Judge preliminarily approves Wawa data breach settlement that would pay customers in gift cards

A federal judge has given preliminary approval to a settlement that would require Wawa to pay customers up to $9 million in gift cards and cash after a massive data breach exposed customers’ payment card numbers.

U.S. District Judge Gene E.K. Pratter gave her initial approval of the deal Friday and provisionally certified the class of consumers who would qualify for the settlement. Pratter must still give final approval to the agreement, with a hearing set for January.

Now, Wawa and plaintiffs’ lawyers can notify customers of the agreement and give them the chance to submit claims for payments, opt out of the settlement, or object to the deal by November. The settlement would end the class-action case filed in U.S. District Court for the Eastern District of Pennsylvania.

The vast majority of funds Wawa would pay consumers — up to $8 million — would be in $5 or $15 Wawa gift cards, according to court filings. Up to $1 million more could be used to reimburse consumers with cash payments up to $500, if they can show financial losses linked to the breach.

In addition, Wawa has agreed to spend at least $35 million to improve its cybersecurity. And lawyers for the plaintiffs have asked for $3.2 million to cover their fees and expenses, administration costs, and cash payments of up to $1,000 for 13 named plaintiffs.

Wawa, which is based in Wawa, Delaware County, was hit with a wave of lawsuits claiming the company failed to protect consumers from hackers after it announced the data breach in December 2019. Hackers accessed Wawa’s point-of-sale systems, installed malware, and tried to sell stolen customer payment card data on the “dark web,” according to Pratter’s opinion. The breach, which lasted more than nine months, exposed cardholders’ names, numbers, and expiration dates used in-store and at gas pumps at all Wawa stores. Wawa has denied plaintiffs’ allegations.

There are 22 million class members, which includes all U.S. residents who used a credit or debit card at a Wawa location from March 4, 2019 through Dec. 12, 2019. That’s how long the malware was running on Wawa’s computer systems before it was discovered.

Wawa is working with plaintiffs and a third-party settlement administrator, who is setting up the website where consumers can submit claims for gift cards and payments, said Wawa spokesperson Lori Bruce.

“We will release further details, including timing of notifications for customers, in the coming days,” Bruce said in an statement.

Class members who did not suffer attempted or actual fraud on their payment cards, and say they spent some time monitoring their card accounts because of the breach, could get a $5 Wawa gift card. Customers who can show that someone tried or succeeded in victimizing them could receive a $15 Wawa gift card.

And consumers who can provide “reasonable documentary proof” that they lost money because of an actual or attempted fraud could be reimbursed up to $500.

The gift cards, which would be valid for one year, can’t be used for cigarettes or other tobacco products. Because Wawa is required to pay no more than $9 million to consumers, the individual value of the gift cards and cash payments could be reduced depending on how many customers submit claims, according to court papers.

Pratter overruled objections by lawyers representing Wawa workers who are also customers. Those employees want to assert their own claims and not be locked into the settlement for consumers. They also argued that the gift cards — which they called “coupons” — provides little value to consumers who no longer live near a Wawa or choose not to shop there.

Pratter ruled that employees’ arguments were premature because they can voice their objections before the final approval hearing. And she said the gift cards were adequate relief, noting that 97.5% of Wawa gift cards are redeemed and that Wawa sells more than 3,000 items for less than $5. Wawa’s lawyers also argued that it is more expensive to distribute checks, likely allowing the company to pay consumers higher amounts through gift cards.

“The court disagrees that this is somehow a ‘coupon settlement,’” Pratter wrote. “At this time, the court sees no reason to doubt that the settlement will provide a tangible benefit to plaintiffs and proposed class members while avoiding the costs and risks associated with continued litigation.”

A website where consumers can submit claims must be created by Aug. 30. Wawa also plans to notify customers with signs at gas pumps and payment terminals, information on its website, and a news release, according to court filings. The signs will include a QR code that consumers can scan on their phones to access the settlement website.