In re: Yapstone Data Breach

Frequently Asked Questions

  1. Why was a notice issued?
  2. What is this lawsuit about?
  3. Why is this case a class action?
  4. Why is there a Settlement?
  5. How do I know whether I am part of the Settlement?
  6. Are there exceptions to being included?
  7. What if I am still not sure whether I am part of the Settlement?
  8. What does the Settlement provide?
  9. How do I get benefits?
  10. When would I receive my benefits?
  11. What if my name or address changes after I submit a Claim Form?
  12. What rights am I giving up to stay in the Settlement Class?
  13. What are the Released Claims?
  14. Do I have a lawyer in this case?
  15. How will the lawyers be paid?
  16. How do I get out of the Settlement?
  17. If I exclude myself, can I still get benefits from this Settlement?
  18. If I do not exclude myself, can I sue Yapstone for the same claims later?
  19. How do I tell the Court that I do not like the Settlement?
  20. May I come to Court to speak about my objection?
  21. What is the difference between objecting to the Settlement and asking to be excluded from it?
  22. When and where will the Court decide whether to approve the Settlement?
  23. Do I have to come to the hearing?
  24. May I speak at the hearing?
  25. What happens if I do nothing at all?
  26. How do I get more information?
  1. Why was a notice issued?

    A federal court authorized the Notice because you have a right to know about the proposed Settlement of this class action and about all of your options before the Court decides whether to grant final approval of the Settlement. This Notice explains the lawsuit, the Settlement, your legal rights, what benefits are available, and who can get them.


    Judge Jeffrey S. White of the United States District Court for the Northern District of California is overseeing this class action. The case is known as In re: Yapstone Data Breach, Case No. 4:15-cv-04429 (the “Consumer Action”). The people that filed this lawsuit are called the “Plaintiffs” and the company they sued, Yapstone Holdings, Inc., ("Yapstone") is called the “Defendant.”

    Top

  2. What is this lawsuit about?

    Yapstone discovered that certain personally identifiable information ("PII") of its users may have been exposed through unsecured online unique resource locators (“URLs”), or web addresses, when users submitted applications to use its payment processing platform. PII including the name, address, date of birth, and bank account information—and in some cases, social security numbers, driver’s license numbers, and/or passport numbers, if provided by the applicant—may have been exposed between July 15, 2014 and August 5, 2015. In September 2015, Yapstone sent an Incident Notice to potentially affected users to notify them of the Incident and offered two years of complimentary credit protection and fraud resolution. Plaintiffs claim that Yapstone maintained inadequate data security practices, delayed in notifying users of the Incident, violated various state statutes, breached implied contracts, and unfairly profited from users. Yapstone denies all of the allegations made in the lawsuit and contends that there is no evidence of actual extractions or misuse of the data at issue.

    Top

  3. Why is this case a class action?

    In a class action, one or more people called Class Representatives or Plaintiffs (in this case, Jonathan Koles, Christopher Bonnema, Daniel Adams, James Mitchell, and Robert McGuire) sue on behalf of other people with similar claims. The people with similar claims are called the Class or Class Members. One court resolves the issues for all Class Members, except for those who exclude themselves from the Class.

    Top

  4. Why is there a Settlement?

    The Court did not decide in favor of the Plaintiffs or Defendant. Instead, both sides agreed to a settlement (the “Settlement”). This way, they avoid the cost and burden of a trial and the people affected can get benefits. The Class Representatives and their attorneys think the Settlement is best for all Settlement Class Members.

    Top

  5. How do I know whether I am part of the Settlement?

    If you received a notice in the mail or by email, Yapstone’s records indicate that you are included in the Settlement Class. More specifically, the Settlement Class includes all persons and entities that Yapstone sent an Incident Notice to. You are eligible to receive benefits from the Settlement if you were sent an Incident Notice and your social security number, driver’s license number, and/or passport number was among the PII potentially exposed, and you did not sign up for the credit protection and fraud resolution offer from Yapstone in the Incident Notice.  These Class Members are known as  “Redemption Claimants."

    Top

  6. Are there exceptions to being included?

    Yes. The Settlement does not include any judge presiding over this matter and any members of their first degree relatives, judicial staff, and the officers and directors of Yapstone.

    Top

  7. What if I am still not sure whether I am part of the Settlement?

    If you are not sure whether you are included, call the Settlement Administrator at 1-866-664-9037 or Class Counsel at 1-888-333-8996.

    Top

  8. What does the Settlement provide?

    The Settlement provides credit protection services, a Settlement Fund, and additional data security measures. First, Redemption Claimants may file a claim for twelve months of Experian’s ProtectMyID® identity monitoring services. The ProtectMyID® services include: (a) a free Experian credit report; (b) surveillance alerts for Daily Bureau Credit Monitoring; (c) identity theft resolution and ProtectMyID® ExtendCARE; and (d) one million dollars in identity theft insurance. Second, a $120,000 Settlement Fund has been established and will be distributed, equally, to two non-profit organizations: Public Justice (www.publicjustice.net) and the UC Berkeley School of Information, Center for Long-Term Cybersecurity (https://cltc.berkeley.edu). Finally, Yapstone has agreed to implement certain data security measures, including expedited compliance with industry standards, designation of a Chief Information Security Officer, certain risk assessment and monitoring procedures, continued updates regarding its privacy policy, and education and training of its workforce on the importance of the privacy and security of the Settlement Class Members’ PII.

    Top

  9. How do I get benefits?

    To receive ProtectMyID® services from Yapstone, Redemption Claimants must submit a Claim Form online or by mail by October 10, 2017. If you have your Claim ID and PIN, you can submit your claim online at the case settlement website, www.YapstoneSettlement.com. You can also download a claim form from the website by clicking here and submit it by mail by October 10, 2017. Claim forms are also available by calling 1-866-664-9037, or by writing to the Settlement Administrator at In re: Yapstone Data Breach, Settlement Administrator, P.O. Box 43034, Providence, RI 02940-3034.

    Top

  10. When would I receive my benefits?

    The Court will hold a Fairness Hearing on August 4, 2017 to decide whether to grant final approval of the Settlement. If the Court approves the Settlement, there may be appeals. It is always uncertain whether appeals will be filed and, if so, how long it will take to resolve them. Settlement benefits will be provided as soon as possible, if and when the Court grants final approval to the Settlement and after any appeals are resolved.

    Top

  11. What if my name or address changes after I submit a Claim Form?

    If your name or address needs to be corrected, you must send a letter to the Settlement Administrator at In re: Yapstone Data Breach, Settlement Administrator, P.O. Box 43034, Providence, RI 02940-3034.

    Top

  12. What rights am I giving up to stay in the Settlement Class?

    Unless you exclude yourself, you are staying in the Settlement Class. If the Settlement is approved and becomes final, all of the Court’s orders will apply to you and legally bind you. You won’t be able to sue, continue to sue, or be part of any other lawsuit against Yapstone about the issues in this case, but you will be able to submit a Claim Form to receive benefits from this Settlement. The rights you are giving up are called Released Claims.

    Top

  13. What are the Released Claims?

    If and when the Settlement becomes final, Settlement Class Representatives and all Settlement Class Members who do not timely and properly exclude themselves from the Settlement Class, and each of their respective heirs, assigns, beneficiaries, and successors, will permanently release the Released Parties from any and all liabilities, rights, claims, actions, causes of action, demands, damages, penalties, costs, attorneys’ fees, expenses losses, and remedies, whether known or unknown, existing or potential, suspected or unsuspected, liquidated or unliquidated, legal, statutory, or equitable, that result from, arise out of, are based upon, or relate to the Incident that were or could have been alleged in the Consumer Action, including, without limitation, any claims, actions, causes of action, demands, damages, penalties, losses, or remedies relating to, based upon, resulting from, or arising out of: (1) any alleged theft, exposure or disclosure of Settlement Class Members’ PII; (2) Yapstone’s maintenance and storage of Settlement Class Members’ PII; (3) Yapstone’s information security policies and practices; and (4) Yapstone’s Incident Notice to Settlement Class Members, and its handling of notices during that period.


    “Released Parties” means Yapstone and Yapstone’s enterprise and consumer customers involved in the Incident (e.g., Homeaway) and each of their present and former parents, subsidiaries, divisions, affiliates, predecessors, successors, and assigns, and the present and former directors, officers, employees, agents, insurers, shareholders, attorneys, advisors, consultants, representatives, partners, joint venturers, independent contractors, predecessors, successors, and assigns of each of them.


    The specific claims you will be releasing, including the provisions of California Civil Code § 1542, are described in paragraphs 66–71 of the Settlement Agreement, a copy of which is available here

    Top

  14. Do I have a lawyer in this case?

    Yes. Judge White appointed Tina Wolfson and Robert Ahdoot of Ahdoot & Wolfson, PC as Class Counsel to represent you and other Settlement Class Members. You will not be charged for these lawyers. If you want to be represented by your own lawyer, you may hire one at your own expense.

    Top

  15. How will the lawyers be paid?

    Class Counsel will ask the Court for attorneys’ fees, costs, and expenses of up to $300,000, and $2,000 in Service Awards to each of the five Class Representatives. The Court may award less than these amounts. All of these amounts, as well as the costs of administering the Notice and claims program, will be paid separately by Yapstone.

    Top

  16. How do I get out of the Settlement?

    To exclude yourself from the Settlement, you must mail a written request for exclusion to the Settlement Administrator. Your letter must include: (1) your full name; (2) your email address and current mailing address; (3) a statement indicating you want to be excluded from the Settlement Class, do not wish to be a Settlement Class Member, and elect to be excluded from any judgment entered in connection with this Settlement; (4) the name and number of this case, In re: Yapstone Data Breach, Case No. 4:15-cv-04429; and (5) your signature. Your request for exclusion must be mailed to the Settlement Administrator at the address below and postmarked no later than May 30, 2017:

     In re: Yapstone Data Breach
    Settlement Administrator
     P.O. Box 43034
     Providence, RI 02940-3034

    Top

  17. If I exclude myself, can I still get benefits from this Settlement?

    No. If you exclude yourself, you are telling the Court that you don’t want to be part of the Settlement. You can only receive the ProtectMyID® services if you stay in the Settlement (i.e. do not exclude yourself), are a Redemption Claimant and file a Claim Form.

    Top

  18. If I do not exclude myself, can I sue Yapstone for the same claims later?

    No. Unless you exclude yourself, you are giving up the right to sue Yapstone and the Released Parties for the legal claims that this Settlement resolves. You must exclude yourself from this lawsuit to start or continue with your own lawsuit or be part of any other lawsuit against Yapstone or any of the Released Parties about the legal claims resolved by this Settlement.

    Top

  19. How do I tell the Court that I do not like the Settlement?

    You can tell the Court if you don’t agree with the Settlement or any part of it. If you are a Settlement Class Member, you can object to the Settlement if you do not like it or a portion of it. You can give reasons why you think the Court should not approve it. The Court will consider your views. The Court can only approve or reject the Settlement. It cannot make changes to the terms of the Settlement.

    To object, you must submit a written objection to the Court that includes: (1) your full name, address, and telephone number; (2) the name, address and telephone number of the attorney representing you in your objection, if applicable; (3) the case name and number, In re: Yapstone Data Breach, Case No. 4:15-cv-04429; (4) the reasons why you object to the Settlement; (5) a statement indicating whether you and/or your attorney intend to appear at the Court’s Fairness Hearing and the amount of time requested for speaking; and (6) your signature.

    Your objection must be filed with the Court electronically or in person at any location of the U.S. District Court for the Northern District of California by May 30, 2017 or mailed to the Class Action Clerk, U.S. District Court for the Northern District of California, 1301 Clay Street, Oakland, California 94612, postmarked by May 30, 2017.

    Top

  20. May I come to Court to speak about my objection?

    Yes. You or your attorney may speak at the Fairness Hearing about your objection. To do so, your objection must include the information required above and be postmarked or filed by May 30, 2017.

    Top

  21. What is the difference between objecting to the Settlement and asking to be excluded from it?

    Objecting is simply telling the Court that you don’t like something about the Settlement. You can object only if you remain a member of the Settlement Class (that is, do not exclude yourself). Excluding yourself is telling the Court that you don’t want to be part of the Settlement. If you exclude yourself, you cannot object because the Settlement no longer affects you.

    Top

  22. When and where will the Court decide whether to approve the Settlement?

    The Court will hold a Fairness Hearing at 9:00 a.m. on August 4, 2017 at the U.S. District Court for the Northern District of California, 1301 Clay Street, Oakland, California 94612. The date of this Hearing may change without further notice. Settlement Class Members should check the Settlement Website and the Court docket in this case through the Court’s Public Access to Court Electronic Records (PACER) system at http://www.cand.uscourts.gov/cm-ecf  to confirm that the date of the Fairness Hearing has not been changed. At this hearing, the Court will consider whether the Settlement is fair, reasonable and adequate. It will also consider whether to approve Class Counsel’s request for an award of attorneys’ fees, expenses, and costs (up to $300,000), as well as Service Awards for each of the five Class Representatives (up to $2,000 for each Class Representative). If there are objections, the Court will consider them. Judge White will listen to people who have asked to speak at the hearing (see Question 20 above). After the hearing, the Court will decide whether to approve the Settlement.

    Top

  23. Do I have to come to the hearing?

    No. Class Counsel will answer any questions Judge White may have. However, you are welcome to come to the hearing at your own expense. If you send an objection, you do not have to come to court to talk about it. As long as you mailed your written objection on time, the Court will consider it. You may also pay your own lawyer to attend, but that is not necessary.

    Top

  24. May I speak at the hearing?

    Yes. You may ask the Court for permission to speak at the Fairness Hearing (see Question 20 above).

    Top

  25. What happens if I do nothing at all?

    If you are a member of the Settlement Class and you do nothing, you will give up the rights explained in Questions 12–13, including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Yapstone and the Released Parties about the legal issues in this case. In addition, if you are a Redemption Claimant, you will not receive the twelve months of ProtectMyID® services available as a benefit of this Settlement.

    Top

  26. How do I get more information?

    The Notice summarizes the proposed Settlement. Complete details are provided in the Settlement Agreement, which is available here. Additional information is also available by calling 1-866-664-9037 or by writing to In re:Yapstone Data Breach, Settlement Administrator, P.O. Box 43034, Providence, RI 02940-3034, or by contacting Class Counsel at 1-888-333-8996. Publicly-filed documents can also be obtained by visiting the office of the Clerk of the United States District Court for the Northern District of California, at 1301 Clay Street, Oakland, CA 94612, between 9:00 a.m. and 4:00 p.m., Monday through Friday, excluding Court holidays, or by reviewing the Court’s online docket on the Court’s Public Access to Electronic Records (PACER) system at http://www.cand.uscourts.gov/cm-ecf. Please do not telephone the Court or the Court Clerk’s Office to inquire about this Settlement or the Claim Process.

    Top