PHILADELPHIA–A federal court here has given preliminary approval to a proposed $37-million settlement—including lawyers’ fees—in a lawsuit filed by a number of credit unions against Wawa over a 2019 data breach.
Specifically, the settlement would award the credit union plaintiffs $28.5 million, plus an additional $9 million to pay legal costs.
As CUToday.info reported earlier here, the Wawa convenience store chain had agreed to pay $9 million to affected customers and $35 million to upgrade its security in a separate case.
The information that was compromised included credit and debit card numbers, their expiration dates and cardholder names.
Origins of Suit
In January of 2020, the $66.2-million, New Castle, Penn.-based First Choice FCU filed a class action suit against Wawa over the breach, which involved compromises of debit and credit card numbers at nearly all of the company’s approximately 900 stores.
Other credit unions also filed suit and were added as part of the class, including the $320.3-million Inspire FCU in Newtown, Penn.; the $92.8-million FCU in Falconer, N.Y., and the $679.1-million Insight Credit Union in Winter Springs, Fla.
According to the settlement, which quotes from the Rolling Stones that “you can’t always get what you want” but that parties had compromised to “get what they need,” the parties reached their compromise settlement after mediation in August of 2022, with Wawa executing the proposed settlement agreement in early March of this year.
Now the court has given the agreement its blessing.
Three Tiers of Relief
The proposed settlement includes three tiers of relief, including:
- Tier 1: $5 per replacement card. “The class member must attest…to having cancelled and replaced impacted cards in response to the data breach, if replaced between Dec. 12, 2019 and May 1, 2020,” the settlement reads. “Wawa has committed a minimum of $3 million and maximum of $18.5 million for Tier 1.”
- Tier 2. Fraudulent charges up to $4,000 er financial institution. “The class member must provide a statement reflecting unreimbursed out-of-pocket absorption or reimbursement to a cardholder of fraudulent charges on impacted cards…” Tier 2 payments have a cap of $8 million.
- Tier 3. Claim without documentation. “The class member can submit a claim that it incurred some cost in the data breach’s aftermath. The value will be a fixed amount for all claiming class members, calculated by dividing $2 million by the final number of members confirmed during the notice period.”