U.S. District Judge Lucy Koh signed off on the $117.5 million data breach settlement with Yahoo Inc. on Tuesday, but she slashed attorney fees by more than $7 million after concluding the deal was "unexceptional" and the legal work "not particularly novel."

In her Tuesday order, amended on Wednesday, Koh found the settlement, which resolved the claims of an estimated class of 194 million Yahoo users, was reasonable, despite her assessment that she would have "expected a larger settlement."

Her biggest criticism, however, focused on the plaintiffs' request for $30 million in attorney fees, which she deemed "an unreasonable windfall to class counsel." She also questioned how difficult the Yahoo litigation really was, especially when compared to a $115 million data breach settlement with Anthem Inc., which she called "exceptional" when approving it in 2018.

"Here, the court finds that the result and benefit obtained for the settlement class are fair, reasonable, and adequate, but unexceptional," she wrote. She also found that "many of the legal theories involved in the instant case were not particularly novel," especially given that she addressed them already in Anthem and other cases.

Lead plaintiffs counsel John Yanchunis of Morgan & Morgan in Tampa, Florida, did not return a call for comment. He previously has said about the fees: "We took this case on a contingent basis, and we were not paid at the time any of this work was done. We advanced costs and expenses to the benefit of the class, and I know a comment has been made that this was a no-risk case — I would beg to differ."

The Yahoo order is the latest in which Koh has scrutinized fee requests in class actions, particularly the billing records of the plaintiffs firms leading the cases. In Anthem, she brought in a special master to review the bills, telling plaintiffs attorneys she was "deeply disappointed" that they would bring 49 additional law firms into the case.

The Yahoo settlement includes a fund that provides out-of-pocket costs and two years of credit monitoring or, if class members already have such coverage, alternative compensation of up to $50. It also includes injunctive relief, which Koh praised, in the form of changed business practices.

Yet Koh has criticized the fee request from the start, rejecting the initial $85 million settlement with Yahoo after finding the $35 million in attorney fees "unreasonably high." She also questioned the involvement of 143 attorneys given she appointed only five lawyers to the case.

Last year, she preliminarily approved the revised deal, which increased the settlement fund, but continued to have questions about the number of law firms seeking fees.

At a June 18 final approval hearing, held via Zoom, Koh probed plaintiffs attorneys about specific billing records, demanding that she receive the total number of attorneys, law clerks and others who billed on the case. "I'm not going to award any attorney fees until I get it," she told them.

In Tuesday's order, she chipped away at the plaintiffs' estimated $19 million lodestar, which is the hourly rate billed times the number of hours worked on the case. For the most part, however, she signed off on the hourly rates and, unlike in Anthem, in which she cut more than $9 million in fees, she made little mention about contract attorneys or the number of law firms involved.

Instead, her reduced fee award of $22.7 million, which is 19.4% of the settlement, came mostly from the multiplier, used to reward plaintiffs firms for the risks and difficulties of litigating the case while on contingency. In her order, she targeted the lawyers' acumen, which was "not without errors."

"The instant case involved technical subject matter and a substantial class size, both of which class counsel ably handled," she wrote. "However, class counsel ultimately prepared limited legal filings with numerous overlapping issues, class counsel completed limited discovery relative to the scope of the alleged claims, and class counsel erred with respect to the first motion for preliminary approval."

In this case, she wrote, the amount of the settlement fund was due to the size of the class, once estimated to be as many as 200 million people, and not the skill of the lawyers. In fact, each class member would receive just 60 cents, far less than in other cases.

The case had a low volume of work, she said, and plaintiffs attorneys had stronger facts than in other data breach lawsuits because the case involved multiple cyberattacks dating back to 2013 that Yahoo allegedly covered up and did not report until 2016. That meant plaintiffs attorneys "wielded more leverage to achieve a favorable settlement" than in other data breach cases, she wrote.

"All in all, in light of the number of data breaches, the larger settlement class size, Yahoo's failures to timely disclose, Yahoo's misleading public statements, and the sale of the breached Yahoo data on the dark web, the court would have expected a larger settlement here than in Anthem," Koh wrote. "Instead, the parties largely followed the Anthem settlement. Nonetheless, the court concludes that the $117.5 million amount offered in settlement is a significant sum and weighs in favor of approval."