Wawa Agrees to $13M Settlement in Data Breach Class Action

Wawa customers who made purchases at one of its convenience stores during a 2019 data breach may be eligible for a gift card or cash under a $13.2 million proposed class action settlement.

In a motion filed in the Eastern District of Pennsylvania Friday, lawyers asked a judge to approve the settlement, which is made up of $8 million worth of Wawa gift cards for those who used their payment cards at Wawa between March 4 and Dec. 12, 2019, and up to $1 million in cash payments to those who experienced out-of-pocket losses. 

Wawa has also agreed to pay a separate $3.2 million lump sum to cover attorney fees and other costs associated with settlement administration, and to further secure its systems, the motion states.

“The Settlement also includes important injunctive relief designed to further strengthen Wawa’s data security systems to prevent future unauthorized intrusions to its data systems.”

Wawa discovered malware on its payment processing servers in December 2019 that had been potentially exposing customer payment card information at most of its locations since March 4 that year, the convenience chain said. Wawa has almost 900 locations, including fuel dispensers.

In the proposed settlement, customers will fall into one of three class groups.

The first group includes those who bought something at Wawa using their credit or debit card during the incident period and spent time monitoring their account because of the breach. Those Class members will get a $5 gift card. 

The second is for customers who made a purchase and can submit proof of a fraudulent charge or attempted charge, in exchange for a $15 gift card.

The third is for customers who can show any losses suffered as a result of using their card at Wawa during the security breach. Those members can get up to $500.

Lawyers said Wawa agreed to enter mediation with the Class on June 11, 2020. In September, they attended a “hard fought” negotiation “which lasted nearly 12 hours” to hammer out an agreement, the motion states. 

The settlement agreement sets out a straightforward claims process with the use of simple claims forms. Those who don’t qualify for the group they apply to will automatically be eligible for compensation under the next closest group they appear eligible for, according to the motion.

In addition, a website will be launched for the settlement and Wawa would also post signage in its stores and fuel pumps, issue a press release and post information on its website to share settlement details with the proposed Class. 

Wawa also agreed to an injunction where it will strengthen its data security processes by, among other things, carrying out yearly simulated cyber attacks to hedge against vulnerabilities and operating a system that encrypts payment card information. 

The cost of this injunction to Wawa was estimated at $35 million, the motion states.

A series of suits sprung against Wawa in the wake of the breach, which were consolidated in 2020, Law360 reported. Wawa is also facing a class action lawsuit from a former employee who claims the convenience store chain fired him in the wake of the cybersecurity attack. 

Are you worried your financial information was compromised in the Wawa data breach? Leave a message in the comments section below.

The consumers are represented by Sherrie R. Savett of Berger & Montague PC; Roberta D. Liebenberg of Fine Kaplan & Black; Linda P. Nussbaum of Nussbaum Law Group PC and Benjamin F. Johns of Chimicles Schwartz Kriner & Donaldson-Smith LLP.

The Wawa Data Breach Class Action Settlement is In Re: Wawa Inc. Data Security Litigation, Case No. 2:19-cv-06019, in the U.S. District Court for the Eastern District of Pennsylvania.

Read About More Class Action Lawsuits & Class Action Settlements:

• Wawa Class Action Says Workers Fired After Breach
• Do You Qualify: Gambling Apps Apple & Google
• Wawa Class Action Filed Over Major Data Breach
• Do You Qualify: Belviq Cancer Lawsuit Investigation