Counsel for the class that successfully sued Home Depot Inc. following a 2014 credit card data breach will have to have their fee award recalculated, the Eleventh Circuit said July 25.

Home Depot settled with financial institutions holding the affected accounts for $25 million. The trial court approved attorneys’ fees of $15.7 million, in addition to the settlement fund.

But the trial court abused its discretion in arriving at that number, the U.S. Court of Appeals for the Eleventh Circuit said. It multiplied the amount calculated by the lodestar method—$11.7 million—by 1.3, to account for increased litigation risks class counsel shouldered, Judge Gerald Bard Tjoflat said for the court. The lodestar method uses the amount of hours worked and a reasonable fee-per-hour to calculate attorneys’ fees.

The fee structure in the case is unusually complicated, but it’s ultimately a fee-shifting arrangement that used a lodestar calculation, the court said. The U.S. Supreme Court has held that risk generally can’t be used to justify a multiplier in such cases, Tjoflat said.

Even though Supreme Court precedent focuses on statutory fee shifting cases, whereas the fee shifting arrangement here is governed by the settlement contract, the Supreme Court’s reasoning was persuasive, Tjoflat said.

Not only was the quality of representation already incorporated in the lodestar calculation even when that calculation is agreed to in a contract, but enhancing payouts based on risk “would reward lawyers for taking cases with relatively little merit and incentivize bad claims,” he said.

The issue will return to the trial court for further proceedings.

Other issues Home Depot raised on appeal concerning the factors incorporated into the lodestar calculation weren’t successful.

The banks were represented by Doffermyre, Shields, Canfield & Knowles LLC; Carlson Lynch Sweet & Kilpela LLP; Scott+Scott LLP; and Hausfeld LLP. Home Depot was represented by Alston & Bird LLP, King & Spalding LLP, and Burns & Levinson LLP.

The case is In re: The Home Depot Inc., Customer Data Security Breach Litigation, 11th Cir., No. 17-14741, 7/25/19.