclusion; and must also contain a statement to the effect that “I/We hereby request to be excluded from the proposed Settlement Class in Kondo, et. al. v. Creative Services, Inc., 1:22-cv-10438 (D. Mass.).”  The Request for Exclusion must be mailed so that it is postmarked or received by the Claims Administrator at the address below no later than June 26, 2023:

Creative Services Data Breach Settlement
Attn: Exclusions
P.O. Box 58220
Philadelphia, PA 19102

You cannot exclude yourself by telephone or by e-mail.

No. If you exclude yourself, you are telling the Court that you do not want to be part of the Settlement. You can only get a cash payment if you stay in the Settlement and submit a valid Claim Form.

No. Unless you exclude yourself, you give up any right to sue CSI and Released Parties for the claims that this Settlement resolves. You must exclude yourself from this Action to start or continue with your own lawsuit or be part of any other lawsuit against CSI or any of the Released Parties. If you have a pending lawsuit, speak to your lawyer in that case immediately.

Objecting is telling the Court you do not like something about the Settlement. You can object only if you stay in the Class (that is, do not exclude yourself). Requesting exclusion is telling the Court you do not want to be part of the Class or the Settlement. If you exclude yourself, you cannot object to the Settlement because it no longer affects you.

The Court will hold a Final Approval Hearing on September 7, 2023 at 3:00 pm before the Honorable Denise J. Casper, United States District Court for the District of Massachusetts, 1 Courthouse Way, Suite 2300, Boston, Massachusetts 02210.

The date and time of the Final Approval Hearing is subject to change without further notice to the Settlement Class. Class Members should monitor this Website or the Court’s PACER site to confirm whether the date for the Final Approval Hearing is changed.

At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate, and will decide whether to approve: the Settlement; Class Counsel’s application for attorneys’ fees, costs and expenses; and the Service Award to the Class Representative. If there are objections, the Court will consider them. The Court will also listen to people who have asked to speak at the hearing.

No. Class Counsel will answer any questions the Court may have. However, you are welcome to attend at your own expense. If you send an objection, you do not have to come to Court to talk about it. As long as you mail your written objection on time, the Court will consider it.

Yes. If you wish to attend and speak at the Final Approval Hearing, you must indicate this in your written objection (see Question 28). Your objection must state that it is your intention to appear at the Final Approval Hearing and must identify any witnesses you may call to testify or exhibits you intend to introduce into evidence at the Final Approval Hearing. If you plan to have your attorney speak

If you are a Class Member and you do nothing, you will not receive any Settlement Benefits. You will also give up certain rights, including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against CSI or any of the Released Parties about the legal issues in this Action and released by the Settlement Agreement.

This Notice summarizes the proposed Settlement. For the precise terms and conditions of the Settlement, please see the Settlement Agreement, or by contacting Class Counsel (see below), or by accessing the Court docket in this case, for a fee, through the Court’s Public Access to Court Electronic Records (PACER) system at https://ecf.cand.uscourts.gov.

If you have questions about the proposed Settlement or anything in this Notice, you may contact Class Counsel at:

David Lietz
MILBERG COLEMAN BRYSON PHILLIPS GROSSMAN, PLLC
5335 Wisconsin Avenue NW
Suite 440
Washington, D.C. 20015-2052
Telephone: (866) 252-0878
Facsimile: (202) 686-2877
dlietz@milberg.com

PLEASE DO NOT CONTACT THE COURT OR THE COURT CLERK’S OFFICE TO INQUIRE ABOUT THIS SETTLEMENT OR THE CLAIM PROCESS.