Given that, I think GP is probably right in that the fees look reasonable, it's just that maybe it's a case that shouldn't have been litigated if the payout was going to be that small.

Think of it this way, if you want to sue your neighbor for causing some damage to your car, and you expect the money you can recoup is probably capped at around $5k (maybe the amount it cost you to fix), do you hire a lawyer to litigate it for you? If you do, and the lawyer gets you that $5k, but presents you a bill for $4,800 for time spent, do you blame the lawyer, or perhaps was it not worth using that exact strategy to recoup your money, and you would have been better served by small claims court.

So, the question here is, was the payout ever expected to by significantly higher? If not, then there's probably no reason for it to have been a class-action. If so, it probably just depends on even more variables. In the end, people got something out of it, which is probably more than they would have gotten otherwise. Also, there's the benefit of companies knowing they can be sued for these data breaches, which allows them to put a real cost to it, so they put more towards making sure it's secure, even if it didn't help the individuals much in this instance.