Sex assault victims settle with law firm over data breach

The Zalkin Law Firm PC, a San Diego firm that represents many sexual assault plaintiffs, agreed to pay nearly $300,000 to end a putative class action over a cyberattack that exposed personal information and case files from 523 clients.

“We are appreciative of the defendant’s flexibility in reaching this compromise,” the plaintiffs’ counsel, Scott E. Cole of Cole & Van Note, wrote in an email Monday. “While no admission of responsibility was offered, we consider this to be an excellent result for this modest class size.”

Zalkin Law Firm founding partner, Irwin M. Zalkin, said in an email: “On the advice of counsel, we have no comment at this time.” The defense counsel representing the firm at Manatt Phelps & Phillips could not be reached for comment.

Cole’s motion for preliminary approval of the settlement was filed last Friday in federal court in San Diego. He proposed a $285,000 non-reversionary settlement fund to be split among the 523 individuals. In addition, the plaintiffs’ counsel also seeks an unopposed request of $99,750 in attorneys’ fees and reimbursement costs. The named plaintiff seeks a service award of $3,500. Ariana Deats v. The Zalkin Law Firm PC, 3:23-cv-02005 (S.D. Cal., filed Oct. 30, 2023).

U.S. District Judge M. James Lorenz is scheduled to consider approval of the settlement on March 18.

The litigation was filed last year on behalf of Deats and 523 other former Zalkin Law Firm clients. The lawsuit stated their information including Social Security numbers and sexual abuse case details were stolen and shared on the dark web by a cybercriminal group. The group then allegedly emailed Deats, stating that it was in possession of her case file, which contained images and notes that detailed her experience as a sexual abuse victim, the complaint claimed.

The data breach was discovered by the Zalkin Law Firm on April 6, 2023. On Sept. 6, 2023, the firm sent a notice to clients informing them of the attack on its database and stated the network had since been secured. The lawsuit stated this letter didn’t reach recipients until Sept. 8 and accused the firm of failing to properly respond to the breach in a timely manner.

According to Cole’s declaration, a settlement of the class complaint was finalized on Jan. 16. “Shared among 523 individuals, this is an extraordinary result in a data breach case where values per class member often hover in the $5-10 range,” Cole wrote in the court filing. “This represents a strong recovery when viewed in comparison to what could be achieved through trial before taking into account the significant risk, cost and delay of continued litigation.”

Since Deats was the only former Zalkin Law firm client to come forward and file a lawsuit, “it is unclear how many of these 523 individuals will claim injury,” Cole wrote.

Following the subtraction of the costs of administration, attorneys’ fees and Deats’ service award, Cole wrote that if every class member made a claim, “each would receive around $300. However, class members without damages are unlikely to make a claim, allowing for more funds to be distributed to those harmed.”

Cole argued the proposal “should be presumed procedurally fair” after taking into consideration the stage of discovery, meet and confer processes, the experience of the counsel and the two months of settlement negotiations, he wrote in the court filing.