In re: Citrix Data Breach Litigation

Frequently Asked Questions

1. BASIC INFORMATION AND OVERVIEW

1. Why was the Notice issued and why should I read it?

   The Court has authorized posting of the Notice to inform you of proposed settlement that may affect your rights. The notice explains the nature of the litigation, the general terms of the proposed settlement and what it may mean to you. The notice also explains the ways you may participate in, or exclude yourself from, the Settlement.

2. What is this lawsuit about?

   On March 8, 2019, Citrix disclosed that international cyber criminals had gained access to the internal Citrix network. The criminals may have accessed or stolen personal information of Citrix current and former employees, their dependents or beneficiaries, or other third parties. This information may have included people’s names, Social Security numbers or other tax identification numbers, financial account numbers, passport numbers, limited health claims information, or other personal information.

   Citrix notified all current and former employees who were employed by Citrix on or after 2002 out of an abundance of caution and also conducted a review to identify other individuals whose sensitive personal data was exfiltrated and sent them notice as well.

   Thereafter, three class action lawsuits were filed in the United States District Court for the Southern District of Florida by individuals who allege that they were affected by the Data Breach. The judge overseeing the case is the Honorable Roy K. Altman. The Court consolidated the cases to proceed together under the caption In re: Citrix Data Breach Litigation, No. 19-cv-61350. The individuals who sued are called the “Plaintiffs.” Citrix is the “Defendant.” Plaintiffs claim that Citrix did not adequately protect their personal information. The consolidated complaint filed in the lawsuit, which describes the specific legal claims alleged by the Plaintiffs, is available on the Important Documents page.

   Citrix denies any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing.

3. Why is this a class action?

   In a class action, one or more people called “class representatives” sue on behalf of themselves and other people with similar claims. All of these people together are the “class” or “class members.” Because this is a class action, even persons who did not file their own lawsuit can obtain relief from harm that may have been caused by the Data Breach, except for those individuals who timely exclude themselves from the Settlement Class.

4. Why is there a settlement?

   The Court has not decided in favor of Plaintiffs or Citrix. Instead, both sides agreed to a settlement. Settlements avoid the costs and uncertainty of a trial and related appeals, while more quickly providing benefits to members of the Settlement Class. The class representatives appointed to represent the class and the attorneys for the Settlement Class (“Class Counsel,” see FAQ 17) believe that the Settlement is in the best interests of the Settlement Class Members.

5. WHO IS PART OF THE SETTLEMENT

5. How do I know if I am part of the Settlement?

   You are a member of the Settlement Class if you received notice from Citrix that your personal information was or may have been compromised in the data breach initially disclosed by Citrix in or about March 2019, or you received this settlement notice stating that you or your dependent(s) are class members.

   Excluded from the Settlement are:

   • Citrix and its officers, directors, legal representatives, successors, subsidiaries, and assigns;
   • The presiding judge and any judicial staff or immediate family members; and
   • Any Settlement Class Member who excludes himself or herself from the Settlement (see FAQ 19).

   If you are not sure whether you are included in the Settlement Class, call 833-984-2604.

6. THE SETTLEMENT BENEFITS

6. What does the Settlement provide?

   Under the Settlement, Citrix will pay $2,275,000.00 into a Settlement Fund that will be used to provide the following benefits:

   • Cash reimbursement for Out-of-Pocket Losses fairly traceable to the Data Breach (see FAQ 8);
   • Cash reimbursement for Attested Time spent remedying issues related to the Data Breach (see FAQ 8);
   • Identity Restoration Services (see FAQ 11);
   • Credit Monitoring Services (see FAQ 9) or
   • Alternative Cash Payments (see FAQ 10);
   • Minor Monitoring Services for affected minors (see FAQ 9);
   • Attorneys’ fees and expenses as approved by the Court (see FAQ 18), and the costs of notifying the class and administering the Settlement.

   Depending on the number of valid claims, the costs of settlement administration, and the amount awarded by the Court for attorney’s fees and costs and service payments, payments for certain benefits may be reduced proportionally or withheld as set forth in paragraph 68 of the Settlement Agreement.

   As part of the Settlement, Citrix also has agreed to implement certain business practices relating to its information security program for three years after the Effective Date of the Settlement (see FAQ 12).

7. Will Citrix know if I submit a claim for settlement benefits?

   No. As part of the Settlement Agreement, Citrix will not have access to the identities of Settlement Class Members who make claims for any of the benefits provided by this Settlement.

8. How will the Settlement compensate me for identity theft and fraud I have already suffered or expenses I have already paid to protect myself?

   Settlement Benefit: Payment for Unreimbursed Out-of-Pocket Losses: If you spent money to address fraud or identity theft that or to protect yourself from future harm that is fairly traceable to the Data Breach, then you can submit a claim for reimbursement up to $15,000. Out-of-Pocket losses that are eligible for reimbursement through the Settlement may include, but are not limited to, the following costs related to the Data Breach and incurred after October 13, 2018:

   • Unreimbursed costs associated with fraud or identity theft;
   • Professional fees including attorneys’ fees, accountants’ fees and fees for credit repair services;
   • Miscellaneous expenses such as notary, fax, postage, copying, mileage, and long-distance telephone charges;
   • Costs of credit monitoring or other identity theft protection services incurred on or after October 13, 2018;
   • Costs associated with freezing or unfreezing credit with any credit reporting agency.

   This list provides examples only, and other losses or costs traceable to the Data Breach may also be eligible for reimbursement. YOU MUST BE ABLE TO DOCUMENT YOUR CLAIM.

   The Settlement Administrator has the sole authority to determine the validity of claims for Out-Of-Pocket Losses. Only valid claims will be paid. The deadline to file a claim for Out-of-Pocket Losses is May 17, 2021 (this is the last day to file online and the postmark deadline for mailed claims).

   Settlement Benefit: Reimbursement for Attested Time: If you spent time dealing with fraud or identity theft or to protect yourself from future harm that is fairly traceable to the Data Breach, then you may also make a claim for reimbursement for up to 5 hours at $25 per hour.

   You may receive reimbursement for up to 5 hours at $25 per hour by providing an attestation and a brief description of (i) the actions taken in response to the Data Breach in dealing with misuse of your information or taking preventative measures and (ii) the time associated with each action. Claims for Attested Time are capped at $125 per individual but may be combined with reimbursement for Out-of-Pocket Losses subject to an individual aggregate cap of $15,000. The Settlement Administrator has the authority to determine the validity of claims for Attested Time. Only valid claims will be paid. The deadline to file a claim for Attested Time is May 17, 2021.

9. How will the Settlement help protect me against future identity theft and fraud?

   Settlement Benefit: Three-Bureau Credit Monitoring Services: The Settlement provides a way to help protect yourself from unauthorized use of your personal information. Settlement Class Members may submit a claim to enroll in five (5) years of Experian IdentityWorks credit monitoring services at no cost. These services retail at nearly $1,200 per individual and include the following features:

   • Three-bureau credit monitoring providing notice of changes to your credit report at all three national credit reporting agencies;
   • Experian credit report upon enrollment;
   • Identity restoration services to help you address credit and non-credit related fraud.
   • Experian IdentityWorks ExtendCARE providing extended identity restoration support.
   • Up to $1 Million in insurance coverage for certain costs relating to identity theft and unauthorized electronic fund transfers.

   If you submit a valid claim form and elect to enroll in Credit Monitoring Services, you will receive enrollment instructions by mail or email after the Settlement becomes final. You may make a claim for reimbursement for Out-of-Pocket Losses and/or Attested Time and Credit Monitoring Services under the Settlement. You may only elect to receive either Credit Monitoring Services or an Alternative Cash Payment (See FAQs 9 and 10). In the event that 7,500 or more class members elect to enroll in Credit Monitoring Services under the Settlement, the number of years of Credit Monitoring Services provided pursuant to this benefit election will be reduced to three (3) years.

   Settlement Benefit: Minor Plus Monitoring Services: A parent or legal guardian of a Settlement Class Member who is a minor at the time the settlement is final may enroll the minor in five (5) years of Experian’s Minor Plus Monitoring Services. These services include monthly monitoring of Experian information for the minor; internet surveillance; fraud resolution services, and $1,000,000 in identity theft insurance for material damages caused by the misuse of the minor’s credit file. Parents or guardians of Settlement Class Members who are minors do not need to submit a submit a claim form to enroll the Settlement Class Member in Minor Plus Monitoring. The Settlement Administrator will automatically send enrollment instructions by mail or email to a legal guardian for each qualifying minor after the Settlement becomes final.

10. What if I already have credit monitoring or identity protection services?

    Settlement Benefit: Alternative Cash Payments from Net Settlement Fund: All Settlement Class Members who do not opt out of the settlement and who do not elect to receive Credit Monitoring Services, may make a claim for an Alternative Cash Payment. The amount of the Alternative Cash Payment will depend on the number of claims and will be paid from the Net Settlement Funds (funds remaining after payments for Attested Time, Out-of-Pocket Losses, Credit Monitoring Services, Minor Monitoring Services, Identity Restoration, costs of notice and administration, attorneys’ fees and expenses). These payments could range from several dollars to two hundred dollars or more depending on the number of Settlement Class Members who submit valid claims. For example, if 20% of the Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, Settlement Class Members claiming this benefit will likely receive a minimum cash payment of at least $50. If 10% or less of Settlement Class Members submit a valid claim for reimbursement for Out-of-Pocket Losses and Attested Time, the Alternative Cash Payments will likely exceed $150 per claimant. If the claims rate exceeds 25%, then Alternative Cash Payments may be significantly reduced or withheld. For your reference, in many class action settlements only 5-10% of eligible class members submit valid claims. If you have questions regarding this benefit, you may contact Class Counsel as provided for in FAQ 17.

    Alternative Cash Payments are available to Settlement Class Members who receive payment for Attested Time and Out of Pocket Losses, however each class member is subject to an individual aggregate cap of $15,000.00.

11. How will the Settlement help me deal with identity theft or fraud if it happens?

    Settlement Benefit: Identity Restoration Services: All Settlement Class Members who do not opt out of the Settlement will receive access to Identity Restoration Services through Experian IdentityWorks after the Settlement becomes final. These services include access to Fraud Resolution Specialists to assist you in addressing an identity theft event, including assistance with dealing with companies, government agencies, and credit bureaus.

    All Settlement Class Members who do not opt out of the Settlement may access Identity Resolution Services after the Settlement becomes final, even they do not make a claim, by going to this website, or calling Experian toll free at (888) 292-0073 and referencing engagement code B009229 for adults or B009231 for minors.

12. Will the Settlement include changes to Citrix’s data security program?

    Settlement Benefit: Data Security Business Practice Commitments by Citrix: Citrix has agreed to implement and pay for Business Practice Commitments relating to information security for a period of three years after the Effective Date of the Settlement. These Business Practice Commitments are in the following categories: enhanced cybersecurity training and awareness program; enhanced data security policies; enhanced security measures; further restricting access to personal information; and enhanced monitoring and response capability.

13. HOW TO GET SETTLEMENT BENEFITS

13. How do I file a claim for Credit Monitoring Services or Alternative Cash Payment, Attested Time, and/or Out-of-Pocket Losses?

    To submit a claim for Out-of-Pocket Losses or Attested Time fairly traceable to the Data Breach, Credit Monitoring Services or an Alternative Cash Payment, you will need to file a claim form. There are two options for filing claims:

    1. File Online: You may fill out and submit the claim form online on the Submit a Claim page. This is the quickest way to file a claim.
    2. File by Mail: Alternatively, you may fill out a claim form and mail it to the address on the form with supporting documentation, if any. You can download a hard copy of the claim form on the Important Documents page, or ask the Settlement Administrator to mail a claim form to you by calling 833-984-2604. Fill out your claim form and mail it (including postage) to: In re: Citrix Data Breach Litigation c/o Citrix Data Breach Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103.

    The deadline to file a claim is May 17, 2021 (this is the last day to file online and/or the postmark deadline for mailed claims).

14. How do I submit a claim on behalf of a Settlement Class Member who is a minor?

    If you received notice that your minor dependent(s) is a Settlement Class Member, a parent or legal guardian may submit a claim on the minor’s behalf by filling out and submitting the minor claim form online on the Submit a Claim page or by downloading the form and mailing to the Settlement Administrator. Legal guardians may seek reimbursement for Out-of-Pocket Losses and Attested Time on behalf of the minor as set forth in FAQ 8.

15. When and how will I receive the benefits I claim from the Settlement?

    Credit Monitoring Services claimed by Settlement Class Members will begin, and payments for valid claims will be made, after the Court enters the Final Approval Order and Judgment and the Settlement becomes final. This process may take several months or longer if there is an appeal; please be patient. Once there is a Final Approval Order and Judgment, it will be posted on the Settlement Administrator’s website.

    If you make a claim for Credit Monitoring Services, the Settlement Administrator will send you information on how to activate your credit monitoring once the Settlement is final. The Settlement Administrator will provide you with an activation code that you will use at the Experian website to activate the applicable Credit Monitoring Services. The activation code(s) will remain valid for at least 60 days.

    Checks for valid claims for Out-of-Pocket Losses, Attested Time and Alternative Cash Payments either will be mailed by the Settlement Administrator to the mailing address that you provide, or will be provided through PayPal or Venmo at your election.

16. LEGAL RIGHTS RESOLVED THROUGH THE SETTLEMENT

16. What happens if I do nothing and what am I giving up to stay in the settlement class?

    If you make a claim under the Settlement, or if you do nothing, you will be releasing all of your legal claims against Citrix arising out of the issues this Settlement resolves. Unless you exclude yourself from the Settlement (see FAQ 19), all of the decisions by the Court will bind you. The specific claims you are giving up against Citrix are described in Section XIII of the Settlement Agreement. The Settlement Agreement is available on the Important Documents page. You will be releasing Citrix and all related people as described in Section XIII of the Settlement Agreement.

    The Settlement Agreement describes the released claims with specific descriptions, so read it carefully. If you have any questions regarding the release, you may contact Class Counsel as provided for in FAQ 17.

17. THE LAWYERS REPRESENTING YOU

17. Do I have a lawyer in the case?

    Yes. The Court appointed the following attorneys to represent you and other Settlement Class Members as “Class Counsel.”

    John A. Yanchunis
    MORGAN & MORGAN
    COMPLEX LITIGATION GROUP
    201 N. Franklin Street, 7th Floor
    Tampa, Florida 33602
    813- 223-5505

    Rosemary M. Rivas
    GIBBS LAW GROUP LLP
    505 14th Street, Suite 1110
    Oakland, CA 94612
    510-359-9700

    J. Austin Moore
    STUEVE SIEGEL HANSON LLP
    460 Nichols Road, Suite 200
    Kansas City, MO 64112
    816-714-7100

    Herman J. Russomanno III
    RUSSOMANNO & BORRELLO, P.A.
    Museum Tower – Penthouse 2800
    150 West Flagler Street
    Miami, Florida 33130
    305-373-2101

    Gayle M. Blatt
    CASEY GERRY SCHENK FRANCAVILLA
    BLATT & PENFIELD LLP
    110 Laurel Street
    San Diego, CA 92101
    619-238-1811

    You will not be charged by these lawyers for their work on the case. If you want to be represented by your own lawyer, you may hire one at your own expense. If you have questions about how to submit a claim or if you need to update your address information, please contact the Settlement Administrator (see FAQ 21).

18. How will these lawyers be paid?

    Class Counsel have undertaken this case on a contingency-fee basis and have not been paid any money in relation to their work on this case to date. Accordingly, Class Counsel have asked the Court to award them attorneys’ fees in the amount of $750,000 equaling 32.9% of the Settlement Fund, and reimbursement for costs and expenses in the amount of $18,494.16 to be paid from the Settlement Fund. You will not have to separately pay any portion of these fees yourself. The Court will decide the amount of fees and costs and expenses to be paid. Class Counsel’s request for attorneys’ fees and costs (which must be approved by the Court) was filed on February 4, 2021 and is available to view on the Important Documents page.

19. EXCLUDING YOURSELF FROM THE SETTLEMENT

19. How do I exclude myself from the Settlement?

    If you are a member of the settlement class but do not want to remain in the class, you may exclude yourself from the class (also known as “opting out”). If you exclude yourself, you will lose any right to participate in the Settlement, including any right to receive the benefits outlined in the Notice.

    If you decide on this option, you may keep any rights you have, if any, against Citrix and you may file your own suit against Citrix based upon the same legal claims that are asserted in this lawsuit, but you will need to find your own attorney at your own cost to represent you in that lawsuit. If you are considering this option, you may want to consult an attorney to determine your options.

    To exclude yourself from the Settlement, you must mail a request for exclusion, postmarked no later than March 28, 2021, to:

    Citrix Data Breach Settlement Administrator
    Attn: Exclusion
    In re: Citrix Data Breach Litigation
    P.O. Box 58220
    Philadelphia, PA 19102

    This statement must contain the following information:

    1. The name of this proceeding (In re: Citrix Data Breach Litigation, No. 19-cv-61350R-RKA or similar identifying words such as “Citrix Data Breach Lawsuit”);
    2. Your full name and address;
    3. The words “Request for Exclusion” at the top of the document or a statement that you do not wish to participate in the settlement; and
    4. Your signature.

    If you do not comply with these procedures and the deadline for exclusions, you will lose any opportunity to exclude yourself from the settlement class, and your rights will be determined in this lawsuit by the Settlement Agreement if it is approved by the Court, and you may not recover under any other individual settlement agreement regarding the claims released as part of the Settlement.

20. OBJECTING OR COMMENTING ON THE SETTLEMENT

20. How do I tell the Court that I don’t like the Settlement?

    If you are a Settlement Class Member, you can object to the Settlement if you don’t think it is fair, reasonable, or adequate, including Class Counsel’s motion for an award of attorneys’ fees and costs and expenses. The Court cannot order a larger settlement or award you more based on your individual circumstances; the Court can only approve or deny the Settlement as it is presented.

    To object, you must send a letter stating that you object to the Settlement. Your objection must include:

    1. The name of this proceeding (In re: Citrix Data Breach Litigation, No. 19-cv-61350-RKA or similar identifying words such as “Citrix Data Breach Lawsuit”);
    2. Your full name, address, and telephone number;
    3. State with specificity the grounds for the objection, as well as any documents supporting the objection;
    4. A statement as to whether the objection applies only to you and your circumstances, to a specific subset of the class, or to the entire class;
    5. The name and address of any attorneys representing you with respect to the objection;
    6. A statement regarding whether you or your attorney intend to appear at the Final Approval Hearing; and
    7. You or your attorney’s signature.

    To be considered by the Court, your objection must be mailed, postmarked no later than March 28, 2021, to the following address:

    Citrix Data Breach Settlement Administrator
    Attn: Objections
    In re: Citrix Data Breach Litigation
    P.O. Box 58220
    Philadelphia, PA 19102

    You must not submit your objections directly to the Court. If you do not comply with these procedures and the deadline for objections, you may lose any opportunity to have your objection considered at the Final Approval Hearing or otherwise to contest the approval of the Settlement or to appeal from any orders or judgments entered by the Court in connection with the proposed settlement. You will still be eligible to receive settlement benefits if the Settlement becomes final even if you object to the Settlement.

    The Court has scheduled a Final Approval Hearing to listen to and consider whether the Settlement is fair, adequate, and reasonable. If there are objections, the Court will consider them.

    The hearing will take place on June 10, 2021 via Zoom Videoconference before the Honorable Roy K. Altman, at the United States District Court for the Southern District of Florida, 299 East Broward Blvd. Fort Lauderdale, Florida 33301. The hearing time and dial-in information for the video hearing will be posted to the settlement website on or about May 12, 2021.The hearing date and time may be moved, please refer to the settlement website for notice of any changes.

21. GETTING MORE INFORMATION

21. Where can I get more information?

    The notice summarizes the Settlement. More details are in the Settlement Agreement itself. You can get a copy of the Settlement Agreement and other case documents on the Important Documents page. If you have questions about this Notice or the Settlement, you may contact the Settlement Administrator by phone at 833-984-2604, by email at info@CitrixDataBreachSettlement.com, or by mail at:

    In re: Citrix Data Breach Litigation
    c/o Citrix Data Breach Settlement Administrator
    1650 Arch Street, Suite 2210,
    Philadelphia, PA 19103

    If you wish to communicate directly with Class Counsel, you may contact them (contact information noted above in FAQ 17). You may also seek advice and guidance from your own private attorney at your own expense, if you wish to do so.

    The status of the settlement, any appeals, and the date of payments will be posted on this website.

    The Court cannot respond to any questions regarding the Notice, the lawsuit, or the proposed settlement.
    Please do not contact the Court or its Clerk with questions about the Settlement.