Common use of Dispute Resolution for Claims Clause in Contracts

Dispute Resolution for Claims. The Settlement Administrator, in its sole (1) the claimant is a Class Member; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Administrator may, at any time, request from the claimant, in writing, additional information that the Settlement Administrator deems reasonably necessary to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Administrator shall request additional information and allow the claimant 14 days from the date of the request to cure the defect. If the defect is not cured within the time allotted, then the claim will be deemed invalid. 2.4.2 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1, the Settlement Administrator shall have 10 days to accept or reject the Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim is valid, then the Claim shall be paid. If the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.7.1. The Settlement Administrator, in its sole Claims Administrator will determine whether: (1) the claimant is a an Exposure Class Member; Member or Non-Exposure Class Member based on information to be provided to the Claims Administrator by PTHC’s counsel; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.1 and 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Breach (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.7.2. Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.7.3. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may shall reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.7.4. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the Claims Administrator. If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. 2.7.5. The Claims Administrator shall provide the Settling Parties’ counsel with a summary of Facially Valid Claims on a monthly basis, stating the name of the Settlement Class Member, the approved Claim amount, and a description of the support provided for such Claim. This provision does Within fifteen (15) days after receiving such summary, one or more of the Settling Parties may object to any Claim and instruct the Claims Administrator to withhold approval of said Facially Valid Claim so that the objecting party may seek review of said Claim by a third-party Settlement Referee agreed upon by the Parties or appointed by the Court if no such agreement is reached. PTHC shall not apply where be responsible for paying any objected to claim unless and until said objection is resolved by the Claim value deviates due to a pro rata increase or decreaseSettlement Referee.

Dispute Resolution for Claims. 41. The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1) the claimant Claimant is a Settlement Class Member; ; (2) the claimant Claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Outclaimed ordinary or extraordinary out-of-Pocket-Expense Claims; pocket expenses, described in Paragraphs 14 and 15, above; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant Claimant has suffered the claimed losses as a result of the Data Incident; Incident (collectively, “Complete and (4) the claimant timely submitted his or her Claim FormPlausible”). The Settlement Claims Administrator may, at any time, request from the claimantClaimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claimClaim (“Claim Supplementation”), e.g., documentation requested on the Claim Formclaim form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. 42. The Claims Administrator’s initial review will be limited to a determination of whether the Claim is Complete and Plausible. For any such claims Claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims Claims to the Settling Parties. If the Parties (one Plaintiffs’ lawyer agree that the Claimant’s Claim is Complete and Plausible, then the Claim shall be designated to fill this role for all Plaintiffs)paid. IfIf the Parties agree that the Claim is incomplete and/or implausible, upon it shall be denied. If the Parties do not agree, after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to a mediator pursuant to agreement between the Settlement Administrator Parties (the “Claims Referee”), for final determination on the Claim validityresolution. 2.4.1 43. Upon receipt of an incomplete or unsigned Claim Form claim form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim Claim is facially validComplete and Plausible, the Settlement Claims Administrator shall request additional information Claim Supplementation and allow give the claimant 14 Claimant thirty (30) days to cure the defect before rejecting the Claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such claim form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the Claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim Claim will be deemed invalidinvalid and there shall be no obligation to pay the Claim. 2.4.2 44. Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the each Claim. If, after review of the Claim and all documentation submitted by the claimantClaimant, the Settlement Claims Administrator determines that such a claim Claim is validComplete and Plausible, then the Claim shall be paid. If the Claim is not valid Complete and Plausible because the claimant Claimant has not provided all information needed to complete the information requested by claim form and evaluate the Settlement AdministratorClaim, then the Settlement Claims Administrator may reject the Claim without any further action. A defect If the Claim is rejected in one whole or in part, for other reasons, then the Claim shall not cause rejection of any other Valid be referred to the Parties. If the Parties agree that the Claimant’s Claim submitted by is incomplete and/or implausible then no further action shall be taken. If the claimant. 2.4.3 Class Members shall have 10 days from receipt of Parties agree that the approval of a Claimant’s Claim that provides a payment that deviates from the losses described on is Complete and Plausible, then the Claim Form to accept or reject shall be paid. If the Claim. This provision does Parties do not apply where agree, after meeting and conferring, then the Claim value deviates due shall be referred to a pro rata increase or decreasethe Claims Referee for resolution.

Dispute Resolution for Claims. 2.6.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.1 and 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has plausibly suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The determination of whether a claim made under paragraphs 2.1 or 2.2 is plausibly caused by the Data Incident shall be made by the Settlement Administrator based on a preponderance of the evidence standard (i.e., the claimed loss or expense was more likely than not caused by the Data Incident). The Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.6.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.6.3 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.11.1. The Settlement Administrator, in its sole Claims Administrator will determine whether: (1) the claimant is a Settlement Class Member; Member based on information to be provided to the Claims Administrator by Defendant’s counsel; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.4 and 2.5; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses unreimbursed cost, loss, or expenditure as a result of the Data Incident; and Ransomware Attack (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writingvia email or U.S. Mail, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed unreimbursed costs, losses, or expenditures, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.11.2. Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information Claim Supplementation and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.11.3. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may shall reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.11.4. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision does not apply where If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. 2.11.5. Within thirty (30) days of the Claims Deadline, the Claims Administrator shall provide the Settling Parties’ counsel with a summary of Facially Valid Claims, stating the types of claims, the total approved claim amounts by claim type, and a description of the support provided for claims for reimbursement for Ordinary Out-of-Pocket Losses and/or Extraordinary Losses and Attested Time. Within fifteen (15) days after receiving such summary, one or more of the Settling Parties may object to any claim and instruct the Claims Administrator to withhold approval of said Facially Valid Claim value deviates due to so that the objecting party may seek review of said claim by a pro rata increase third-party Settlement Referee agreed upon by the Parties or decreaseappointed by the Court if no such agreement is reached and paid for by the objecting party.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its sole (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any third-party documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in §§ IV.2.1 and/or IV.2.2, and/or entitlement to enrollment in Credit Monitoring services as described in § IV.2.4; and (3) the information submitted could lead a reasonable person to conclude that it is the claimant has more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Breach (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, may at any time, time request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.6.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later, and a copy of the request for Claim Supplementation shall be provided to cure Class Counsel and counsel for Defendants. In the defectevent of unusual circumstances interfering with compliance during the 21-day period, the claimant may request and, for good cause shown (illness, military service, out of the country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 21-day deadline in which to comply; however, in no event shall the deadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.6.2 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Administrator Claims Administrator, in its sole discretion, shall have 10 thirty (30) days to accept accept, in whole or a lesser amount, or reject the Claimeach claim. If, If after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is partially Facially Valid, the claim shall be paid to the extent that the Claims Administrator determines the claim to be Facially Valid, and the Claims Administrator shall inform the Settlement Class Member of the determination and inform the claimant of his/her right to dispute the determination in writing and request an appeal within thirty (30) days. If the claim is not valid because the claimant has not provided the information requested by the Settlement AdministratorFacially Xxxxx, then the Settlement Claims Administrator may reject the Claim without any further action. A defect claim and inform the claimant of his/her right to dispute the determination in one Claim shall not cause rejection of any other Valid Claim submitted by the claimantwriting and request an appeal within thirty (30) days. 2.4.3 Class Members 2.6.3 Claimants shall have 10 thirty (30) days from receipt of the denial or partial denial of a claim from the Claims Administrator to dispute such determination in writing request an appeal. If a claimant disputes a determination in writing and requests an appeal, the Claims Administrator shall provide a copy of the claimant’s dispute, Claim Form, and Claim Supplementation (if any), along with all documentation and other information submitted by the claimant to Class Counsel and counsel for Defendants. Counsel will confer regarding the claim submission, and their approval of denial of the claimant’s submission, whether in whole or in part, will be final. If counsel cannot agree on approval or denial of a Claim that provides a payment that deviates from claimant’s submission, in whole or in part, the losses described on dispute will be submitted to the Claim Form Claims Referee. 2.6.4 Pursuant to accept or reject § IV.1.6 above, subject to Court approval, the ClaimSettling Parties agree to use Xxx. This provision does not apply where the Claim value deviates due to a pro rata increase or decreaseXxxxx Xxxxxxxx (Xxx.) of

Dispute Resolution for Claims. 2.8.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member and/or SSN Subclass Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.1 and 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Security Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.8.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.8.3 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.8.4 Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision does not apply where If a Settlement Class Member rejects an offer from the Claim value deviates due Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a pro rata increase or decreasefinal determination.

Dispute Resolution for Claims. a) The Settlement Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant Claimant is a Settlement Class Member; ; (2) the claimant Claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Pocket Loss Claims; , described in Paragraph 2.4, above; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant Claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Administrator may, at any time, request Claim Supplementation from the claimant, in writing, additional information that the Settlement Administrator deems reasonably necessary to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validityClaimant. 2.4.1 b) Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim Claim is facially validcomplete and plausible, the Settlement Administrator shall request additional information Claim Supplementation and allow give the claimant 14 Claimant 30 days to cure the defect before rejecting the Claim. Requests for Claim Supplementation shall be made within 30 days of receipt of such Claim Form or 30 days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the Claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defect. If deadline be extended to later than one year from the defect is not cured within the time allotted, then the claim will be deemed invalidEffective Date. 2.4.2 c) Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Administrator shall have 10 30 days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimantClaimant, the Settlement Administrator determines that such a claim is facially valid, either in whole or in part, then the Claim claim shall be paid. If the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect paid in one Claim shall not cause rejection of any other Valid Claim submitted by the claimantaccordance with Paragraphs 2.1 through 2. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.4.1 The Settlement Claims Administrator, in its solehis sole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in { 2.1 or { 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any Claims for Extraordinary Expenses, the Claims Administrator’s initial review will be limited to a determination of whether the Claim is complete and plausible. For any such claims Claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims Claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree with the Claimant’s Claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator Claims Referee for final determination on the Claim validityresolution. 2.4.1 2.4.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.4.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantClaims Referee. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree with the Claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one-hundred-and-eighty (180) days from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its his or her sole (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 (a) Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall may request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within twenty-one (21) days of receipt of such Claim Form or ten (10) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with a claimant’s compliance with meeting the 30-day cure period, the claimant may request and, for good cause shown (severe illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than thirty (30) days from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalid. 2.4.2 invalid and there shall be no obligation to pay the claim. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its solehis or her (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalid. 2.4.2 invalid and there shall be no obligation to pay the claim. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim deficient portion of the claim without any further action. A defect in one Claim If the claim is rejected for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimant. 2.4.3 Claims Referee. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. If the claimant approves the final determination, then the approved amount shall be the amount to be paid. If the claimant does not apply where approve the Claim value deviates due final determination within thirty (30) days, then the dispute will be submitted to a pro rata increase or decrease.the Claims Referee within an additional ten

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant is a California Settlement Subclass Member; (3) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims;claimant’s class membership and the expenses described in ¶¶ 2.1 through 2.3; and (34) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information Claim Supplementation and allow give the claimant 14 thirty (30) days from the date of the request to cure the defectdefect before rejecting the claim. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.5.4 Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision If a Settlement Class Member does not apply where timely accept or reject an offer of partial payment, the Claim value deviates due Settlement Class Member will be deemed to have accepted such partial payment offer. If a pro rata increase or decreaseSettlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final, non-appealable determination. If the claimant approves the final determination, then the approved amount shall be the amount to be paid. If the claimant does not approve the final determination within thirty (30) days, then the dispute will be determined by the Claims Administrator within an additional ten (10) day period.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ of Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree with the Claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.5.4 If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third- party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims;claimant’s class membership and the expenses described in ¶¶ 2.1 through 2.3; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information Claim Supplementation and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim If the claim is rejected for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimant. 2.4.3 Class Members shall have 10 days from receipt Claims Referee upon request of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decreaseSettlement Class Member.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its solehis or her (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Administrator shall request additional information and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalid. 2.4.2 invalid and there shall be no obligation to pay the claim. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect in one Claim If the claim is rejected for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimant. 2.4.3 Claims Referee. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. If the claimant approves the final determination, then the approved amount shall be the amount to be paid. If the claimant does not apply where approve the Claim value deviates due final determination within thirty (30) days, then the dispute will be submitted to a pro rata increase or decrease.the Claims Referee within an additional ten

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one of Plaintiffs’ lawyer lawyers shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree regarding the Claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.5.4 If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third- party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. 2.11.1. The Settlement Administrator, in its sole Claims Administrator will determine whether: (1) the claimant is a Settlement Class Member; Member based on information to be provided to the Claims Administrator by Defendant’s counsel; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.3 and 2.4; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses unreimbursed cost, loss, or expenditure as a result of the Data Incident; and Ransomware Attack (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed unreimbursed costs, losses, or expenditures, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.11.2. Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information Claim Supplementation and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.11.3. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may shall reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.11.4. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision does not apply where If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. 2.11.5. Within thirty (30) days of the Claims Deadline, the Claims Administrator shall provide the Settling Parties’ counsel with a summary of Facially Valid Claims, stating the types of claims, the total approved claim amounts by claim type, and a description of the support provided for claims for reimbursement for Ordinary Out-of-Pocket Losses and/or Extraordinary Losses and Attested Time. Within fifteen (15) days after receiving such summary, one or more of the Settling Parties may object to any claim and instruct the Claims Administrator to withhold approval of said Facially Valid Claim value deviates due to so that the objecting party may seek review of said claim by a pro rata increase third-party Settlement Referee agreed upon by the Parties or decreaseappointed by the Court if no such agreement is reached and paid for by the objecting party.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary Docusign Envelope ID: E7AE1CF7-080D-407C-AC99-A2FFB35A6C35 require to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the Claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalid, the Settlement Claims Administrator will submit those claims to the counsel for the Settling Parties (one Plaintiffs’ lawyer Parties. If the Settling Parties, through counsel, mutually agree with the determination by the Claims Administrator that a Claim is invalid, the Claim shall be designated to fill this role for all Plaintiffs)denied. If, upon meeting and conferring, If the Settling Parties disagree as to regarding the Claim validitytreatment of the Claim, then the Claim shall be resubmitted and referred back to the Settlement Claims Administrator for a final determination on the Claim validitybinding and independent resolution. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim Claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 submitting Settlement Class Member thirty (30) days from the date transmission of the request a cure notice to cure the defectdefect before rejecting the claim. If the defect is not cured within the time allottedtimely cured, then the claim Claim will be deemed invalidinvalid and there shall be no obligation to pay the Claim. Further, if an insufficient or otherwise non-compliant Claim Form is submitted by or for a Person not included in the Class Member Information (defined below), the Claims Administrator shall deem the Claim invalid without first engaging in the Claim Supplementation process. 2.4.2 2.5.3 Following timely receipt of additional information pursuant from a Settlement Class Member subject to a request by cure notice, the Settlement Claims Administrator under ¶ 2.4.1shall have ten (10) days to reject or accept, in whole or lesser amount, the Settlement Administrator shall have 10 days to accept or reject the Class Member’s Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim Claim is facially valid, then the Claim shall be paid. If the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimantpaid subject to ¶ 2.5. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.8.1. The Settlement Administrator, in its sole Claims Administrator will determine whether: (1) the claimant is a Settlement Class Member; Member based on information to be provided to the Claims Administrator by Defendant’s counsel; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.3 and 2.4; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of plausibly arose from the Data Incident; and Security Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.8.2. Upon receipt of an unclear, incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall may request additional information Claim Supplementation and allow give the claimant 14 thirty (30) days to cure the defect before rejecting or altering the claim request. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (including but not limited to illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim as requested. 2.4.2 2.8.3. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.8.4. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision does not apply where If a Settlement Class Member rejects an offer from the Claim value deviates due Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a pro rata increase final determination. 2.8.5. The Claims Administrator shall provide the Settling Parties’ counsel with a summary of Facially Valid Claims on at least a monthly basis, stating the types of claims, the total approved claim amounts by claim type, and a description of the support provided for claims for reimbursement for Out-of-Pocket Losses. Within fifteen (15) days after receiving such summary, one or decreasemore of the Settling Parties may object to the determination on any claim and instruct the Claims Administrator to withhold approval or rejection of said claim so that the objecting party may seek review of said claim by a third-party Settlement Referee agreed upon by the Parties or appointed by the Court if no such agreement is reached.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim FormBreach. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information required documentation regarding the claimed losses, etc. The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties. If the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). Ifdo not agree with the claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination on the Claim validityresolution. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.5.4 Subject to Court approval, the Settling Parties agree to use Xxxxxxx Xxxxxx of Xxxxxxxx Ronon Xxxxxxx & Xxxxx LLP as the claims referee in this matter. If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third-party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. The Settlement Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Class Member; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Pocket Loss Claims; ; (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her their Claim Form. The Settlement Administrator may, at any time, request from the claimant, in writing, additional information that the Settlement Administrator deems reasonably necessary to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to Counsel for the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs)Parties. If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 i. Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Administrator shall request additional information and allow the claimant 14 days from the date of the request to cure the defect. If the defect is not cured within the time allotted, then the claim will be deemed invalid. 2.4.2 ii. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.160(i), the Settlement Administrator shall have 10 days to accept or reject the Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim is valid, then the Claim shall be paid. If the Settlement Administrator determines the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 iii. Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 4 2.6.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably and in good faith (1) the claimant is a Settlement Class Member; ; (2) the claimant has 6 provided all information needed to complete the Claim Form, including any documentation that may be 7 necessary to reasonably support the Outout-of-Pocket-Expense Claims; pocket expenses and/or lost time described in ¶¶ 2.1 and 2.2; 8 and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has 9 suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, 10 request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may 11 reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, 12 information regarding the claimed losses, available insurance and the status of any claims made for 13 insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims 14 Claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will 15 submit those claims Claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for 16 all Plaintiffs). IfIf the Settling Parties do not agree with the Settlement Administrator’s determination, upon 17 after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back for resolution to the Settlement Administrator for final determination on claim referee, 18 to be selected by the Claim validityParties if needed. Any costs associated with work performed by the claims referee 19 shall be paid by NRS. 2.4.1 20 2.6.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is 21 not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement 22 Claims Administrator shall request additional information and allow give the claimant 14 thirty (30) days from the date of the request to cure 23 the defectdefect before rejecting the claim. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid 24 and there shall be no obligation to pay the claim. 2.4.2 25 2.6.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims 26 Administrator, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, 27 or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement 28 Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim 1 claim is not facially valid because the claimant has not provided all information needed to complete the information requested by 2 Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any 3 further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 4 2.6.4 Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to 5 accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision If a Settlement 6 Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have 7 fifteen (15) days to reconsider its initial adjustment amount and make a final determination. If the 8 claimant approves the final determination, then the approved amount shall be the amount to be paid. If 9 the claimant does not apply where approve the final determination within thirty (30) days, then the dispute shall be 10 submitted to the Settling Parties. If the Settling Parties do not agree with the Settlement Administrator’s 11 determination, or are unable to reach a mutually satisfactory resolution after meeting and conferring, 12 then the Claim value deviates due shall be referred for resolution to a pro rata increase or decreasethe claim referee, to be selected by the Parties if needed. 13 2.6.5 If any dispute is submitted to the claims referee, the claims referee may approve

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer Xxxxx Xxxxxxxx shall be designated to fill this role for all PlaintiffsPlaintiff). IfIf the Settling Parties do not agree with the Claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.5.4 If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third- party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. The Settlement Administrator, in its sole (1) the claimant is a Class Member; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Pocket Expense Claims; Claims described in Section 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim FormBreach. The Settlement Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalidimplausible, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer and one Defense lawyer shall be designated to fill this role for all PlaintiffsPlaintiffs and for Defendant, respectively). IfIf the Settling Parties do not agree with the claimant’s Settlement Claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Settlement Claim shall be referred back for resolution to the Settlement Administrator for final determination on the Claim validitydetermination. 2.4.1 a) Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Administrator shall request additional information and allow give the claimant 14 a minimum of fourteen (14) days from the date of the request to cure the defectdefect before rejecting the claim. If the defect is not cured within in the time allottedpermitted by the Settlement Administrator (subject to the 14-day minimum), then the claim will be deemed invalidinvalid and there shall be no obligation to pay the defective claim. The postmark date shall constitute evidence of the date of mailing for these purposes. 2.4.2 b) Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Administrator, the Settlement Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim claim is not facially valid because the claimant has not provided all information needed to complete and evaluate the information requested by the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect in one Claim claim shall not cause rejection of any other Valid Claim valid claim submitted by the claimant. 2.4.3 c) Class Members shall have 10 ten (10) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decreaseSettlement Administrator.

Dispute Resolution for Claims. 2.11.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Outout-of-Pocketpocket-Expense Claims; expenses described in ¶ 2.7; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g.; for example, documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.11.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information and allow give the claimant 14 thirty (30) days from the date of the request to cure the defectdefect before rejecting the claim. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.11.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantSettling Parties. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its his or her sole (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalid. 2.4.2 invalid and there shall be no obligation to pay the claim. Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect in one Claim If the claim is rejected for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimant. 2.4.3 Claims Referee. Settlement Class Members shall have 10 thirty (30) days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form offer to accept or reject any offer of partial payment received from the ClaimClaims Administrator. This provision If a Settlement Class Member rejects an offer from the Claims Administrator, the Claims Administrator shall have fifteen (15) days to reconsider its initial adjustment amount and make a final determination. If the claimant approves the final determination, then the approved amount shall be the amount to be paid. If the claimant does not apply where approve the Claim value deviates due final determination within thirty (30) days, then the dispute will be submitted to the Claims Referee within an additional ten (10) days. If any dispute is submitted to the Claims Referee, the Claims Referee may approve the Claims Administrator’s determination by making a pro rata increase ruling within fifteen (15) days. The Claims Referee may make any other final determination of the dispute or decreaserequest further supplementation of a claim within thirty (30) days. The Claims Referee’s determination shall be based on whether the Claims Referee is persuaded that the claimed amounts are reasonably supported in fact and were more likely than not caused by the Incident. The Claims Referee shall have the power to approve a claim in full or in part. The Claims Referee’s decision will be final and non-appealable. Any claimant referred to the Claims Referee shall reasonably cooperate with the Claims Referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the Claims Referee to verify the claim through third party sources, and failure to cooperate shall be grounds for denial of the claim in full. The Claims Referee shall make a final decision within thirty (30) days of receipt of all supplemental information requested.

Dispute Resolution for Claims. 2.4.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all PlaintiffsClass Counsel). IfIf the Settling Parties do not agree with the claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.4.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six (6) months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.4.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.4.4 If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third- party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. 2.4.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and plausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one PlaintiffsPlaintiff’s’ lawyer shall be designated to fill this role for all PlaintiffsPlaintiff). IfIf the Settling Parties do not agree with the Claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator claims referee for final determination resolution. The Parties will mutually agree on the Claim validitya claims referee should one be required. 2.4.1 2.4.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the Claim (“Claim Supplementation”). Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 21-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 21-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.4.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantClaims Referee. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 9.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant Claimant is a Settlement Class Member; member; and (2) the claimant Claimant has provided all information needed to complete the Claim Formclaim form, including any documentation (e.g. Proof of Purchase) that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; collectively, “Complete and (4) the claimant timely submitted his or her Claim FormPlausible”). The Settlement Claims Administrator may, at any time, request from the claimantClaimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claimClaim (“Claim Supplementation”), e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereofconfirming Proof of Purchase. For any such claims that the Settlement Administrator determines to be invalid, the Settlement The Claims Administrator will submit those claims to authorize the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 Upon receipt payment of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Administrator shall request additional information and allow the claimant 14 days from the date of the request to cure the defect. If the defect is not cured within the time allotted, then the claim will be deemed invalid. 2.4.2 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1, the Settlement Administrator shall have 10 days to accept or reject the Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim is valid, then the Claim shall be paid. If if it believes the Claim is not valid because the claimant has not provided the information requested Complete and Plausible. 9.2 Any Claim that is denied by the Settlement Claims Administrator will be sent to Class Counsel and Schnucks’ Counsel for review within ten (10) days of being denied by Claims Administrator. Within ten (10) days of receipt, Class Counsel and Schnucks’ Counsel will make a joint determination that either: (i) the Claims are Complete and Plausible and the Claim initially denied by the Claims Administrator should be paid; (ii) the Claim should be denied, or (iii) the Claimant will be permitted fourteen (14) days to submit Claim Supplementation. There will be no appeal rights to the Claimant. 9.3 Any Claim that is reduced or downgraded by the Claims Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in i.e., a Claimant is downgraded from one Claim shall not cause rejection Group to a lower Group, will be sent to Class Counsel and Schnucks’ Counsel for review within ten (10) days of any other Valid Claim submitted being reduced by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the ClaimClaims Administrator. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.Within ten

Dispute Resolution for Claims. 2.4.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Security Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to counsel for the Settling Parties. If the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). Ifdo not agree with the claimant’s claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.4.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-eight (28) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-eight (28) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one-hundred-and-eighty (180) days from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.4.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 2.4.4 If any dispute is submitted to the claims referee, the claims referee may approve the Claims Administrator’s determination by making a ruling within fifteen (15) days from of the claims referee’s receipt of the approval submitted dispute. The claims referee may make any other final determination of the dispute or request further supplementation of a Claim claim within thirty (30) days of the claims referee’s receipt of the submitted dispute. The claims referee’s determination shall be based on whether the claims referee is persuaded that provides the claimed amounts are reasonably supported in fact and were more likely than not caused by the Security Incident. The claims referee shall have the power to approve a payment that deviates from claim in full or in part. The claims referee’s decision will be final and non-appealable. Any claimant referred to the losses described on claims referee shall reasonably cooperate with the Claim Form claims referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the claims referee to accept or reject verify the Claimclaim through third- party sources, and failure to cooperate shall be grounds for denial of the claim in full. This provision does not apply where The claims referee shall make a final decision within thirty (30) days of the Claim value deviates due to a pro rata increase or decreaselatter of the following events: its receipt of the submitted dispute and receipt of all supplemental information requested.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., e.g. documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator's initial review will be limited to a determination of whether the claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ ' lawyer shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree with the Claimant's claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim claim shall be referred back to the Settlement Administrator a claims referee for final determination resolution. The Settling Parties will mutually agree on the Claim validityclaims referee should one be required. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the twenty-one (21) day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the twenty-one (21) day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one (1) year from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim Administrator determines that such a claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorClaim Administrator to evaluate the claim, then the Settlement Claim Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantclaims referee. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.4.1 The Settlement Claims Administrator, in its solehis sole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1 or ¶ 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any Claims for Extraordinary Expenses, the Claims Administrator’s initial review will be limited to a determination of whether the Claim is complete and plausible. For any such claims Claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims Claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). IfIf the Settling Parties do not agree with the Claimant’s Claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator Claims Referee for final determination on the Claim validityresolution. 2.4.1 2.4.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Claims Administrator shall request additional information and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.4.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Claims Administrator, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is facially valid, then the Claim claim shall be paid. If the Claim claim is not facially valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Administrator may reject the Claim claim without any further action. A defect If the claim is rejected in one Claim whole or in part, for other reasons, then the claim shall not cause rejection of any other Valid Claim submitted by be referred to the claimantClaims Referee. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. The Settlement Administrator, in its sole (1) the claimant is a Class Member; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Claims for Ordinary and/or Extraordinary Out-of-Pocket-Expense Claims; Pocket Loss or Attested Lost Time; (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her their Claim Form. The Settlement Administrator may, at any time, request from the claimant, in writing, additional information that the Settlement Administrator deems reasonably necessary to evaluate the claimClaim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, and claims previously made for identity theft and the resolution thereof. For any such claims Claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims Claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs)Parties, by and through their respective Counsel. If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.3.1 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim Claim is facially valid, the Settlement Administrator shall request additional information and allow the claimant 14 fourteen (14) days from the date of the request to cure the defect. If the defect is not cured within the time allotted, then the claim Claim will be deemed invalid. 2.4.2 2.3.2 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.12.3.1, the Settlement Administrator shall have 10 ten (10) days to accept or reject the Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim Claim is valida Valid Claim, then the Claim shall be paid. If the Claim is not valid a Valid Claim because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 2.3.3 Class Members shall have 10 ten (10) days from receipt of the approval of a Valid Claim that provides a payment (“Claim Payment”) that deviates from the losses described on the Claim Form to accept or reject the ClaimClaim Payment. This provision does not apply where the Claim value Payment deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in 112.1 or 2.2 and/or entitlement to enrollment in credit monitoring services as described in 12.3; 270307649v.l and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Form. collectively, "Facially Valid"). 2.6.1 The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.6.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information ("Claim Supplementation") and allow give the claimant 14 twenty-one (21) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later, and a copy of the request for Claim Supplementation shall be provided to cure Class Counsel and counsel for GCPA. In the defectevent of unusual circumstances interfering with compliance during the 21-day period, the claimant may request and, for good cause shown (illness, military service, out of the country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 21-day deadline in which to comply; however, in no event shall the deadline be extended to later than three (3) months from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 270307649v.l 2.6.3 If the Claims Administrator raises a question about the plausibility of any claim, that claim shall be referred to counsel for Plaintiff and GCPA, and if counsel cannot agree on the validity of the claim, to the Claims Referee. One-half ofthe cost of the Claims Referee shall be borne by GCPA, separate and apart from the Settlement Fund; the other half is to be borne by Plaintiffs Counsel. 2.4.2 Following timely 2.6.4 If any dispute is submitted to the Claims Referee, the Claims Referee may make any other final determination of the dispute or request further supplementation of a claim within thirty (30) days. The Claims Referee's determination shall be based on whether the Claims Referee is persuaded that the claimed amounts are reasonably supported in fact and were more likely than not caused by the Data Incident. The Claims Referee shall have the power to approve a claim in full or in part. The Claims Referee's decision will be final and non­ appealable. Any claimant referred to the Claims Referee shall reasonably cooperate with the Claims Referee, including by either providing supplemental information as requested or, alternatively, signing an authorization allowing the Claims Referee to verify the claim through third party sources, and failure to cooperate shall be grounds for denial of the claim in full. The Claims Referee shall make a final decision within thirty (30) days of receipt of additional all supplemental information pursuant to a request by the Settlement Administrator under ¶ 2.4.1, the Settlement Administrator shall have 10 days to accept or reject the Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Administrator determines that such a claim is valid, then the Claim shall be paid. If the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimantrequested. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.6.1 The Settlement Claims Administrator, in its solesole discretion to be reasonably exercised, will determine whether: (1) the claimant is a Settlement Class Member; ; (2) the claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; claimant’s class membership and the expenses described in ¶¶ 2.1 and 2.2; and (3) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and Incident (4) the claimant timely submitted his or her Claim Formcollectively, “Facially Valid”). The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that (“Claim Supplementation”) as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g., documentation requested on the Claim Form, information regarding the claimed losses, available insurance and the status of any claims made for insurance benefits, and claims previously made for identity theft and the resolution thereof. For any such claims that the Settlement Administrator determines to be invalid, the Settlement Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs). If, upon meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validity. 2.4.1 2.6.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially validFacially Valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days to cure the defect before rejecting the claim. Requests for Claim Supplementation shall be made within thirty (30) days of receipt of such Claim Form or thirty (30) days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 30-day period, the claimant may request and, for good cause shown (illness, military service, out of the request country, mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 30-day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than one year from the Effective Date. If the defect is not cured within the time allottedcured, then the claim will be deemed invalidinvalid and there shall be no obligation to pay the claim. 2.4.2 2.6.3 Following timely receipt of additional information pursuant to a request by the Settlement Administrator under ¶ 2.4.1requested as Claim Supplementation, the Settlement Claims Administrator shall have 10 thirty (30) days to accept accept, in whole or lesser amount, or reject the Claimeach claim. If, after review of the Claim claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim is validFacially Valid, then the Claim claim shall be paid. If the Claim claim is not valid Facially Valid because the claimant has not provided all information needed to complete the information requested by Claim Form and evaluate the Settlement Administratorclaim, then the Settlement Claims Administrator may reject the Claim claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.5.1 The Settlement Claims Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant is a Settlement Class Member; ; (2ii) the claimant has provided all information needed to complete assess whether the claimant has submitted a facially valid Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Claims Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Claims Administrator deems may reasonably necessary require to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Claims Administrator’s initial review will be limited to a determination of whether the Claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that the Settlement Claims Administrator determines to be invalidimplausible, the Settlement Claims Administrator will submit those claims to the Settling Parties (one Plaintiffs’ lawyer shall be designated to fill this role for all Plaintiffs)through counsel. IfIf the Settling Parties, upon mutually, do not agree with the Claimant’s claim, after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be denied. If the Settling Parties disagree regarding the treatment of the Claim, the Claimant’s claim shall be resubmitted and referred back to the Settlement Claims Administrator for a final determination on the Claim validitybinding and independent resolution. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim Claim is facially valid, the Settlement Claims Administrator shall request additional information (“Claim Supplementation”) and allow give the claimant 14 thirty (30) days from the date transmission of the request a cure notice to cure the defectdefect before rejecting the claim. If the defect is not cured within the time allottedtimely cured, then the claim Claim will be deemed invalidinvalid and there shall be no obligation to pay the Claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant from a claimant subject to a request by the Settlement Administrator under ¶ 2.4.1cure notice, the Settlement Claims Administrator shall have 10 ten (10) days to accept accept, in whole or lesser amount, or reject the each Claim. If, after review of the Claim and all documentation submitted by the claimant, the Settlement Claims Administrator determines that such a claim Claim is facially valid, then the Claim shall be paid. If the Claim is not valid because the claimant has not provided the information requested by the Settlement Administrator, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimantpaid subject to ¶ 2.5. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.

Dispute Resolution for Claims. 2.5.1 The Settlement Administrator, in its sole sole discretion to be reasonably exercised, will determine whether: (1i) the claimant Claimant is a Settlement Class Member; ; (2ii) the claimant Claimant has provided all information needed to complete the Claim Form, including any documentation that may be necessary to reasonably support the Out-of-Pocket-Expense Claims; their claim for expenses described in ¶ 2.1; and (3iii) the information submitted could lead a reasonable person to conclude that it is more likely than not the claimant Claimant has suffered the claimed losses as a result of the Data Incident; and (4) the claimant timely submitted his or her Claim Form. The Settlement Administrator may, at any time, request from the claimant, in writing, additional information that as the Settlement Administrator deems may reasonably necessary require in order to evaluate the claim, e.g., documentation requested on the Claim Form, information and required documentation regarding the claimed losses, . The Settlement Administrator’s initial review will be limited to a determination of whether the Claim is complete and claims previously made for identity theft and the resolution thereofplausible. For any such claims that Claims the Settlement Administrator determines to be invalidimplausible, the Settlement Administrator will submit those claims Claims to the Settling Parties (one Plaintiffs’ lawyer of Class Counsel shall be designated to fill this role for all Plaintiffs). IfIf the Parties do not agree with the Claimant’s Claim, upon after meeting and conferring, the Settling Parties disagree as to the Claim validity, then the Claim shall be referred back to the Settlement Administrator for final determination on the Claim validityresolution. 2.4.1 2.5.2 Upon receipt of an incomplete or unsigned Claim Form or a Claim Form that is not accompanied by sufficient documentation to determine whether the claim is facially valid, the Settlement Administrator shall request additional information and allow give the claimant 14 Claimant 21 days to cure the defect before rejecting the Claim. Requests for Claim supplementation shall be made within 30 days of receipt of such Claim Form or 30 days from the date Effective Date, whichever comes later. In the event of unusual circumstances interfering with compliance during the 21-day period, the Claimant may request and, for good cause shown (illness, military service, out of the request country, mail or e-mail failures, lack of cooperation of third parties in possession of required information, etc.), shall be given a reasonable extension of the 21 day deadline in which to cure comply; however, in no event shall the defectdeadline be extended to later than six months from the Effective Date. If the defect is not cured within the time allottedtimely cured, then the claim Claim will be deemed invalidinvalid and there shall be no obligation to pay the Claim. 2.4.2 2.5.3 Following timely receipt of additional information pursuant to a request requested by the Settlement Administrator under ¶ 2.4.1Administrator, the Settlement Administrator shall have 10 days to accept accept, in whole or lesser amount, or reject the each Claim. If, after review of the Claim claim and all documentation submitted by the claimantClaimant, the Settlement Administrator determines that such a claim Claim is facially valid, then the Claim shall be paid. If the Settlement Administrator determines that such a Claim is not facially valid because the claimant Claimant has not provided all information needed to complete the information requested by Claim Form and enable the Settlement AdministratorAdministrator to evaluate the Claim, then the Settlement Administrator may reject the Claim without any further action. A defect in one Claim shall not cause rejection of any other Valid Claim submitted by the claimant. 2.4.3 Class Members shall have 10 days from receipt of the approval of a Claim that provides a payment that deviates from the losses described on the Claim Form to accept or reject the Claim. This provision does not apply where the Claim value deviates due to a pro rata increase or decrease.