More than 22 million Wawa Inc. customers were granted preliminary class status Friday in a suit stemming from a data breach that led to the sale of their payment information on the dark web.
Hackers accessed Wawa’s point-of-sale systems and installed malware targeting in-store payment terminals and gas station fuel dispensers in March 2019. Over the next several months, the hackers obtained customer payment card information, which they later offered for purchase online.
Wawa disclosed the data breach in December 2019, and litigation ensued. The court’s case management plan split claims resulting from the data breach into consumer, employee, and financial institution tracks.
In February, Wawa agreed to pay up to $12 million to settle claims from the customer track. The U.S. District Court for the Eastern District of Pennsylvania tentatively approved the settlement, which will provide gift cards or cash to the customers, and require the convenience store to strengthen its payment processing systems and enhance data security practices.
The settlement includes three tiers of customers, who will receive gift cards for either $5 or $15, or $500 in cash, depending on the severity of their injury from the data breach.
The first tier includes all customers who used a debit or credit card to make a purchase during the data breach period, and who said they spent additional time monitoring their accounts as a result. The second tier applies to customers who had fraudulent transactions processed on their cards, and had to spend time addressing them, and the third includes customers who suffered out-of-pocket losses as a result of the breach.
Judge Gene E.K. Pratter overruled opposition to the settlement from Wawa employees who are also customers.
Their argument is that they should be able to assert their own claims related to the repayment card data breach, and obtain their own relief, Pratter said.
That argument is premature because employees will be able to voice their objections prior to and during the final approval hearing. “The court will not now entertain the prospect of forcing the parties back to the bargaining table,” Pratter wrote.
Wawa currently has approximately 34,000 employees—and it is estimated that there were over 50,000 current and former employees during the class period, she said. If, after preliminary approval, the employees aren’t satisfied with the terms of the agreement, they can object or opt-out entirely.
The settlement also includes several methods to notify class members, including signs in stores, a press release, a settlement website and the Wawa website, a plan which the judge found reasonable.
Morgan, Lewis & Bockius LLP represents Wawa. Berger Montague PC, Chimicles Schwartz Kriner & Donaldson-Smith LLP, Fine, Kaplan & Black RPC, and Nussbaum Law Group PC are the interim co-lead counsel for the consumers.
The case is In re: Wawa Data Sec. Litig., E.D. Pa., No. 2:19-cv-06019, 7/30/21.