U.S. District Judge Lucy Koh of the Northern District of California (Photo: ALM)

A federal judge has granted final approval in a $117.5 million class action settlement over Yahoo Inc.'s data breaches, but found that class counsel's $30 million fee request was too high.

U.S. District Judge Lucy Koh of the Northern District of California issued the order Tuesday in the litigation dating back to 2016.

The settlement class encompasses roughly 194 million people whose personal information might have been compromised through their Yahoo accounts in several data breaches over the course of five years. The average payout per class member comes out to about 60 cents, according to the ruling.

Koh disagreed with plaintiffs attorneys that the percentage-of-recovery method is the best way to determine attorney fees in the case. "Instead, having overseen this case for four years, the court finds that justice would be best served by applying the lodestar method—i.e., tying the fee awards for class counsel to the actual hours they reasonably expended on this litigation and then selecting a multiplier," she wrote.

Koh compared the per-capita recovery for class members in the settlement with the $1.46 earned per class member in the Anthem data breach litigation, which she also oversaw. "Here, by contrast, the per-capita recovery is roughly $0.60 per settlement class member," she said. "In light of this disparity, the court is therefore convinced that the size of the settlement fund is largely a function of the size of the settlement class, and 'not entirely attributable to class counsel's skill.'"

As part of the settlement, Yahoo will also funnel $66 million per year into its information security budget until 2022, which is four times more that it spent on average from 2013 to 2016, according to the ruling. The company has also agreed to hire 200 full-time information security employees through 2022, compared with the 48 it employed the year the lawsuit was filed.

"These non-monetary forms of relief benefit millions of settlement class members, including those who do not submit a claim form," Koh wrote. "The court finds that this nonmonetary relief weighs in favor of final approval."

The ruling was not the first time Koh voiced concerns about attorney fees in the case. In June, Koh asked plaintiffs lawyers to provide more billing details, saying that she would not award attorney fees without getting one document laying out the total number of billers by firm and position.

Read more: In $117.5M Yahoo Data Breach Settlement, Judge Koh Has More Questions

Judge Hammers Plaintiffs Counsel, Rejects Yahoo Breach Settlement

Yahoo Agrees to Pay $85M to Settle Consumer Data Breach Class Actions