Jackson et al v. Citrix Systems, Inc.

Southern District of Florida, flsd-0:2019-cv-61350

Exhibit Settlement Agreement and Release

Interested in this case?

Current View

Full Text

3 Exhibit 1 3 SETTLEMENT AGREEMENT AND RELEASE This Settlement Agreement and Release ("Settlement Agreement" or "Agreement") is entered into by and between Lee Milligan, on behalf of himself and his minor son, Lindsey Howard, Kristi Jackson, Michelle Ramus, Charles Ramus, Brandon Sargent, and Natalie Young ("Plaintiffs"), individually and on behalf of Participating Settlement Class Members (as defined in Paragraph 30) (together "Plaintiffs"), and (2) Citrix Systems, Inc. ("Defendant" or "Citrix") (collectively the "Parties"), in the action In re: Citrix Data Breach Litigation, Case No. 19-cv- 61350, pending in the U.S. District Court for the Southern District of Florida. RECITALS WHEREAS, between May 24 and June 23, 2019, three proposed class action lawsuits were filed against Citrix in the U.S. District Court for the Southern District of Florida relating to a data breach disclosed by Citrix on or about March 8, 2019, potentially affecting certain Personal Information of current and former Citrix employees and, in some cases, their beneficiaries, dependents and others (the "Data Breach"). WHEREAS, on July 16, 2019, the Court entered an order consolidating the three related actions before the Honorable Roy K. Altman, United States District Judge, directing Plaintiffs to file a consolidated complaint, and setting a schedule for submitting applications for consideration as interim class counsel. (Doc. 16). On July 29, 2019, Plaintiffs filed a consolidated class action complaint. (Doc. 18). Citrix answered the complaint on August 22, 2019. (Doc. 23). WHEREAS, Citrix denies: a) the allegations and all liability with respect to any and all facts and claims alleged in the Action; b) that the class representatives in the Action and the class they purport to represent have suffered any damage; and c) that the Action satisfies the requirements to be tried as a class action under Federal Rule of Civil Procedure 23. WHEREAS, on September 26, 2019, the Court entered a scheduling order. (Doc. 28). The Court thereafter entered an order appointing interim class counsel. (Doc. 35). WHEREAS, the Parties exchanged initial disclosures, engaged in early-stage discovery, and agreed to engage the Honorable Jay C. Gandhi (United States Magistrate Judge, Ret.) of JAMS ADR as a mediator to oversee settlement negotiations in this Action. In advance of formal mediation, Citrix provided certain discovery. The Parties also exchanged detailed mediation briefs with their respective positions on the merits of the claims and class certification. WHEREAS, following extensive arm's length settlement negotiations conducted through Judge Gandhi that included an all-day mediation session on March 26, 2020, the Parties executed a binding term sheet setting forth the essential terms of settlement. On March 30, 2020, the Court entered an order vacating pending motions, pretrial deadlines, and the trial date in light of settlement. (Doc. 42). NOW, THEREFORE, in exchange for the mutual promises and valuable consideration provided for in this Agreement, and without any admission or concession by either Party, the 1 3 Parties agree to a full, complete, and final settlement and resolution of the Action, subject to Court approval, on the following terms and conditions: I. DEFINITIONS In addition to terms defined at various points within this Agreement, the following defined terms shall have the meanings set forth below: 1. "Action" means the consolidated class action lawsuit captioned In re: Citrix Data Breach Litigation, Case No. 19-cv-61350, currently pending before the Honorable Roy K. Altman in the U.S. District Court for the Southern District of Florida. 2. "Approved Claim" means the timely submitted Claim Form by a Participating Settlement Member that has been approved by the Settlement Administrator. 3. "Attested Time" means time spent remedying issues related to the Data Breach, as provided in Section III of this Agreement. 4. "Citrix's Counsel" means David F. McDowell and Nancy Thomas of Morrison & Foerster LLP. 5. "Claim Form" or "Claim" means the form(s) Participating Settlement Class Members must submit to be eligible for reimbursement of Out-of-Pocket Losses, Attested Time, and/or to claim Credit Monitoring Services or an Alternative Cash Payment under the terms of the Settlement, which is attached hereto as Exhibit 2. 6. "Claims Deadline" means the last day to submit a timely Claim Form(s), which will occur ninety (90) days after the Notice Deadline. 7. "Claims Period" means the period of time during which Settlement Class Members may submit Claim Forms to receive Settlement benefits, which will end on the Claims Deadline. 8. "Class Counsel" means John A. Yanchunis of Morgan & Morgan, J. Austin Moore of Stueve Siegel Hanson LLP, Gayle M. Blatt of Casey, Gerry, Schenk, Francavilla, Blatt & Penfield, LLP, Rosemary M. Rivas of Levi & Korsinsky, LLP, and Herman J. Russomanno III of Russomanno & Borrello, P.A. 9. "Settlement Class Representatives" means Lee Milligan, Lindsey Howard, Kristi Jackson, Michelle Ramus, Charles Ramus, Brandon Sargent, and Natalie Young. 10. "Court" means the Honorable Roy K. Altman, United States District Judge, Southern District of Florida, or such other judge to whom the Action may hereafter be assigned. 11. "Credit Monitoring Services" means three-bureau credit monitoring services provided by Experian to Participating Settlement Class Members under the Settlement. These 2 3 services include daily three-bureau credit monitoring with Equifax, Experian, and TransUnion; identity restoration services; and $1 million in identity theft insurance, among other features. 12. "Data Breach" means the data breach initially disclosed by Citrix in or about March 2019. 13. "Effective Date" means one business day following the latest of: (i) the date upon which the time expires for filing or noticing any appeal of the Final Approval Order and Judgment or one (1) business day following entry of the Final Approval Order and Judgment if no parties have standing to appeal; or (ii) if any appeal, petition, request for rehearing, or other review has been filed, the Final Approval Order and Judgment is affirmed without material change or the appeal is dismissed or otherwise disposed of, no other appeal, petition, rehearing, or other review is pending, and the time for further appeals, petitions, requests for rehearing, or other review has expired. 14. "Fee Application" means any motion for an award of attorneys' fees, Litigation Costs and Expenses, and Service Award Payments to be paid from the Settlement Fund, as set forth in Paragraphs 90 and 92. 15. "Fee Award and Costs" means the amount of attorneys' fees and reimbursement of Litigation Costs and Expenses awarded by the Court to Class Counsel. 16. "Final Approval Order and Judgment" means an order and judgment that the Court enters after the Final Approval Hearing, which finally approves the Settlement Agreement, certifies the Settlement Class, dismisses the Action with prejudice, otherwise satisfies the settlement-related provisions of Federal Rule of Civil Procedure 23, and is consistent with all material provisions of this Settlement Agreement. Class Counsel and Citrix's Counsel will work together on a proposed Final Approval Order and Judgment, which Citrix must approve before filing. 17. "Final Approval Hearing" means the hearing to be conducted by the Court to determine the fairness, adequacy, and reasonableness of the Settlement pursuant to Federal Rule of Civil Procedure 23 and whether to issue the Final Approval Order and Judgment. 18. "Identity Restoration Services" means identity restoration services provided by Experian to all Participating Settlement Class Members under the Settlement. These services provide for professional fraud resolution and identity recovery assistance by U.S.-based agents to Participating Settlement Class Members who experience identity theft or fraud. 19. "Litigation Costs and Expenses" means costs and expenses incurred by counsel for Plaintiffs in connection with commencing, prosecuting, and settling the Action. 20. "Minor Claim Form" means the form(s) a legal guardian may submit on behalf of a Participating Settlement Class Member who is under the age of eighteen (18) at the time of claim submission seeking reimbursement of Out-of-Pocket Losses and/or Attested Time, which is attached hereto as Exhibit 3. 3 3 21. "Minor Monitoring Services" means Experian's "Minor Plus" monitoring services automatically provided to every Participating Settlement Class Member under the age of eighteen (18) under the Settlement. These services include monthly monitoring of Experian information for every enrolled minor; internet surveillance; fraud resolution services; and $1 million in identity theft insurance from material damages that may occur against a minor whose credit file is misused, among other features. 22. "Net Settlement Fund" means the amount of funds that remain in the Settlement Fund after funds are paid from or allocated for payment from the Settlement Fund for the following: (i) Notice and Administrative Expenses, (ii) Taxes and Tax-Related Expenses, (iii) Identity Restoration Services; (iv) Minor Monitoring Services; (v) Credit Monitoring Services; (vi) Service Awards Payments approved by the Court, and (vii) Fee Award and Costs approved by the Court. 23. "Non-Profit Residual Recipient" means a non-profit organization approved by the Court following distribution of Settlement payments for Approved Claims. 24. "Notice" means notice of the proposed class action Settlement to be provided to Settlement Class Members pursuant to the Preliminary Approval Order, substantially in the form attached hereto as Exhibit 1. 25. "Notice Deadline" means the last day by which Notice must issue to the Settlement Class Members, and will occur thirty (30) days after entry of the Preliminary Approval Order. 26. "Notice and Administrative Expenses" means all of the expenses incurred in the administration of this Settlement, including, without limitation, all expenses or costs associated with providing Notice to the Settlement Class, locating Settlement Class Members, processing claims, determining the eligibility of any person to be a Settlement Class Member, and administering, calculating and distributing the Settlement Fund to Settlement Class Members. Administrative Expenses also includes all reasonable third-party fees and expenses incurred by the Settlement Administrator in administering the terms of this Agreement. 27. "Objection Deadline" is the last day on which a Settlement Class Member may file an objection to the Settlement or Fee Application, which will be forty (40) days after the Notice Deadline. 28. "Opt-Out Deadline" is the last day on which a Settlement Class Member may file a request to be excluded from the Settlement Class, which will be forty (40) days after the Notice Deadline. 29. "Out-of-Pocket Losses" means documented out-of-pocket costs or expenditures that a Settlement Class Member actually incurred that are fairly traceable to the Data Breach, and that have not already been reimbursed by a third party. Out-of-Pocket Losses may include, without limitation, unreimbursed costs associated with fraud or identity theft including professional fees including attorneys' fees, accountants' fees, and fees for credit repair services and miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance telephone charges, as 4 3 well as costs for credit monitoring costs or other mitigative services that were incurred on or between October 13, 2018 and the Notice Deadline. 30. "Participating Settlement Class Member" means a Settlement Class Member who does not submit a valid Request for Exclusion prior to the Opt-Out Deadline. 31. "Preliminary Approval Order" means an order directing issuance of Notice to Settlement Class Members, determining that the Court will likely be able to approve the Settlement under Federal Rule of Civil Procedure 23(e)(2), and determining that the Court will likely be able to certify the Settlement Class for purposes of judgment, that is consistent with all material provisions of this Settlement Agreement. Class Counsel and Citrix's Counsel will work together on a proposed Preliminary Approval Order, which Citrix must approve before filing. 32. "Released Claims" means any and all claims or causes of action of every kind and description, including any causes of action in law, claims in equity, complaints, suits or petitions, and any allegations of wrongdoing, demands for legal, equitable or administrative relief (including, but not limited to, any claims for injunction, rescission, reformation, restitution, disgorgement, constructive trust, declaratory relief, compensatory damages, consequential damages, penalties, exemplary damages, punitive damages, attorneys' fees, costs, interest or expenses) that the Releasing Parties had, have or may claim now or in the future to have (including, but not limited to, assigned claims and any and all "Unknown Claims" as defined below) that were or could have been asserted or alleged arising out of the same nucleus of operative facts as any of the claims alleged or asserted in the Action, including but not limited to the facts, transactions, occurrences, events, acts, omissions, or failures to act that were alleged, argued, raised or asserted in any pleading or court filing in the Action, including but not limited to those concerning: 1) the disclosure of the Settlement Class Members' personal information in the Data Breach; 2) Citrix's maintenance of Settlement Class Members' personal information as it relates to the Data Breach; 3) Citrix's information security policies and practices as it relates to the Data Breach; or 4) Citrix's provision of notice to Settlement Class Members following the Data Breach. 33. "Request for Exclusion" is the written communication by or on behalf of a Settlement Class Member in which he or she requests to be excluded from the Settlement Class in the form and manner provided for in the Notice. 34. "Service Award Payment" means compensation awarded by the Court and paid to the Settlement Class Representatives in recognition of their role in this litigation. 35. "Settlement" means the settlement of the Action by and between the Parties, and the terms thereof as stated in this Settlement Agreement. 36. "Settlement Administrator" means Angeion Group. Class Counsel and Citrix's Counsel may, by agreement, substitute a different Settlement Administrator, subject to Court approval. 37. "Settlement Class" means the 24,316 individuals identified on the Settlement Class List, including all individuals residing in the United States who were sent notification by Citrix 5 3 that their personal information was or may have been compromised in the data breach initially disclosed by Citrix in or about March 2019. Excluded from the Settlement Class are: (1) the judges presiding over this Action, and members of their direct families; (2) the Defendant, its subsidiaries, parent companies, successors, predecessors, and any entity in which the Defendant or its parents have a controlling interest and their current or former officers, directors, and employees; (3) Settlement Class Members who submit a valid Request for Exclusion prior to the Opt-Out Deadline. 38. "Settlement Class List" means the list generated by Citrix containing the full names, current or last known addresses, personal email addresses where known, and birthdates for Settlement Class members under the age of eighteen (18), for all persons who fall under the definition of the Settlement Class, which Citrix shall provide to the Settlement Administrator within twenty-one (21) days of the Preliminary Approval Order. 39. "Settlement Class Member" means an individual who falls within the definition of the Settlement Class. 40. "Settlement Fund" means two million two hundred seventy-five thousand dollars ($2,275,000.00) to be paid by Citrix as specified in Paragraphs 44-49, including any interest accrued thereon after payment. This payment is the limit and extent of Citrix's monetary obligations with respect to the Settlement. 41. "Settlement Payment" or "Settlement Check" mean the payment to be made via mailed check and/or electronic payment to a Participating Settlement Class Member pursuant to Paragraphs 52-56, 58. 42. "Settlement Website" means the website that the Settlement Administrator will establish as soon as practicable following entry of the Preliminary Approval Order, but prior to the mailing of the Notice, as a means for Settlement Class Members to obtain notice of and information about the Settlement and relevant case documents and deadlines. The Settlement Website shall contain relevant documents, including, but not limited to, the Notice, this Agreement, Plaintiff's motion for preliminary approval of the Settlement, the Preliminary Approval Order, Plaintiff's Fee Application, and the operative complaint in the Action. The Settlement Website shall also include a toll-free telephone number, e-mail address, and mailing address through which Settlement Class Members may contact the Settlement Administrator directly. The Settlement Website shall not include any advertising and shall remain operational until at least sixty (60) days after all Settlement Payments have been distributed. 43. "Taxes and Tax-Related Expenses" means any and all applicable taxes, duties, and similar charges imposed by a government authority (including any estimated taxes, interest or penalties) arising in any jurisdiction, if any, with respect to the income or gains earned by or in respect of the Settlement Fund, including, without limitation, any taxes that may be imposed upon Citrix with respect to any income or gains earned by or in respect of the Settlement Fund for any period while it is held in the Settlement Fund. 6 3 II. SETTLEMENT FUND 44. Establishment of Settlement Fund. Within twenty-one (21) days of the Preliminary Approval Order, Citrix shall deposit the sum of $2,275,000 into an account established and administered by the Settlement Administrator at a financial institution agreed upon by the Settlement Administrator and Citrix. 45. Non-Reversionary. The Settlement Fund is non-reversionary. As of the Effective Date, all rights of Citrix in or to the Settlement Fund shall be extinguished, except in the event this Settlement Agreement is terminated, as described in Paragraph 84. 46. Qualified Settlement Fund. The Parties agree that the Settlement Fund is intended to be maintained as a qualified settlement fund within the meaning of Treasury Regulation § 1.468 B-1, and that the Settlement Administrator, within the meaning of Treasury Regulation § 1.468 B- 2(k)(3), shall be responsible for filing tax returns and any other tax reporting for or in respect of the Settlement Fund and paying from the Settlement Fund any Taxes and Tax-Related Expenses owed with respect to the Settlement Fund. The Parties agree that the Settlement Fund shall be treated as a qualified settlement fund from the earliest date possible and agree to any relation-back election required to treat the Settlement Fund as a qualified settlement fund from the earliest date possible. Any and all funds held in the Settlement Fund shall be held in an interest-bearing account insured by the Federal Deposit Insurance Corporation. Funds may be placed in a non-interest bearing account as may be reasonably necessary during the check clearing process. The Settlement Administrator shall provide an accounting of any and all funds in the Settlement Fund, including any interest accrued thereon and payments made pursuant to this Agreement, upon request of any of the Parties. 47. Custody of Settlement Fund. The Settlement Fund shall be deemed to be in the custody of the Court and shall remain subject to the jurisdiction of the Court until such time as the entirety of the Settlement Fund is distributed pursuant to this Settlement Agreement or the balance returned to those who paid the Settlement Fund in the event this Settlement Agreement is terminated in accordance with Paragraph 84. 48. Use of the Settlement Fund. As further described in this Agreement, the Settlement Fund shall be used by the Settlement Administrator to pay for the following: (i) Notice and Administrative Expenses; (ii) Taxes and Tax-Related Expenses; (iii) Service Awards Payments approved by the Court; (iv) Fee Award and Costs; (v) Credit Monitoring Services; (vi) Identity Restoration Services; (vii) Minor Monitoring Services; (viii) reimbursement for Out-of- Pocket Losses and Attested Time; and (ix) Alternative Cash Payments. No amounts may be withdrawn from the Settlement Fund unless expressly authorized by this Agreement or approved by the Court. 49. Taxes and Representations. Taxes and Tax-Related Expenses relating to the Settlement Fund shall be considered Notice and Administrative Expenses and shall be timely paid by the Settlement Administrator out of the Settlement Fund without prior order of the Court. Further, the Settlement Fund shall indemnify and hold harmless the Parties and their counsel for Taxes and Tax-Related Expenses (including, without limitation, taxes payable by reason of any such indemnification payments). The Parties and their respective counsel have made no 7 3 representation or warranty with respect to the tax treatment by any Settlement Class Representative or any Settlement Class Member of any payment or transfer made pursuant to this Agreement or derived from or made pursuant to the Settlement Fund. Each Class Representative and Participating Settlement Class Member shall be solely responsible for the federal, state, and local tax consequences to him, her or it of the receipt of funds from the Settlement Fund pursuant to this Agreement. III. REIMBURSEMENT FOR OUT-OF-POCKET LOSSES AND ATTESTED TIME 50. Reimbursement for Out-of-Pocket Losses. All Settlement Class Members may submit a claim for up to $15,000.00 for reimbursement of Out-of-Pocket Losses. To receive reimbursement for Out-of-Pocket Losses, Settlement Class Members must submit a valid Claim Form that includes the following: (i) third party documentation supporting the loss; and (ii) a brief description of the documentation describing the nature of the loss, if the nature of the loss is not apparent from the documentation alone. Third-party documentation can include receipts or other documentation not "self-prepared" by the Settlement Class Member that documents the costs incurred. Self-prepared documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but can be considered to add clarity or support other submitted documentation. A legal guardian for a Settlement Class Member who is under the age of eighteen (18) at the time of claim submission may submit a Minor Claim Form seeking reimbursement of Out-of-Pocket Losses on the minor's behalf. 51. Assessing Claims for Out-of-Pocket Losses. The Settlement Administrator shall verify that each person who submits a Claim Form is a Settlement Class Member. The Settlement Administrator shall have the sole discretion and authority to determine whether and to what extent documentation for Out-of-Pocket Losses reflects valid Out-of-Pocket Losses actually incurred that are fairly traceable to the Data Breach, but may consult with Class Counsel in making individual determinations. In assessing what qualifies as "fairly traceable," the Settlement Administrator will consider (i) whether the timing of the loss occurred on or after October 13, 2018; and (ii) whether the Personal Information used to commit identity theft or fraud consisted of the type of Personal Information identified in Citrix's notices of the Data Breach. Costs expended for mitigation measures like credit monitoring services, fraud resolution services, and professional services incurred to address identity theft or fraud on or after October 13, 2018 shall be presumed "reasonably incurred." The Settlement Administrator is authorized to contact any Settlement Class Member (by e-mail, telephone, or U.S. mail) to seek clarification regarding a submitted claim prior to making a determination as to its validity. 52. Reimbursement for Attested Time. All Settlement Class Members may submit a claim for reimbursement of Attested Time up to five (5) hours at twenty-five dollars ($25) per hour. Settlement Class Members can receive reimbursement of Attested Time with a brief description of the actions taken in response to the Data Breach and the time associated with each action. Claims for Attested Time are capped at $125.00 per individual. A claim for Attested Time may be combined with reimbursement for Out-of-Pocket Losses but in no circumstance will a Settlement Class Member be eligible to receive more than the $15,000.00 individual cap. A legal guardian for a Settlement Class Member who is under the age of eighteen (18) at the time of claim 8 3 submission may submit a Minor Claim Form seeking reimbursement of Attested Time on the minor's behalf. 53. Assessing Claims for Attested Time. The Settlement Administrator shall have the sole discretion and authority to determine whether the prerequisites have been met in order to award payments of Attested Time, but may consult with Class Counsel in making individual determinations. The Settlement Administrator is authorized to contact any Settlement Class Member (by e-mail, telephone, or U.S. mail) to seek clarification regarding a submitted claim prior to making a determination as to its validity. 54. Disputes. To the extent the Settlement Administrator determines a claim for Out- of-Pocket Losses or Attested Time is deficient in whole or part, within a reasonable time of making such a determination, the Settlement Administrator shall notify the Settlement Class Member of the deficiencies and give the Settlement Class Member twenty-one (21) days to cure the deficiencies. Such notifications shall be sent via e-mail, unless the claimant did not provide an e- mail address, in which case such notifications shall be sent via U.S. mail. If the Settlement Class Member attempts to cure the deficiencies but, at the sole discretion and authority of the Settlement Administrator, fails to do so, the Settlement Administrator shall notify the Settlement Class Member of that determination within ten (10) days of the determination. The Settlement Administrator may consult with Class Counsel in making such determinations. IV. CREDIT MONITORING, IDENTITY RESTORATION, MINOR MONITORING, AND ALTERNATIVE CASH PAYMENTS 55. Credit Monitoring Services. All Participating Settlement Class Members who are not automatically eligible for Minor Monitoring Services are eligible to enroll in five (5) years of Credit Monitoring Services provided by Experian, regardless of whether the Settlement Class Member submits a claim for reimbursement of Out-of-Pocket Losses or Attested Time. The Settlement Administrator shall send an activation code to each Participating Settlement Class Member who is eligible for Crediting Monitoring Services within thirty (30) days of the Effective Date which can be used to activate Credit Monitoring Services via an enrollment website maintained by Experian. Such enrollment codes shall be sent via e-mail, unless the claimant did not provide an e-mail address, in which case such codes shall be sent via U.S. mail. Credit Monitoring Services claimants may activate Credit Monitoring Services for a period of at least 60 -days from the date the Settlement Administrator sends the activation code. Experian shall provide Credit Monitoring Services to all valid claimants who timely activate those services for a period of five (5) years from the date of activation. A Participating Settlement Class Member cannot select both Credit Monitoring Services and an Alternative Cash Payment (Paragraph 56) under the Settlement. 56. Alternative Cash Payments. In lieu of Credit Monitoring Services, Participating Settlement Class Members who are not automatically eligible for Minor Monitoring Services may elect to receive a cash payment in an amount equal to a pro rata distribution of the Net Settlement Fund ("Alternative Cash Payments"). If a Participating Settlement Class Member attempts to claim both Credit Monitoring Services and Alternative Cash Payment under the Settlement, the Settlement Administrator is authorized to contact the Settlement Class Member (by e-mail, telephone, or U.S. mail) to seek clarification regarding which benefit he or she would like to select. 9 3 57. Identity Restoration Services. All Participating Settlement Class Members are automatically eligible to access Identity Restoration Services offered through Experian for a period of five (5) years from the Effective Date, regardless of whether they submit a claim under the Settlement. 58. Minor Monitoring Services. All Participating Settlement Class Members under the age of eighteen (18) on or before the Claims Deadline are automatically eligible to enroll in Minor Monitoring Services provided by Experian for a period of five (5) years from the Effective Date, regardless of whether they submit a claim under the Settlement. Enrollment codes shall be mailed or emailed to all eligible Settlement Class Members within thirty (30) days of the Effective Date. V. PAYMENTS TO PARTICIPATING SETTLEMENT CLASS MEMBERS 59. Payment Timing. Payments for Approved Claims for reimbursement for Out-of- Pocket Losses, Attested Time, and/or Alternative Cash Payments shall be issued in the form of a check mailed and/or an electronic payment as soon as practicable after the allocation and distribution of funds are determined by the Settlement Administrator following the Effective Date. 60. Timing. Settlement Checks shall bear in the legend that they expire if not negotiated within ninety (90) days of their date of issue. If a Settlement Check is not cashed within sixty (60) days after the date of issue, the Settlement Administrator is authorized to send an e-mail and/or place a telephone call to that Participating Settlement Class Member reminding him/her of the deadline to cash such check. 61. Returned Checks. For any Settlement Check returned to the Settlement Administrator as undeliverable (including, but not limited to, when the intended recipient is no longer located at the address), the Settlement Administrator shall make reasonable efforts to locate a valid address and resend the Settlement Payment within thirty (30) days after the check is returned to the Settlement Administrator as undeliverable. In attempting to locate a valid address, the Settlement Administrator is authorized to send an e-mail and/or place a telephone call to that Participating Settlement Class Member to obtain updated address information. Any replacement Settlement Checks issued to Participating Settlement Class Members shall remain valid and negotiable for sixty (60) days from the date of their issuance and may thereafter automatically be canceled if not cashed by the Participating Settlement Class Members within that time. 62. Uncashed Checks. To the extent that a Settlement Check is not cashed within ninety (90) days after the date of issue, the Settlement Administrator shall undertake the following actions: (1) attempt to contact the Participating Settlement Class Member by e-mail and/or telephone to discuss how to obtain a reissued check; (2) if those efforts are unsuccessful, make reasonable efforts to locate an updated address for the Participating Settlement Class Member using advanced address searches or other reasonable methods; and (3) reissuing a check or mailing the Participating Settlement Class Member a postcard (either to an updated address if located or the original address if not) providing information regarding how to obtain a reissued check. Any reissued Settlement Checks issued to Participating Settlement Class Members shall remain valid 10 3 and negotiable for sixty (60) days from the date of their issuance and may thereafter automatically be canceled if not cashed by the Participating Settlement Class Members within that time. 63. Unclaimed Property. No portion of the Settlement Fund shall revert or be repaid to Defendant after the Effective Date. To the extent any monies remain in the Net Settlement Fund more than 150 days after the distribution of Settlement payments to the Participating Settlement Class Members, or 30 days after all reissued Settlement Checks are no longer negotiable, whichever occurs later or as otherwise agreed to by the Parties, any remaining monies shall be distributed as required by state law or to the Non-Profit Residual Recipient. 64. Deceased Class Members. If the Settlement Administrator is notified that a Participating Settlement Class Member is deceased, the Settlement Administrator is authorized to reissue the Settlement Check to the Participating Settlement Class Member's estate upon receiving proof the Participating Settlement Class Member is deceased and after consultation with Class Counsel. VI. CLAIMS, CAPS, AND DISTRIBUTION OF SETTLEMENT FUNDS 65. Submission of Electronic and Hard Copy Claims. Participating Settlement Class Members may submit Claim Forms to the Settlement Administrator electronically via a claims website or physically by mail to the Settlement Administrator. Claim Forms must be submitted electronically or postmarked during the Claims Period and on or before the Claims Deadline. Citrix shall not be entitled to access information regarding which Settlement Class Members submitted a Claim Form or otherwise participated in the Settlement. Citrix's Counsel may obtain this information on a showing of good cause, including but not limited to any disputes arising out of the claims process. 66. Individual Caps. Participating Settlement Class Members are subject to an individual aggregate cap of $15,000.00 for payments made under the Settlement. Participating Settlement Class Members may submit claims for reimbursement of Attested Time, Out-of-Pocket Losses, and/or Alternative Cash Payments but the Participating Settlement Class Member's combined claims will be subject to the individual aggregate cap of $15,000.00. 67. Order of Distribution of Funds. The Settlement Administrator must first use the Net Settlement Fund to make payments for Approved Claims for Out-of-Pocket Losses, followed by Approved Claims for Attested Time. The Settlement Administrator shall then utilize the remaining funds in the Net Settlement Fund to make distributions for Alternative Cash Payments. 68. Pro-Rata Contingencies. In the event that 7,500 or more Participating Settlement Class Members elect to enroll in Credit Monitoring Services under the Settlement, the number of years of Credit Monitoring Services provided to each Participating Settlement Class Member who claims that benefit shall be reduced to three years to ensure the Net Settlement Fund will adequately fund other Settlement benefits. In the event that the aggregate amount of all payments for reimbursement of Out-of-Pocket Losses exceeds the total amount of the Net Settlement Fund, then the value of such payments shall be reduced on a pro rata basis, such that the aggregate value of all payments for Out-of-Pocket Losses does not exceed the Net Settlement Fund. In such an event, no Net Settlement Funds will be distributed for Approved Claims of Attested Time or 11 3 Alternative Cash Payments. In the event that (i) the aggregate amount of Approved Claims for Out-of-Pocket Losses does not exceed the Net Settlement Fund, and (ii) the aggregate amount of all Approved Claims for Attested Time is greater than the Net Settlement Fund, less the aggregate amount of Approved Claims for Out-of-Pocket Losses, then the value of each Participating Settlement Class Members' payment for Attested Time shall be reduced on a pro rata basis such that the aggregate value of all Approved Claims for Out-of-Pocket Losses and Attested Time do not exceed the Net Settlement Fund. In such an event, no Net Settlement Funds will be distributed for Alternative Cash Payments. All pro rata determinations required by this Paragraph shall be performed by the Settlement Administrator. VII. BUSINESS PRACTICE COMMITMENTS 69. Business Practice Commitments. Citrix agrees to adopt and implement certain business practice commitments and remedial measures set forth in the declaration described below ("Business Practice Commitments") for a period of at least three (3) years following the Effective Date, subject to the Modification provision set forth in Paragraph 70. These Business Practice Commitments are specific business practice commitments and remedial measures within the following general categories: a. Enhanced Cybersecurity Training and Awareness Program. b. Enhanced Data Security Policies. c. Enhanced Security Measures. d. Further Restricting Access to Personal Information. e. Enhanced Monitoring and Response Capability. 70. Modification and Costs. The Parties acknowledge that technical requirements for securing information evolve and change dynamically. In the event that technological or industry developments, or intervening changes in law or business practices render specific Business Practice Commitments obsolete or make compliance by Citrix with them unreasonable or technically impractical, Citrix may modify its business practices as necessary to ensure appropriate security practices are being followed. For each of the next three years on or before the anniversary of the Effective Date, Citrix will confirm in writing to Class Counsel that it is in compliance with its obligations under this Paragraph and the previous Paragraph. All costs associated with implementing the Business Practice Commitments will be borne by Citrix separate and apart from the Settlement Fund. 71. Enforcement. Citrix has provided to Class Counsel a declaration attesting to the Business Practice Commitments. Such declaration shall be treated as confidential and cannot be used for any purpose other than enforcement of this Settlement Agreement. If at any time Class Counsel has information indicating Citrix is not complying with its Business Practice Commitments, the Parties are required to meet and confer to discuss the issue prior to seeking Court intervention. To the extent Court intervention is required, the Parties agree to cooperate in 12 3 seeking the Court's permission to file the Business Practice Commitments and any discussion of the Business Practice Commitments under seal. VIII. SETTLEMENT CLASS NOTICE 72. Notice. Within twenty-one (21) days after the date of the Preliminary Approval Order, Citrix shall provide the Settlement Class List to the Settlement Administrator. Within seven (7) days after receipt of Settlement Class List, the Settlement Administrator shall disseminate Notice to the members of the Settlement Class. Notice shall be disseminated via U.S. mail to all Settlement Class members and also via e-mail to Settlement Class Members whose personal e- mail addresses are known. Class Counsel may direct the Settlement Administrator to send reminder notices to Settlement Class Members at any time prior to the Claims Deadline. IX. OPT-OUTS AND OBJECTIONS 73. Opt-Outs. The Notice shall explain the procedure for Settlement Class Members to exclude themselves or "opt-out" of the Settlement by submitting a Request for Exclusion to the Settlement Administrator postmarked no later than forty (40) days after the Notice Deadline. The Request for Exclusion must include the name of the proceeding, the individual's full name, current address, personal signature, and the words "Request for Exclusion" or a comparable statement that the individual does not wish to participate in the Settlement at the top of the communication. The Notice must state that any Settlement Class Member who does not file a timely Request for Exclusion in accordance with this Paragraph will lose the opportunity to exclude himself or herself from the Settlement and will be bound by the Settlement. 74. Objections. The Notice shall explain the procedure for Settlement Class Members to object to the Settlement or Fee Application by submitting written objections to the Settlement Administrator postmarked no later than forty (40) days after the Notice Deadline. The written objection must include (i) the name of the proceedings; (ii) the Settlement Class Member's full name, current mailing address, and telephone number; (iii) a statement of the specific grounds for the objection, as well as any documents supporting the objection; (iv) a statement as to whether the objection applies only to the objector, to a specific subset of the class, or to the entire class; (v) the identity of any attorneys representing the objector; (vi) a statement regarding whether the Settlement Class Member (or his/her attorney) intends to appear at the Final Approval Hearing; and (vii) the signature of the Settlement Class Member or the Settlement Class Member's attorney. The Notice must set forth the time and place of the Final Approval Hearing (subject to change) and state that any Settlement Class Member who does not file a timely and adequate objection in accordance with this Paragraph waives the right to object or to be heard at the Final Approval Hearing and shall be forever barred from making any objection to the Settlement. X. DUTIES OF THE SETTLEMENT ADMINISTRATOR 75. Duties of Settlement Administrator. The Settlement Administrator shall perform the functions and duties necessary to effectuate the Settlement and as specified in this Agreement, including, but not limited to, the following: 13 3 a. Creating, administering, and overseeing the Settlement Fund; b. Obtaining the Settlement Class List for the purpose of disseminating Notice to Settlement Class Members; c. Providing Notice to Settlement Class Members via U.S. mail and e-mail; d. Establishing and maintaining the Settlement Website; e. Establishing and maintaining a toll-free telephone line for Settlement Class Members to call with Settlement-related inquiries, and answering the questions of Settlement Class Members who call with or otherwise communicate such inquiries within one (1) business day; f. Responding to any mailed or emailed Settlement Class Member inquiries within one (1) business day; g. Reviewing, determining the validity of, and processing all claims submitted by Settlement Class Members; h. Receiving Requests for Exclusion and objections from Settlement Class Members and providing Class Counsel and Citrix's Counsel a copy thereof no later than three (3) days following the deadline for submission of the same. If the Settlement Administrator receives any Requests for Exclusion, objections, or other requests from Settlement Class Members after the Opt-Out and Objection Deadlines, the Settlement Administrator shall promptly provide copies thereof to Class Counsel and to Citrix's Counsel; i. Working with the provider of Credit Monitoring Services and Minor Monitoring Services to receive and send activation codes within thirty (30) days of the Effective Date; j. After the Effective Date, processing and transmitting Settlement Payments to Settlement Cass Members; k. Providing weekly or other periodic reports to Class Counsel and Citrix's Counsel that include information regarding the number of Settlement Checks mailed and delivered, Settlement Checks cashed, undeliverable information, and any other requested information relating to Settlement Payments. The Settlement Administrator shall also, as requested by Class Counsel or Citrix's Counsel and from time to time, provide the amounts remaining in the Net Settlement Fund; l. In advance of the Final Approval Hearing, preparing a sworn declaration to submit to the Court that: (i) attests to implementation of Notice in accordance with the Preliminary Approval Order; and (ii) identifies each Settlement Class Member who timely and properly submitted a Request for Exclusion; and 14 3 m. Performing any function related to Settlement administration at the agreed-upon instruction of Class Counsel or Citrix's Counsel, including, but not limited to, verifying that Settlement Payments have been distributed. 76. Limitation of Liability. The Parties, Class Counsel, and Citrix's Counsel shall not have any liability whatsoever with respect to (i) any act, omission or determination of the Settlement Administrator, or any of its respective designees or agents, in connection with the administration of the Settlement or otherwise; (ii) the management, investment or distribution of the Settlement Fund; (iii) the formulation, design or terms of the disbursement of the Settlement Fund; (iv) the determination, administration, calculation or payment of any claims asserted against the Settlement Fund; (v) any losses suffered by or fluctuations in the value of the Settlement Fund; or (vi) the payment or withholding of any Taxes and Tax-Related Expenses. 77. Indemnification. The Settlement Administrator shall indemnify and hold harmless the Parties, Class Counsel, and Citrix's Counsel for (i) any act or omission or determination of the Settlement Administrator, or any of Settlement Administrator's designees or agents, in connection with the Notice Plan and the administration of the Settlement; (ii) the management, investment or distribution of the Settlement Fund; (iii) the formulation, design or terms of the disbursement of the Settlement Fund; (iv) the determination, administration, calculation or payment of any claims asserted against the Settlement Fund; (v) any losses suffered by, or fluctuations in the value of the Settlement Fund; or (vi) the payment or withholding of any Taxes and Tax-Related Expenses. XI. PRELIMINARY APPROVAL, FINAL APPROVAL, AND JURISDICTION 78. Certification of the Settlement Class. For purposes of this Settlement only, the Parties stipulate to the certification of the Settlement Class, which is contingent upon the Court entering the Final Approval Order and Judgment of this Settlement and the occurrence of the Effective Date. 79. Preliminary Approval. Following execution of this Agreement, Class Counsel shall file a motion for preliminary approval of the settlement on or before May 29, 2020 or a date thereafter that is agreeable to the Parties. 80. Final Approval. Class Counsel shall move the Court for a Final Approval Order and Judgment of this Settlement, to be issued following the Final Approval Hearing; within a reasonable time after the Notice Deadline, Objection Deadline, and Opt-Out Deadline; and at least 90 days after Citrix notifies the appropriate government officials of this Settlement Agreement pursuant to the Class Action Fairness Act of 2005, 28 U.S.C. § 1715. 81. Jurisdiction. The Court shall retain jurisdiction over the implementation, enforcement, and performance of this Agreement, and shall have exclusive jurisdiction over any suit, action, proceeding or dispute arising out of or relating to this Agreement that cannot be resolved by negotiation and agreement by counsel for the Parties. The Court shall retain jurisdiction with respect to the administration, consummation and enforcement of the Agreement and shall retain jurisdiction for the purpose of enforcing all terms of the Agreement. The Court 15 3 shall also retain jurisdiction over all questions and/or disputes related to the Notice and the Settlement Administrator. As part of its agreement to render services in connection with this Settlement, the Settlement Administrator shall consent to the jurisdiction of the Court for this purpose. XII. MODIFICATION AND TERMINATION 82. Modification. The terms and provisions of this Agreement may be amended, modified, or expanded by written agreement of the Parties and approval of the Court; provided, however, that, after entry of the Preliminary Approval Order, the Parties may, by written agreement, effect such amendments, modifications, or expansions of this Agreement and its implementing documents (including all exhibits hereto) without further notice to the Settlement Class or approval by the Court if such changes are consistent with the Court's Preliminary Approval Order and do not materially alter, reduce, or limit the rights of Settlement Class Members under this Agreement. 83. Decertification of the Settlement Class if Settlement Not Approved. If: (1) the Court does not issue the Preliminary Approval Order or Final Approval Order and Judgment; or (2) the Effective Date not occur, the certification of the Settlement Class shall be void. Citrix reserves the right to contest class certification for all other purposes. Any orders preliminarily or finally approving the certification of any class contemplated by the Settlement shall be null, void, and vacated, and shall not be used or cited thereafter by any person or entity in support of claims or defenses or in support or in opposition to a class certification motion. In addition, the fact that Citrix did not oppose certification of a class under the Settlement shall not be used or cited thereafter by any person or entity, including in a contested proceeding relating to class certification. 84. Termination. Settlement Class Representatives and Defendant shall have the right to terminate this Agreement by providing written notice of their or its election to do so ("Termination Notice") within seven (7) days of: (1) the Court's refusal to issue the Preliminary Approval Order; or (2) within fourteen (14) days of any of the following: (i) the Court's refusal to enter the Final Approval Order and Judgment, or (ii) the date upon which the Final Approval Order and Judgment is modified or reversed in any material respect by any appellate or other court. 85. Effect of Termination. In the event of a termination as provided in Paragraph 84, this Agreement and the Settlement shall be considered null and void; all of the Parties' obligations under the Agreement shall cease to be of any force and effect and the Parties shall return to the status quo ante in the Action as if the Parties had not entered into this Agreement or the Settlement. In addition, in the event of such a termination, all of the Parties' respective pre-Settlement claims and defenses will be preserved. XIII. RELEASES 86. The Release. Upon the Effective Date, and in consideration of the Settlement benefits described herein, each of the Settlement Class Representatives and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns shall be deemed to have 16 3 released, acquitted, and forever discharged any and all Released Claims against Citrix and its present and former predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all of their past, present, and future officers, directors, employees, stockholders, partners, servants, agents, successors, attorneys, advisors, consultants, representatives, insurers, reinsurers, subrogees and the predecessors, successors, and assigns of any of the foregoing. 87. Unknown Claims. The Released Claims include the release of Unknown Claims. "Unknown Claims" means claims that could have been raised in the Action and that any of the Settlement Class Representatives or Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns does not know or suspect to exist, which, if known by him, her or it, might affect his, her or its agreement to release Citrix and its present and former predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all of their past, present, and future officers, directors, employees, stockholders, partners, servants, agents, successors, attorneys, advisors, consultants, representatives, insurers, reinsurers, subrogees and the predecessors, successors, and assigns of any of the foregoing or the Released Claims or might affect his, her or its decision to agree, object or not to object to the Settlement. Upon the Effective Date, the Settlement Class Representatives and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns shall be deemed to have, and shall have, expressly waived and relinquished, to the fullest extent permitted by law, the provisions, rights and benefits of Section 1542 of the California Civil Code, which provides as follows: A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS THAT THE CREDITOR OR RELEASING PARTY DOES NOT KNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT THE TIME OF EXECUTING THE RELEASE AND THAT, IF KNOWN BY HIM OR HER, WOULD HAVE MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOR OR RELEASED PARTY. Upon the Effective Date, each of the Settlement Class Representatives and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns s shall be deemed to have, and shall have, waived any and all provisions, rights and benefits conferred by any law of any state, the District of Columbia or territory of the United States, by federal law, or principle of common law, or the law of any jurisdiction outside of the United States, which is similar, comparable or equivalent to Section 1542 of the California Civil Code. The Settlement Class Representatives and Participating Settlement Class Members, and each of their respective heirs, executors, administrators, representatives, agents, partners, successors, attorneys, and assigns acknowledge that they may discover facts in addition to or different from those that they now know or believe to be true with respect to the subject matter of the Release, but that it is their intention to finally and forever settle and release the Released Claims, including but not limited to any Unknown Claims they may have, as that term is defined in this Paragraph. 17 3 88. Release of Class Representatives and Class Counsel. Upon the Effective Date, Citrix and its representatives, officers, agents, directors, affiliates, employees, insurers, and attorneys shall be deemed to have released, acquitted, and forever discharged the Settlement Class Representatives and Class Counsel from any and all claims or causes of action of every kind and description, including any causes of action in law, claims in equity, complaints, suits or petitions, and any allegations of wrongdoing, demands for legal, equitable or administrative relief (including, but not limited to, any claims for injunction, rescission, reformation, restitution, disgorgement, constructive trust, declaratory relief, compensatory damages, consequential damages, penalties, exemplary damages, punitive damages, attorneys' fees, costs, interest or expenses), whether known or unknown, that arise out of, are based upon, or relate to prosecution of the Action, the Settlement Agreement, or the Settlement claims process (provided, however, that this release and discharge shall not include claims relating to the enforcement of the terms of the Settlement or this Agreement). 89. Bar to Future Suits. Upon entry of the Final Approval Order and Judgment, the Settlement Class Representatives and other Settlement Class Members shall be enjoined from prosecuting any claim they have released in the preceding paragraphs in any proceeding against any of the Released Parties or based on any actions taken by any of the Released Parties that are authorized or required by this Agreement or by the Final Approval Order. Likewise, Citrix and its representatives, officers, agents, directors, affiliates, employees, insurers, and attorneys shall be enjoined from prosecuting any claim they have released in the preceding paragraphs in any proceeding against Settlement Class Representatives and Class Counsel or based on any actions taken by Settlement Class Representatives and Class Counsel that are authorized or required by this Agreement or by the Final Approval Order. It is further agreed that the Settlement may be pleaded as a complete defense to any proceeding subject to this section. XIV. SERVICE AWARD PAYMENTS 90. Service Award Payments. At least twenty-one (21) days before the Opt-Out and Objection Deadlines, Class Counsel will file a Fee Application that will include a request for Service Award Payments for the Settlement Class Representatives in recognition for their contributions to this Action. Citrix agrees not to oppose Class Counsel's request for a service award not to exceed $3,500.00 per representative. The Settlement Administrator shall make the Service Award Payments to the Settlement Class Representatives from the Settlement Fund. Such Service Award Payment shall be paid by the Settlement Administrator, in the amount approved by the Court, no later than thirty (30) days after the Effective Date. 91. No Effect on Agreement. In the event the Court declines to approve, in whole or in part, the payment of service awards in the amount requested, the remaining provisions of this Agreement shall remain in full force and effect. No decision by the Court, or modification or reversal or appeal of any decision by the Court, concerning the amount of the service awards shall constitute grounds for termination of this Agreement. 18 3 XV. ATTORNEYS' FEES, COSTS, EXPENSES 92. Attorneys' Fees and Costs and Expenses. At least twenty-one (21) days before the Opt-Out and Objection Deadlines, Class Counsel will file a Fee Application for an award of attorneys' fees and Litigation Costs and Expenses to be paid from the Settlement Fund. Citrix agrees not to oppose Class Counsel's request for an award of attorneys' fees not to exceed one- third (33.33%) of the Settlement Fund and reimbursement of litigation costs and expenses not to exceed $150,000.00. Prior to the disbursement or payment of the Fee Award and Costs under this Agreement, Class Counsel shall provide to Citrix and the Settlement Administrator a properly completed and duly executed IRS Form W-9. Fee Award and Costs (plus any interest accrued thereon) shall be paid by the Settlement Administrator, in the amount approved by the Court, no later than three (3) days after the Effective Date. 93. Allocation. Unless otherwise ordered by the Court, Class Counsel shall have the sole and absolute discretion to allocate any approved Fee Award and Costs amongst Plaintiffs' counsel and any other attorneys for Plaintiffs. Citrix shall have no liability or other responsibility for allocation of any such attorneys' fees and costs. XVI. NO ADMISSION OF LIABILITY 94. No Admission of Liability. The Parties understand and acknowledge that this Agreement constitutes a compromise and settlement of disputed claims. No action taken by the Parties either previously or in connection with the negotiations or proceedings connected with this Agreement shall be deemed or construed to be an admission of the truth or falsity of any claims or defenses heretofore made, or an acknowledgment or admission by any party of any fault, liability, or wrongdoing of any kind whatsoever. 95. No Use of Agreement. Neither the Settlement Agreement, nor any act performed or document executed pursuant to or in furtherance of the Settlement: (i) is or may be deemed to be, or may be used as, an admission of, or evidence of, the validity of any claim made by Plaintiffs; or (ii) is or may be deemed to be, or may be used as, an admission of, or evidence of, any fault or omission by Citrix in the Action or in any proceeding in any court, administrative agency or other tribunal. XVII. MISCELLANEOUS 96. Integration of Exhibits. The exhibits to this Agreement and any exhibits thereto are a material part of the Settlement and are incorporated and made a part of the Agreement. 97. Entire Agreement. This Agreement, including all exhibits hereto, shall constitute the entire Agreement among the Parties with regard to the subject matter hereof and shall supersede any previous agreements, representations, communications and understandings among the Parties. This Agreement may not be changed, modified, or amended except in writing signed by all Parties, subject to Court approval. The Parties contemplate that, subject to Court approval or without such approval where legally permissible, the exhibits to this Agreement may be modified by subsequent 19 3 Agreement of counsel for the Parties prior to dissemination of the Settlement Class Notice to the Settlement Class. 98. Deadlines. If any of the dates or deadlines specified herein falls on a weekend or legal holiday, the applicable date or deadline shall fall on the next business day. All reference to "days" in this agreement shall refer to calendar days unless otherwise specified. 99. Construction. For the purpose of construing or interpreting this Agreement, the Parties agree that this Agreement is to be deemed to have been drafted equally by all Parties hereto and shall not be construed strictly for or against any Party. 100. Cooperation of Parties. The Parties to this Agreement agree to cooperate in good faith to prepare and execute all documents, to seek Court approval, defend Court approval, and to do all things reasonably necessary to complete and effectuate the Settlement described in this Agreement. 101. Obligation to Meet and Confer. Before filing any motion in the Court raising a dispute arising out of or related to this Agreement, the Parties shall consult with each other in good faith prior to seeking Court intervention. 102. Governing Law. The Agreement shall be construed in accordance with, and be governed by, the laws of the State of Florida, without regard to the principles thereof regarding choice of law. 103. Counterparts. This Agreement may be executed in any number of counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument, even though all signatories do not sign the same counterparts. Original signatures are not required. Any signature submitted electronically through e-mail of an Adobe PDF shall be deemed an original. 104. Notices. All notices to Class Counsel provided for herein, shall be sent by overnight mail and email to: John A. Yanchunis MORGAN & MORGAN COMPLEX LITIGATION GROUP 201 N. Franklin Street, 7th Floor Tampa, Florida 33602 jyanchunis@ForThePeople.com J. Austin Moore STUEVE SIEGEL HANSON LLP 460 Nichols Road, Suite 200 Kansas City, Missouri 64112 moore@stuevesiegel.com 20 3 Gayle M. Blatt CASEY GERRY SCHENK FRANCAVILLA BLATT & PENFIELD LLP 110 Laurel Street San Diego, CA 92101 gmb@cglaw.com Rosemary M. Rivas LEVI & KORSINSKY LLP 388 Market Street, Suite 1300 San Francisco, CA 94111 rrivas@zlk.com Herman J. Russomanno III RUSSOMANNO & BORRELLO, P.A. Museum Tower – Penthouse 2800 150 West Flagler Street Miami, Florida 33130 herman2@russomanno.com All notices to Citrix provided for herein, shall be sent by overnight mail and email to: David F. McDowell Nancy R. Thomas MORRISON & FOERSTER LLP 707 Wilshire Boulevard Los Angeles, CA 90017-3543 dmcdowell@mofo.com nthomas@mofo.com The notice recipients and addresses designated above may be changed by written notice. 105. Authority. Any person executing this Agreement in a representative capacity represents and warrants that he or she is fully authorized to do so and to bind the Party on whose behalf he or she signs this Agreement to all of the terms and provisions of this Agreement. [SIGNATURES ON FOLLOWING PAGE] 3 By: __________________________ Date: _June 2, 2020_______ David F. McDowell Nancy R. Thomas MORRISON & FOERSTER LLP Counsel for Defendant Citrix Systems, Inc. By: __________________________ Date: _________________ J. Austin Moore STUEVE SIEGEL HANSON LLP By: __________________________ Date: _________________ John A. Yanchunis MORGAN & MORGAN By: __________________________ Date: _________________ Gayle M. Blatt CASEY GERRY SCHENK FRANCAVILLA BLATT & PENFIELD LLP By: __________________________ Date: _________________ Rosemary M. Rivas LEVI & KORSINSKY LLP By: __________________________ Date: _________________ Herman J. Russomanno III RUSSOMANNO & BORRELLO, P.A. Counsel for Plaintiffs and the Settlement Class 3 3 3 By: __________________________ Date: _________________ David F. McDowell Nancy R. Thomas MORRISON & FOERSTER LLP Counsel for Defendant Citrix Systems, Inc. By: __________________________ Date: __June 1, 2020_____ J. Austin Moore STUEVE SIEGEL HANSON LLP By: __________________________ Date: _________________ John A. Yanchunis MORGAN & MORGAN By: __________________________ Date: _________________ Gayle M. Blatt CASEY GERRY SCHENK FRANCAVILLA BLATT & PENFIELD LLP By: __________________________ Date: __June 2, 2020_____ Rosemary M. Rivas LEVI & KORSINSKY LLP By: __________________________ Date: _________________ Herman J. Russomanno III RUSSOMANNO & BORRELLO, P.A. Counsel for Plaintiffs and the Settlement Class 3 By: Date: David F. McDowell Nancy R. Thomas MORzuSON & FOERSTER LLP Counsel for Defendant Citrix Systems, Inc.,4 / /tri,''? / j.{- n /% By: {t "lu' Date: Junsl-202Q J. Austin Moore STUEVE SIEGEL HANSON LLP By: Date: John A. Yanchunis MORGAN & MORGAN Dare: blzlza.u CASEY GERRY SCHENK FRANCAVILLA BLATT & PENFIELD LLP By: Date: - Rosemary M. fuvas LEVI & KORSINSKY LLP By: Date: Herman J. Russomanno III RUSSOMANNO & BORRELLO, P.A. Counsel for Plaintffi and the Settlement Class 3 Exhibit 1 to Settlement Agreement (Class Action Notice) 3 This is a Court approved Legal Notice. This is not an advertisement. In re: Citrix Data Breach Litigation, Case No. 19-cv-61350 UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF FLORIDA CITRIX SYSTEMS, INC. CLASS ACTION SETTLEMENT TO: All individuals who were notified by Citrix Systems, Inc ("Citrix") that their personal information was or may have been compromised in the data breach initially disclosed by Citrix on or about March 2019. A Class Action Settlement has been proposed in litigation against Citrix relating to a data breach that Citrix disclosed on or about March 8, 2019 ("Data Breach"). You are receiving this notice because the following individual(s) are "Settlement Class Members" entitled to benefits from a class action settlement [LIST CLASS MEMBERS, INCLUDING ANY MINORS]. The easiest way to submit a claim under the settlement is online at www.CitrixDataBreachSettlement.com. Under the terms of the settlement, Citrix has agreed to establish a fund of $2,275,000.00 that will be used to pay for the following forms of relief:  Reimbursement for Out-of-Pocket Losses: The Settlement Fund will be used to reimburse Settlement Class Members for out-of-pocket losses fairly traceable to the Data Breach, up to $15,000.00 per individual ("Out-of-Pocket Losses").  Reimbursement for Attested Time: The Settlement Fund will be used to reimburse Settlement Class Members for time spent remedying issues related to the Data Breach for up to five (5) hours at $25.00 per hour ("Attested Time").  Identity Restoration Services: Regardless of whether you submit a claim under the Settlement, all Settlement Class Members will be eligible to access identity restoration services offered through Experian, including professional fraud resolution assistance to help with identity recovery and restoration in case you experience identity theft or fraud in the future, for a period of five (5) years ("Identity Restoration Services").  Minor Monitoring Services: Regardless of whether you submit a claim under the Settlement, a parent or legal guardian of a Settlement Class Member who is a minor at the time the settlement is final may enroll the minor in five (5) years of Experian's Minor Plus Monitoring Services. These services include monthly monitoring of Experian information for the minor; internet surveillance; fraud resolution services, and $1,000,000 in identity theft insurance for material damages caused by the misuse of the minor's credit file.  Three-Bureau Credit Monitoring Services: All Settlement Class Members are eligible to enroll in five (5) years of Experian's credit monitoring services at no cost, regardless of whether you submit a claim for Out-of-Pocket Losses or Attested Time. These services retail for nearly $1,200 per individual and include daily credit monitoring of your credit file at Experian, Equifax, and TransUnion, a $1 million identity theft insurance policy, and additional features discussed below ("Credit Monitoring Services"); or  Alternative Cash Payments: In lieu of Credit Monitoring Services, Settlement Class Members may elect to receive an Alternative Cash Payment in an amount equal to a pro rata distribution of the Net Settlement Fund (cash remaining after funds are allocated for Out-of-Pocket Losses, Attested Time, Credit Monitoring Services, Identity Restoration, Minor Monitoring Services, court awarded Attorneys' Fees, Litigation Costs, Service Award Payments and the costs of Settlement Notice and Administration);  Citrix Business Practice Commitments: In addition to the Settlement Fund, Citrix has agreed to implement and maintain certain business practice commitments relating to its information security 3 program for three years following the Effective Date of the Settlement ("Business Practice Commitments"). The Court still must decide whether to approve the settlement. No payments will be made until after the Court grants final approval of the settlement and all appeals, if any, are resolved. Your legal rights are affected whether you respond or not. Read this notice carefully. YOUR LEGAL RIGHTS AND OPTIONS IN THIS SETTLEMENT DEADLINE File a claim for You must submit a claim in order to receive reimbursement for Out- DATE out-of-pocket of-Pocket Losses and/or loss of time. You may claim Out-of-Pocket losses and lost Losses, Attested Time and either Credit Monitoring Services or the time Alternative Cash payment under the Settlement. For more detailed information, see Questions 6, 8, 13 and 14. File a claim for You must submit a claim(s) in order to receive the Credit DATE credit Monitoring Services offered under the Settlement or an Alternative monitoring Cash Payment. You do not need to file a claim to enroll in the Minor services or an Monitoring Services offered under the Settlement. alternative cash For more detailed information, see Questions 6, 9 and 14. payment Access identity You can access Identity Restoration Services after the Settlement No deadline restoration becomes final, whether or not you make a claim under the services Settlement. For more detailed information, see Questions 6 and 11. Exclude You can exclude yourself from the Settlement by informing the DATE yourself Settlement Administrator that you want to "opt-out" of the Settlement. If the settlement becomes final, this is the only option that allows you to retain your rights to separately sue Citrix for claims related to the Data Breach. If you opt-out, you may not make a claim for benefits under the Settlement. For more detailed information, see Question 20. Object or You may object to the Settlement by writing to the Settlement DATE comment on the Administrator and explaining why you don't think the Settlement settlement should be approved. If you object, you will remain a Settlement Class Member, and if the Settlement is approved, you will be eligible for the benefits of the Settlement and give up your right to sue on certain claims described in the Settlement Agreement which is available at www.CitrixDataBreachSettlement.com. For more detailed information, see Question 21. Do nothing If you do nothing, you will not be eligible to receive reimbursement No deadline for Out-Of-Pocket Losses or Attested Time, enroll in Credit Monitoring Services, or receive Alternative Cash Payment in lieu of Credit Monitoring Services. You will be eligible to access Identity Restoration Services through Experian and Minor Minoring Services if you have a qualifying minor dependent(s). If the Settlement becomes final, you will give up your rights to sue Citrix separately relating to the Data Breach. Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 2 3 For more detailed information, see Questions 6 and 16. What this Notice Contains Page BASIC INFORMATION AND OVERVIEW .........................................................................................5 1. Why did I get this notice? ..........................................................................................................5 2. What is this lawsuit about? ........................................................................................................5 3. Why is this a class action? .........................................................................................................5 4. Why is there a settlement? .........................................................................................................5 WHO IS PART OF THE SETTLEMENT ..............................................................................................5 5. How do I know if I am part of the Settlement?.......................................................................5,6 THE SETTLEMENT BENEFITS ............................................................................................................6 6. What does the Settlement provide?........................................................................................... 6 7. Will Citrix know if I submit a claim for settlement benefits? .................................................. 6 8. How will the Settlement compensate me for identity theft and fraud I have already suffered or expenses I have already paid to protect myself? ................................................................6,7 9. How will the Settlement help protect me against future identity theft and fraud? .................7,8 10. What if I already have credit monitoring or identity protection services? ...............................8 11. How will the Settlement help me deal with identity theft or fraud if it happens? .....................8 12. Will the Settlement include changes to Citrix's data security program? ...................................8 HOW TO GET SETTLEMENT BENEFITS ..........................................................................................8 13. How do I file a claim for Credit Monitoring Services or Alternative Cash Payment, Attested Time, Out-of-Pocket Losses ...................................................................................................8,9 14. How do I submit a claim on behalf of a Settlement Class Member who is a minor? ............... 9 15. When and how will I receive the benefits I claim from the settlement?....................................9 LEGAL RIGHTS RESOLVED THROUGH THE SETTLEMENT ....................................................9 16. What happens if I do nothing and what am I giving up to stay in the settlement class? ..........9 THE LAWYERS REPRESENTING YOU ...........................................................................................10 17. Do I have a lawyer in this case?...............................................................................................10 18. How will these lawyers be paid? .............................................................................................10 19. Will the class representatives receive any additional money? .................................................10 EXCLUDING YOURSELF FROM THE SETTLEMENT .................................................................10 20. How do I exclude myself from the Settlement?................................................................. 10,11 OBJECTING OR COMMENTING ON THE SETTLEMENT..........................................................11 21. How do I tell the Court that I don't like the Settlement? .........................................................11 GETTING MORE INFORMATION.....................................................................................................11 Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 3 3 22. Where can I get more information? .........................................................................................12 Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 4 3 BASIC INFORMATION AND OVERVIEW 1. Why did I get this Notice? You received this notice because Citrix sent you notice that your personal information was or may have been compromised in the data breach initially disclosed by Citrix in or about March 2019. A Court authorized this notice because you have a right to know how the proposed settlement may affect your rights. This notice explains the nature of the litigation, the general terms of the proposed settlement and what it may mean to you. This notice also explains the ways you may participate in, or exclude yourself from, the Settlement. 2. What is this lawsuit about? On March 8, 2019, Citrix disclosed that international cyber criminals had gained access to the internal Citrix network. The criminals may have accessed or stolen personal information of Citrix current and former employees, their dependents or beneficiaries, or other third parties. This information may have included people's names, Social Security numbers or other tax identification numbers, financial account numbers, passport numbers, limited health claims information, or other personal information. Citrix notified all current and former employees who were employed by Citrix on or after 2002 out of an abundance of caution and also conducted a review to identify other individuals whose sensitive personal data was exfiltrated and sent them notice as well. Thereafter, three class action lawsuits were filed in the United States District Court for the Southern District of Florida by individuals who allege that they were affected by the Data Breach. The judge overseeing the case is the Honorable Roy K. Altman. The Court consolidated the cases to proceed together under the caption In re: Citrix Data Breach Litigation, No. 19-cv-61350. The individuals who sued are called the "Plaintiffs." Citrix is the "Defendant." Plaintiffs claim that Citrix did not adequately protect their personal information. The consolidated complaint filed in the lawsuit, which describes the specific legal claims alleged by the Plaintiffs, is available at www.CitrixDataBreachSettlement.com. Citrix denies any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing. 3. Why is this a class action? In a class action, one or more people called "class representatives" sue on behalf of themselves and other people with similar claims. All of these people together are the "class" or "class members." Because this is a class action, even persons who did not file their own lawsuit can obtain relief from harm that may have been caused by the Data Breach, except for those individuals who timely exclude themselves from the Settlement Class. 4. Why is there a settlement? The Court has not decided in favor of Plaintiffs or Citrix. Instead, both sides agreed to a settlement. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The class representatives appointed to represent the class and the attorneys for the Settlement Class ("Class Counsel," see Question 17) believe that the Settlement is in the best interests of the Settlement Class Members. WHO IS PART OF THE SETTLEMENT 5. How do I know if I am part of the Settlement? You are a member of the Settlement Class if you received notice from Citrix that your personal information was or may have been compromised in the data breach initially disclosed by Citrix in or about March 2019, or you received this settlement notice stating that you or your dependent(s) are class members. Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 5 3 Excluded from the Settlement are:  Citrix and its officers, directors, legal representatives, successors, subsidiaries, and assigns;  The presiding judge and any judicial staff or immediate family members; and  Any Settlement Class Member who excludes himself or herself from the Settlement (see Question 20). If you are not sure whether you are included in the Settlement Class, call [PHONE NUMBER]. THE SETTLEMENT BENEFITS 6. What does the Settlement provide? Under the Settlement, Citrix will pay $2,275,000.00 into a Settlement Fund that will be used to provide the following benefits:  Cash reimbursement for Out-of-Pocket Losses fairly traceable to the Data Breach (see Question 8);  Cash reimbursement for Attested Time spent remedying issues related to the Data Breach (see Question 8);  Identity Restoration Services (see Question 11);  Credit Monitoring Services (see Question 9) or  Alternative Cash Payments (see Question 10);  Minor Monitoring Services for affected minors (see Question 9);  Attorneys' fees and expenses as approved by the Court (see Question 18), service awards for the class representatives as approved by the Court (see Question 19-), and the costs of notifying the class and administering the Settlement. Depending on the number of valid claims, the costs of settlement administration, and the amount awarded by the Court for attorney's fees and costs and service payments, payments for certain benefits may be reduced proportionally or withheld as set forth in paragraph 68 of the Settlement Agreement. As part of the Settlement, Citrix also has agreed to implement certain business practices relating to its information security program for three years after the Effective Date of the Settlement (see Question 12). 7. Will Citrix know if I submit a claim for settlement benefits? No. As part of the Settlement Agreement, Citrix will not have access to the identities of Settlement Class Members who make claims for any of the benefits provided by this Settlement. 8. How will the Settlement compensate me for identity theft and fraud I have already suffered or expenses I have already paid to protect myself? Settlement Benefit: Payment for Unreimbursed Out-of-Pocket Losses: If you spent money to address fraud or identity theft that or to protect yourself from future harm that is fairly traceable to the Data Breach, then you can submit a claim for reimbursement up to $15,000. Out-of-Pocket losses that are eligible for reimbursement through the Settlement may include, but are not limited to, the following costs related to the Data Breach and incurred after October 13, 2018:  Unreimbursed costs associated with fraud or identity theft;  Professional fees including attorneys' fees, accountants' fees and fees for credit repair services;  Miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance telephone charges; Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 6 3  Costs of credit monitoring or other identity theft protection services incurred on or after October 13, 2018;  Costs associated with freezing or unfreezing credit with any credit reporting agency. This list provides examples only, and other losses or costs traceable to the Data Breach may also be eligible for reimbursement. YOU MUST BE ABLE TO DOCUMENT YOUR CLAIM. The Settlement Administrator has the sole authority to determine the validity of claims for Out-Of-Pocket Losses. Only valid claims will be paid. The deadline to file a claim for Out-of-Pocket Losses is [DATE] (this is the last day to file online and the postmark deadline for mailed claims). Settlement Benefit: Reimbursement for Attested Time: If you spent time dealing with fraud or identity theft or to protect yourself from future harm that is fairly traceable to the Data Breach, then you may also make a claim for reimbursement for up to 5 hours at $25 per hour. You may receive reimbursement for up to 5 hours at $25 per hour by providing an attestation and a brief description of (i) the actions taken in response to the Data Breach in dealing with misuse of your information or taking preventative measures and (ii) the time associated with each action. Claims for Attested Time are capped at $125 per individual but may be combined with reimbursement for Out-of- Pocket Losses subject to an individual aggregate cap of $15,000. The Settlement Administrator has the authority to determine the validity of claims for Attested Time. Only valid claims will be paid. The deadline to file a claim for Attested Time is [DATE]. 9. How will the Settlement help protect me against future identity theft and fraud? Settlement Benefit: Three-Bureau Credit Monitoring Services: The Settlement provides a way to help protect yourself from unauthorized use of your personal information. Settlement Class Members may submit a claim to enroll in five (5) years of Experian IdentityWorks credit monitoring services at no cost. These services retail at nearly $1,200 per individual and include the following features:  Three-bureau credit monitoring providing notice of changes to your credit report at all three national credit reporting agencies;  Experian credit report upon enrollment;  Identity restoration services to help you address credit and non-credit related fraud.  Experian IdentityWorks ExtendCARE providing extended identity restoration support.  Up to $1 Million in insurance coverage for certain costs relating to identity theft and unauthorized electronic fund transfers. If you submit a valid claim form and elect to enroll in Credit Monitoring Services, you will receive enrollment instructions by mail or email after the Settlement becomes final. You may make a claim for reimbursement for Out-of-Pocket Losses and/or Attested Time and Credit Monitoring Services under the Settlement. You may only elect to receive either Credit Monitoring Services or an Alternative Cash Payment (See Questions 9 and 10). In the event that 7,500 or more class members elect to enroll in Credit Monitoring Services under the Settlement, the number of years of Credit Monitoring Services provided pursuant to this benefit election will be reduced to three (3) years. Settlement Benefit: Minor Plus Monitoring Services: A parent or legal guardian of a Settlement Class Member who is a minor at the time the settlement is final may enroll the minor in five (5) years of Experian's Minor Plus Monitoring Services. These services include monthly monitoring of Experian information for the minor; internet surveillance; fraud resolution services, and $1,000,000 in identity theft insurance for material damages caused by the misuse of the minor's credit file. Parents or guardians of Settlement Class Members who are minors do not need to submit a submit a claim form to enroll the Settlement Class Member in Minor Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 7 3 Plus Monitoring. The Settlement Administrator will automatically send enrollment instructions by mail or email to a legal guardian for each qualifying minor after the Settlement becomes final. 10. What if I already have credit monitoring or identity protection services? Settlement Benefit: Alternative Cash Payments from Net Settlement Fund: All Settlement Class Members who do not opt out of the settlement and who do not elect to receive Credit Monitoring Services, may make a claim for an Alternative Cash Payment. The amount of the Alternative Cash Payment will depend on the number of claims and will be paid from the Net Settlement Funds (funds remaining after payments for Attested Time, Out-of-Pocket Losses, Credit Monitoring Services, Minor Monitoring Services, Identity Restoration, costs of notice and administration, attorneys' fees and expenses, and service award payments). These payments could range from several dollars to two hundred dollars or more depending on the number of Settlement Class Members who submit valid claims. For example, if 20% of the Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, Settlement Class Members claiming this benefit will likely receive a minimum cash payment of at least $50. If 10% or less of Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, the Alternative Cash Payments will likely exceed $150 per claimant. If the claims rate exceeds 25%, then Alternative Cash Payments may be significantly reduced or withheld. For your reference, in many class action settlements only 5-10% of eligible class members submit valid claims. If you have questions regarding this benefit, you may contact Class Counsel as provided for in Question 17. Alternative Cash Payments are available to Settlement Class Members who receive payment for Attested Time and Out of Pocket Losses, however each class member is subject to an individual aggregate cap of $15,000.00. 11. How will the Settlement help me deal with identity theft or fraud if it happens? Settlement Benefit: Identity Restoration Services: All Settlement Class Members who do not opt out of the Settlement will receive access to Identity Restoration Services through Experian IdentityWorks after the Settlement becomes final. These services include access to Fraud Resolution Specialists to assist you in addressing an identity theft event, including assistance with dealing with companies, government agencies, and credit bureaus. All Settlement Class Members who do not opt out of the Settlement may access Identity Resolution Services after the Settlement becomes final, even they do not make a claim, by going to www.CitrixDataBreachSettlement.com, or calling toll free number [PHONE NUMBER] and referencing engagement code XXXXX. 12. Will the Settlement include changes to Citrix's data security program? Settlement Benefit: Data Security Business Practice Commitments by Citrix: Citrix has agreed to implement and pay for Business Practice Commitments relating to information security for a period of three years after the Effective Date of the Settlement. These Business Practice Commitments are in the following categories: enhanced cybersecurity training and awareness program; enhanced data security policies; enhanced security measures; further restricting access to personal information; and enhanced monitoring and response capability. HOW TO GET SETTLEMENT BENEFITS 13. How do I file a claim for Credit Monitoring Services or Alternative Cash Payment, Attested Time, and/or Out-of-Pocket Losses? To submit a claim for Out-of-Pocket Losses or Attested Time fairly traceable to the Data Breach, Credit Monitoring Services or an Alternative Cash Payment, you will need to file a claim form. There are two options for filing claims: Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 8 3 (1) File Online: You may fill out and submit the claim form online at www.CitrixData BreachSettlement.com. This is the quickest way to file a claim. (2) File by Mail: Alternatively, you may fill out the claim form attached to this notice and mail it to the address on the form with supporting documentation, if any. If you lost or did not otherwise receive a claim form, you can download a hard copy of the claim form (available at www.CitrixDataBreachSettlement.com), or ask the Settlement Administrator to mail a claim form to you by calling [PHONE NUMBER]. Fill out your claim form, and mail it (including postage) to: In re: Citrix Data Breach Litigation c/o [Administrator], [ADDRESS]. The deadline to file a claim is [ DATE] (this is the last day to file online and/or the postmark deadline for mailed claims). 14. How do I submit a claim on behalf of a Settlement Class Member who is a minor? If you received notice that your minor dependent(s) is a Settlement Class Member, a parent or legal guardian may submit a claim on the minor's behalf by filling out and submitting the minor claim form included with this notice or filing online at www.CitrixDataBreachSettlement.com. Legal guardians may seek reimbursement for Out-of-Pocket Losses and Attested Time on behalf of the minor as set forth in Question 8. 15. When and how will I receive the benefits I claim from the Settlement? Credit Monitoring Services claimed by Settlement Class Members will begin, and payments for valid claims will be made, after the Court enters the Final Approval Order and Judgment and the Settlement becomes final. This process may take several months or longer if there is an appeal; please be patient. Once there is a Final Approval Order and Judgment, it will be posted on the Settlement Administrator's website. If you make a claim for Credit Monitoring Services, the Settlement Administrator will send you information on how to activate your credit monitoring once the Settlement is final. The Settlement Administrator will provide you with an activation code that you will use at the Experian website to activate the applicable Credit Monitoring Services. The activation code(s) will remain valid for at least 60 days. Checks for valid claims for Out-of-Pocket Losses, Attested Time and Alternative Cash Payments either will be mailed by the Settlement Administrator to the mailing address that you provide, or will be provided through PayPal or Venmo at your election. LEGAL RIGHTS RESOLVED THROUGH THE SETTLEMENT 16. What happens if I do nothing and what am I giving up to stay in the settlement class? If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your legal claims against Citrix arising out of the issues this Settlement resolves. Unless you exclude yourself from the Settlement (see Question 20), all of the decisions by the Court will bind you. The specific claims you are giving up against Citrix are described in Section XIII of the Settlement Agreement. The Settlement Agreement is available at www.CitrixDataBreachSettlement.com. You will be releasing Citrix and all related people as described in Section XIII of the Settlement Agreement. The Settlement Agreement describes the released claims with specific descriptions, so read it carefully. If you have any questions regarding the release, you may contact Class Counsel as provided for in Question 17. Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 9 3 THE LAWYERS REPRESENTING YOU 17. Do I have a lawyer in the case? Yes. The Court appointed the following attorneys to represent you and other Settlement Class Members as "Class Counsel." John A. Yanchunis Rosemary M. Rivas MORGAN & MORGAN LEVI & KORSINSKY LLP COMPLEX LITIGATION GROUP 388 Market Street, Suite 1300 201 N. Franklin Street, 7th Floor San Francisco, CA 94111 Tampa, Florida 33602 415-373-1671 813- 223-5505 Herman J. Russomanno III J. Austin Moore RUSSOMANNO & BORRELLO, P.A. STUEVE SIEGEL HANSON LLP Museum Tower – Penthouse 2800 460 Nichols Road, Suite 200 150 West Flagler Street Kansas City, MO 64112 Miami, Florida 33130 816-714-7100 305-373-2101 Gayle M. Blatt CASEY GERRY SCHENK FRANCAVILLA BLATT & PENFIELD LLP 110 Laurel Street San Diego, CA 92101 619-238-1811 You will not be charged by these lawyers for their work on the case. If you want to be represented by your own lawyer, you may hire one at your own expense. If you have questions about how to submit a claim or if you need to update your address information, please contact the Settlement Administrator (see Question 22). 18. How will these lawyers be paid? Class Counsel have undertaken this case on a contingency-fee basis and have not been paid any money in relation to their work on this case to date. Accordingly, Class Counsel will ask the Court to award them attorneys' fees of up to one-third (33.33%) of the Settlement Fund, and reimbursement for costs and expenses up to $150,000 to be paid from the Settlement Fund. You will not have to separately pay any portion of these fees yourself. The Court will decide the amount of fees and costs and expenses to be paid. Class Counsel's request for attorneys' fees and costs (which must be approved by the Court) will be filed by [DATE] and will be available to view on the settlement website at www.CitrixDataBreachSettlement.com. 19. Will the class representatives receive any additional money? The class representatives are listed in the Settlement Agreement, which is located at www.CitrixDataBreachSettlement.com. Class Counsel will ask the Court to award these individuals Service Award Payments of up to $3,500.00 for the time that they spent, and the risks that they undertook, in bringing this lawsuit on behalf of the class. This amount is also subject to Court approval. Any amount approved by the Court will be paid from the Settlement Fund. Class Counsel's request for these Payments (which must be approved by the Court) will be filed by [DATE] and will be available to view on the settlement website at www.CitrixDataBreachSettlement.com. Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 10 3 EXCLUDING YOURSELF FROM THE SETTLEMENT 20. How do I exclude myself from the Settlement? If you are a member of the settlement class but do not want to remain in the class, you may exclude yourself from the class (also known as "opting out"). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in this Notice. If you decide on this option, you may keep any rights you have, if any, against Citrix and you may file your own suit against Citrix based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options. . To exclude yourself from the Settlement, you must mail a request for exclusion, postmarked no later than [DATE], to: Citrix Class Action Settlement Administrator Attn: Exclusion In re: Citrix Data Breach Litigation c/o [ADDRESS LINE 1] [ADDRESS LINE 2] This statement must contain the following information: (1) The name of this proceeding (In re: Citrix Data Breach Litigation, No. 19-cv-61350R-RKA or similar identifying words such as "Citrix Data Breach Lawsuit"); (2) Your full name and address; (3) The words "Request for Exclusion" at the top of the document or a statement that you do not wish to participate in the settlement; and (4) Your signature. If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the settlement class, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court, and you may not recover under any other individual settlement agreement regarding the claims released as part of the Settlement. OBJECTING OR COMMENTING ON THE SETTLEMENT 21. How do I tell the Court that I don't like the Settlement? If you are a Settlement Class Member, you can object to the Settlement if you don't think it is fair, reasonable, or adequate, including Class Counsel's motion for an award of attorneys' fees and costs and expenses, and/or the requested service award payments to the Settlement Class Representatives. The Court cannot order a larger settlement or award you more based on your individual circumstances; the Court can only approve or deny the Settlement as it is presented. To object, you must send a letter stating that you object to the Settlement. Your objection must include: (1) The name of this proceeding (In re: Citrix Data Breach Litigation, No. 19-cv-61350-RKA or similar identifying words such as "Citrix Data Breach Lawsuit"); (2) Your full name, address, and telephone number; (3) State with specificity the grounds for the objection, as well as any documents supporting the objection; Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 11 3 (4) A statement as to whether the objection applies only to you and your circumstances, to a specific subset of the class, or to the entire class; (5) The name and address of any attorneys representing you with respect to the objection; (6) A statement regarding whether you or your attorney intend to appear at the Final Approval Hearing; and (7) You or your attorney's signature. To be considered by the Court, your objection must be mailed, postmarked no later than [DATE], to the following address: Citrix Class Action Settlement Administrator Attn: Objections In re: Citrix Data Breach Litigation c/o [Administrator] [ADDRESS LINE 1] [ADDRESS LINE 2] You must not submit your objections directly to the Court. If you do not comply with these procedures and the deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed settlement. You will still be eligible to receive settlement benefits if the Settlement becomes final even if you object to the Settlement. The Court has scheduled a Final Approval Hearing to listen to and consider whether the Settlement is fair, adequate, and reasonable. If there are objections, the Court will consider them. The hearing will take place on [DATE and TIME] before the Honorable Roy K. Altman, at the United States District Court for the Southern District of Florida, 299 East Broward Blvd. Fort Lauderdale, Florida 33301. This hearing date and time may be moved or may be conducted telephonically or by video conference. Please refer to the settlement website for notice of any changes. GETTING MORE INFORMATION 22. Where can I get more information? This notice summarizes the Settlement. More details are in the Settlement Agreement itself. You can get a copy of the Settlement Agreement and other case documents at www.CitrixDataBreachSettlement.com. If you have questions about this Notice or the Settlement, you may contact the Settlement Administrator by [PHONE, EMAIL, OR MAIL at In re: Citrix Data Breach Litigation c/o [Administrator] [ADDRESS]]. If you wish to communicate directly with Class Counsel, you may contact them (contact information noted above in Question 17). You may also seek advice and guidance from your own private attorney at your own expense, if you wish to do so. The status of the settlement, any appeals, and the date of payments will be posted on the Settlement website. The Court cannot respond to any questions regarding this Notice, the lawsuit, or the proposed settlement. Please do not contact the Court or its Clerk with questions about the Settlement. Questions? Go to www.CitrixDataBreachSettlement.com or call [PHONE NUMBER] 12 3 Exhibit 2 to Settlement Agreement (Claim Form) 3 Must be postmarked CITRIX DATA BREACH SETTLEMENT or submitted online C/O [CLAIMS ADMINISTRATOR] NO LATER THAN P.O. BOX ______ Month Day, 2020 [CITY],[STATE] [ZIP] WWW.CITRIXDATABREACHSETTLEMENT.COM Citrix Data Breach Claim Form SETTLEMENT BENEFITS – WHAT YOU MAY GET If you received notice that your personal information may have been compromised in the Citrix data breach announced in March 2019, and if you did not opt out of the settlement, you may submit a claim. The easiest way to submit a claim is online at www.CitrixDataBreachSettlement.com, or you can complete and mail this claim form to the mailing address above. You may submit a claim for one or more of these benefits: Cash Reimbursement. Use the claim form to request money for one or more of the following: 1. Reimbursement for Money You Spent. If you spent money trying to avoid or recover from fraud or identity theft because of the Citrix data breach, you can be reimbursed up to $15,000. You must submit documents supporting your claim. 2. Reimbursement for Time Spent. If you spent time trying to avoid or recover from fraud or identity theft because of the Citrix data breach, you can get $25 per hour for up to five (5) total hours. Credit monitoring. Use this claim form to request free credit monitoring services through Experian for five (5) years. If you do not wish to receive credit monitoring, you can select an alternative cash payment. The alternative cash payment will be In lieu of credit monitoring and will be an amount equal to a pro rata distribution of the Net Settlement Fund. Settlement Class Members who are Minors. Persons under the age of eighteen (18) and whose information was or may have been compromised in the Citrix Data Breach are eligible to submit a claim for settlement benefits through their legal guardian by using the Minor Claim Form. No claim is required for Identity Restoration Services. U.S. consumers affected by the Citrix data breach who did not opt out of the settlement will be able to access identity restoration services for a period of at least (five) 5 years once the Settlement is final by calling 1-NNN-NNN- NNNN and referencing engagement code XXXXX. * * * Claims must be submitted online or mailed by [DATE]. Use the address at the top of this form for mailed claims. Please note: the settlement administrator may contact you to request additional documents to process your claim. Your cash benefit may decrease depending on the number of claims filed. Questions? Visit www.CitrixDataBreachSettlement.com or call _________________ Page 1 of 5 3 For more information and complete instructions visit www.CitrixDataBreachSettlement.com. Settlement benefits will be distributed after the Settlement is approved by the Court and final. If you submit a claim, it will be maintained as confidential and not shared with Citrix. Your Information We will use this information to contact you and process your claim. It will not be used for any other purpose. If any of the following information changes, you must promptly notify us by emailing ----@CitrixDataBreachSettlement.com. First Middle Initial Last 1. NAME: 2. ALTERNATIVE NAME(S): Street Address 3. MAILING ADDRESS: Apt. No. City State Zip 4. PHONE NUMBER: 5. EMAIL ADDRESS: Cash Payment: Money You Lost or Spent If you lost or spent money trying to prevent or recover from fraud or identity theft caused by the Citrix data breach and have not been reimbursed for that money, you can receive reimbursement for up to $15,000. It is important for you to send documents that show what happened and how much you lost or spent, so that you can be repaid. To look up more details about how cash payments work, visit www.CitrixDataBreachSettlement.com or call toll-free _______. You will find more information Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 2 of 5 3 about the types of costs and losses that can be paid back to you, what documents you need to attach, and how the Settlement Administrator decides whether to approve your payment. Amount and Date Description of Loss or Money Spent and Supporting Examples of Loss Type Documents and Documents (Identify what you are attaching, and why it's related to the Citrix breach) Credit monitoring and $ ______________________________________ identity theft protection purchased on or after ______________________________________ 10/13/2018 ______________________________________ Date: Examples: Receipts or ______________________________________ statements for credit monitoring services Costs, expenses, and $ ______________________________________ losses due to identity theft, fraud, or misuse of your ______________________________________ personal information on or ______________________________________ after 10/13/2018 Date: ______________________________________ Examples: Account statement with unauthorized charges ______________________________________ highlighted; police reports; IRS documents; FTC Identity Theft ______________________________________ Reports; letters refusing to refund fraudulent charges; credit monitoring services you purchased Professional fees paid to $ ______________________________________ address identity theft on or after 10/13/2018 ______________________________________ Examples: Receipts, bills, and ______________________________________ invoices from accountants, Date: lawyers, or others ______________________________________ Other expenses such as $ ______________________________________ notary, fax, postage, copying, mileage, and long- ______________________________________ distance telephone charges ______________________________________ related to the data breach Date: ______________________________________ Examples: Phone bills, receipts, detailed list of places you traveled ______________________________________ (i.e. police station, IRS office), reason why you traveled there (i.e. ______________________________________ police report or letter from IRS re: falsified tax return) and number of ______________________________________ miles you traveled Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 3 of 5 3 Cash Payment: Time Spent If you spent time trying to recover from fraud or identity theft caused by the data breach, or if you spent time trying to avoid fraud or identity theft because of the data breach (for example, researching the breach, placing or removing credit freezes on your credit files, purchasing credit monitoring services, or taking other actions), complete the chart below. You can be compensated $25 per hour for up to five (5) hours. You must describe the actions you took in response to the data breach and the time each action took. How much time did you lose related to the data breach? _______: _______ (Do not answer this question if you are not claiming lost time.) Hours Minutes By filling out the boxes below, you are certifying that the time you spent doesn't relate to other data breaches. Explanation of Time Spent Number of Hours and Approx. Date(s) Minutes (Identify what you did and why) ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 4 of 5 3 ____________________________________ ____________________________________ How You Would Like to Receive Your Cash Payment If you made a claim for a cash payment in this claim form, you can elect to receive your payment either by check or electronically by PayPal or Venmo. Checks must be cashed within NN days. Which do you prefer?  Check  PayPal (If checked) PayPal e-mail address:_______________.  Venmo (If checked) Venmo username:_______________. Signature I affirm under the laws of the United States that the information supplied in this claim form is true and correct to the best of my knowledge and that any documents that I have submitted in support of my claim are true and correct copies of original documentation. I understand that I may be asked to provide more information by the claims administrator before my claim is complete. Signature: Dated: Print Name: Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 5 of 5 3 Exhibit 3 to Settlement Agreement (Minor Claim Form) 3 Must be postmarked CITRIX DATA BREACH SETTLEMENT or submitted online C/O [CLAIMS ADMINISTRATOR] NO LATER THAN P.O. BOX ______ Month Day, 2020 [CITY],[STATE] [ZIP] WWW.CITRIXDATABREACHSETTLEMENT.COM Citrix Data Breach Minor Claim Form SETTLEMENT BENEFITS – WHAT YOU MAY GET If you received notice that you are the legal guardian of a minor dependent whose personal information may have been compromised by the Citrix data breach announced in March 2019, and if you did not opt out of the settlement, you may submit a claim on behalf of each affected minor. Note that you may only submit a claim for minor dependents identified in your settlement notice. You must submit a separate minor claim form for each affected minor. The easiest way to submit a claim is online at www.CitrixDataBreachSettlement.com, or you can complete and mail this claim form to the mailing address above. You may submit a claim for one or more of these benefits on behalf of a minor under the age of eighteen (18): Cash Reimbursement. Use the claim form to request money for one or more of the following: 1. Reimbursement for Money Spent. If money was spent trying to avoid or recover from fraud or identity theft to a minor because of the Citrix data breach, a cash reimbursement is available up to $15,000. Supporting documents must be submitted. 2. Reimbursement for Time Spent. If time was spent trying to avoid or recover from fraud or identity theft to a minor because of the Citrix data breach, a cash reimbursement of $25 per hour is available for up to five (5) total hours. Minor monitoring services. Minors under the age of 18 are automatically eligible for monitoring services provided by Experian for five (5) years. Minor monitoring services include Internet surveillance, fraud resolution services and $1 million in identity theft insurance.There is no need to submit a claim under the settlement to be eligible for minor monitoring services. An enrollment code will be automatically sent to you by mail or email for each qualifying minor. * * * Claims must be submitted online or mailed by [DATE]. Use the address at the top of this form for mailed claims. Please note: the settlement administrator may contact you to request additional documents to process your claim. Your cash benefit may decrease depending on the number of claims filed. For more information and complete instructions visit www.CitrixDataBreachSettlement.com. Questions? Visit www.CitrixDataBreachSettlement.com or call _________________ Page 1 of 6 3 Settlement benefits will be distributed after the Settlement is approved by the Court and final. If you submit a claim, it will be maintained confidential and not shared with Citrix. Your Information We will use this information to contact you and process your claim. It will not be used for any other purpose. If any of the following information changes, you must promptly notify us by emailing ----@CitrixDataBreachSettlement.com. First Middle Initial Last 1. NAME OF MINOR: 2. ALTERNATIVE NAME(S) FOR ANY MINORS LISTED ABOVE: 3. NAME OF LEGAL GUARDIAN Street Address 4. MAILING ADDRESS: Apt. No. City State Zip 5. PHONE NUMBER: 6. YOUR EMAIL ADDRESS: Cash Payment: Money Lost or Spent If money was lost or spent trying to prevent or recover from fraud or identity theft to a minor caused by the Citrix data breach and such money has not been reimbursed, a claim for reimbursement is available for up to $15,000. It is important for you to send documents that show what happened and how much was lost or spent, so that you can be repaid. Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 2 of 6 3 To look up more details about how cash payments work, visit www.CitrixDataBreachSettlement.com or call toll-free _______. You will find more information about the types of costs and losses that can be paid back, what documents you need to attach, and how the Settlement Administrator decides whether to approve payment. Amount and Date Description of Loss or Money Spent on behalf of Minor Examples of Loss Type and Supporting Documents and Documents (Identify what you are attaching, and why it's related to the Citrix breach) Credit monitoring and $ ______________________________________ identity theft protection purchased for your minor on ______________________________________ or after 10/13/2018 ______________________________________ Date: Examples: Receipts or ______________________________________ statements for credit monitoring services Costs, expenses, and $ ______________________________________ losses due to identity theft, fraud, or misuse of your ______________________________________ minor's information on or ______________________________________ after 10/13/2018 Date: ______________________________________ Examples: Account statement with unauthorized charges ______________________________________ highlighted; police reports; IRS documents; FTC Identity Theft ______________________________________ Reports; letters refusing to refund fraudulent charges; credit monitoring services you purchased Professional fees paid to $ ______________________________________ address identity theft to your minor on or after ______________________________________ 10/18/2018 ______________________________________ Date: Examples: Receipts, bills, and ______________________________________ invoices from accountants, lawyers, or others Other expenses such as $ ______________________________________ notary, fax, postage, copying, mileage, and long- ______________________________________ distance telephone charges ______________________________________ related to your minor child Date: and the data breach ______________________________________ Examples: Phone bills, receipts, ______________________________________ detailed list of places you traveled (i.e. police station, IRS office), ______________________________________ reason why you traveled there (i.e. police report or letter from IRS re: ______________________________________ falsified tax return) and number of miles you traveled Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 3 of 6 3 Cash Payment: Time Spent If time was spent trying to recover from fraud or identity theft to a minor caused by the data breach, or if time was spent trying to avoid fraud or identity theft to a minor because of the data breach (for example, researching the breach, placing or removing credit freezes on your credit files, purchasing credit monitoring services, or taking other actions), complete the chart below. Compensation is available for $25 per hour for up to five (5) hours. You must describe the actions taken in response to the data breach and the time each action took. How much time did you lose related to the data breach? _______: _______ (Do not answer this question if you are not claiming lost time.) Hours Minutes By filling out the boxes below, you are certifying that the time you spent doesn't relate to other data breaches. Number Supporting Explanation of Time Spent Approx. of Hours Documentation? Date(s) and (Y/N) (Identify what you did on the minor's behalf and why) Minutes (not required) ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 4 of 6 3 ____________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ How You Would Like to Receive Your Cash Payment If you made a claim for a cash payment in this claim form, you can elect to receive your payment either by check or electronically by PayPal or Venmo. Checks must be cashed within NN days. Which do you prefer?  Check  PayPal (If checked) PayPal e-mail address:_______________.  Venmo (If checked) Venmo username:_______________. Minor Monitoring: Free Service For Five Years You may be eligible to receive free minor monitoring Qualifying minors are automatically eligible to receive minor monitoring services for five (5) years. This benefit is available regardless of whether a claim is submitted on behalf of the minor under the settlement. Minor monitoring services include Internet surveillance, fraud resolution services, and $1 million in identity theft insurance. You will receive activation instructions for each eligible minor at the email address provided above after the settlement has received final approval. If you did not provide an email address, instructions will be sent via U.S. mail. Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 5 of 6 3 Signature I affirm under the laws of the United States that I am the legal guardian for the minor listed on this form. I also affirm that the information supplied in this claim form is true and correct to the best of my knowledge and that any documents that I have submitted in support of the claim are true and correct copies of original documentation. I understand that I may be asked to provide more information by the claims administrator before the claim is complete. Signature: Dated: Print Name: Questions? Visit www.CitrixDataBreachSettlement.com or call _____________ Page 6 of 6