Credit/Shutterstock
A federal judge in Philadelphia has granted a preliminary approval to settle the Wawa data security breach lawsuit brought by credit unions for $28.5 million, plus $9 million in attorneys' fees.
"This was not a settlement agreement reached overnight but rather one that commenced in November 2021 and did not ultimately conclude until March 2023," U.S. District Court Judge Gene E.K. Pratter wrote in an Oct. 12 memorandum. "No party received exactly what they wanted, as evidenced during oral argument. All evidence indicates that the settlement was conducted at arm's length by adequate, experienced counsel."
In March 2019, hackers breached Wawa's point of sale system, installing malware on payment terminal fuel dispensers that involved most of its 900 convenient stores over the next nine months. The information that was compromised included credit and debit card numbers, their expiration dates and cardholder names.
On Jan. 3, 2020, the $66.2 million First Choice Federal Credit Union in New Castle, Pa., filed the first financial institution class action lawsuit against Wawa, claiming the breach's damages exceeded $5 million. Later that month and into February, additional lawsuits were filed by the $320 million Inspire Federal Credit Union in Newton, Pa., the $127 million Greater Cincinnati Credit Union, the $92.8 million Greater Chautauqua Federal Credit Union in Falconer, N.Y., and the $679 million Insight Credit Union in Winter Springs, Fla. All of these legal actions were consolidated into one lawsuit.
Judge Pratter noted in her memo that an estimated 5,000 financial institutions were affected by the breach but there is no way to specifically identify every financial institution that had to replace cards.
A website (www.WawaFinancialInstitutionSettlement.com), which will serve as a one-stop shop source where financial institutions can access relevant documents related to the proposed settlement, is scheduled to be posted on Nov. 13, according to court documents.
The proposed $28.5 million settlement would include up to $18.5 million in payments to financial institutions to cover card cancellation and replacement costs at a rate of $5 per replaced card – up to $8 million in compensation for fraudulent charges incurred on compromised cards, with each financial institution eligible to receive up to $4,000.
In addition, an alternative option for class members is to elect a fixed payment (based on a pro rata division of $2 million by the number of class members), if the financial institution attests that it incurred some cost in dealing with the data security incident but prefers not to submit a claim under the other two options.
The lawsuit's three class action representatives, First Choice Federal Credit Union, Inspire Federal Credit Union and Greater Cincinnati Credit Union, are expected to each receive a $10,000 service award for their involvement in the legal action, according to the proposed settlement.
What's more, Wawa also has agreed to pay an additional $8.8 million in negotiated attorney fees and nearly $80,000 in expenses. Court documents listed 12 lawyers who represent the financial institutions.
"Should Wawa pay out significantly less than $28.5 million, however, the Court will reevaluate the $9 million in attorneys' fees when determining final settlement approval," Judge Pratter wrote.
The deadline for financial institutions to submit their claims has been scheduled for March 11, 2024. The settlement's final approval is expected sometime after that date.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Peter Strozniak
Credit Union Times reporter covering credit union operations, fraud, M&As, leagues, business continuity, and breaking news.
