A judge who initially struck down a class action settlement over Yahoo! Inc.'s data breaches continued to have questions about a revised $117.5 million deal, particularly the class size "shrinking further and further" and the lack of billing details supporting $30 million in requested attorney fees.

At a Zoom hearing on Thursday that lasted more than three hours, U.S. District Judge Lucy Koh asked several questions about the billing submitted by plaintiffs attorneys—everything from the hourly rates of law clerks to the number of firms handling calls from class members.

She asked plaintiffs lawyers to submit more detailed billing before approving their fee request.

"I want the total number of billers, by firm, all in one document, and by position," she said, mentioning specifically project attorneys, staff attorneys, contract attorneys, law clerks and anyone else paid by the hour. "I'm not going to award any attorney fees until I get it."

Although Koh did not say whether she would grant final approval of the settlement, she indicated she would approve the fees after lawyers answered her billing questions.

"Obviously, I am going to award attorney fees," she said. "I want to make sure class members' best interests are kept in mind."

Plaintiffs lawyers said they would get back to Koh with those details in a week. But they defended their fee request.

"I believe the work in achieving the result, even though it took a second time, does and should be paid," said John Yanchunis, of Morgan & Morgan, lead counsel in the multidistrict litigation against Yahoo. "We took this case on a contingent basis, and we were not paid at the time any of this work was done. We advanced costs and expenses to the benefit of the class, and I know a comment has been made that this was a no-risk case—I would beg to differ."

Koh has scrutinized attorney fee billing in other cases, including another data breach settlement with Anthem Inc. in 2018. In that case, she brought in a special master to review the bills, telling the plaintiffs team she was "deeply disappointed" that they would bring 49 additional law firms into the case. She also sits in San Jose, California, where the Northern District of California enacted new guidelines in 2018 involving class action settlements.

The final approval hearing, initially scheduled for April 2 but delayed after the coronavirus pandemic hit, comes more than a year after Koh lashed out at plaintiffs lawyers over their initial $85 million settlement. In particular, she questioned why plaintiffs lawyers had requested "unreasonably high" attorney fees of $35 million for 143 lawyers at 32 law firms, even though she appointed only five lawyers to handle the case, which she called "not particularly novel."

Koh preliminarily approved the revised deal last year, even though she continued to have concerns about the large number of plaintiffs firms involved.

Those concerns reappeared at Thursday's hearing, at which plaintiffs attorneys said there were 31 firms submitting billing.

In their motion for fees, lawyers reduced their estimated $22 million in lodestar billing—the number of hours worked times their hourly rates—to less than $20 million. They noted that other firms brought into the case assisted in reviewing nearly 9 million pages of documents Yahoo provided in discovery.

But Koh, who issued a 2018 order prohibiting law firms not appointed in the case from billing hours without her approval, pored through specific records that revealed some had done unauthorized work.

"Why was that done in violation of my order?" she asked. "Anyone who's not authorized, I think that should be stricken. I don't think my order could have been clearer."

The settlement purports to resolve the claims of about 200 million class members in the United States and Israel, even though the breaches at issue in the litigation, dating back to 2013, affected about three billion Yahoo account holders worldwide.

On Thursday, Koh appeared irritated that the class size, which lawyers now estimated would be closer to 95 million, kept getting smaller.

"It's somewhat frustrating to have the number of class members be this constant moving target," she said, quoting former Yahoo CEO Marissa Mayer's statements in 2016 that the company had one billion users. "Every time you come back into court, this number is shrinking further and further. Unfortunately, that has been the pattern in this case."

The deadline to submit claims is July 20.

When asked how many claims were submitted, Yanchunis responded the "amount is in the gajillion number."

"I don't want to say fraud, because that doesn't sound kind, but there are some exaggerations in that number," he said.

The settlement fund provides out-of-pocket costs and two years of credit monitoring or, if class members already have such coverage, alternative compensation of $100 (an amount that could be closer to $50, given that 75% of claimants had opted for alternative compensation, according to court filings).

When asked about that response, plaintiffs lawyers pointed to the $1.4 billion Equifax settlement, which had offered similar alternative compensation.

"That's a component of the Equifax settlement," Yanchunis said. "It got a tremendous amount of press, and scrutiny, and it made consumers in the class in Yahoo better understand what that component was, and they chose that."

According to a filing by the settlement administrator this week, at least 1,868 class members had requested exclusion from the Yahoo deal, and 23 objected.

Koh, hearing from some of the objectors on Thursday, appeared receptive to a few of their arguments, most notably that the credit monitoring option in the Yahoo deal would overlap similar provisions granted in the Equifax deal.

"This issue will continue to arise as more data breach settlements are entered," Koh said.