Alcoa Community Federal Credit Union v. Sonic Corporation

• Court: District Court, E.D. Arkansas
• Decided: June 6, 2019
• Docket: 4:18-cv-00770
• Status: Unknown

Opinion

US. District Court, Northern District of Ohio — By: /s/Robert Pitts Deputy Clerk ES UNITED STATES JUDICIAL PANEL Ray on MULTIDISTRICT LITIGATION

IN RE: SONIC CORP. CUSTOMER DATA SECURITY BREACH LITIGATION MDL No. 2807

TRANSFER ORDER

Before the Panel: Plaintiffs in the actions pending in MDL No. 2807 move under Panel Rule 7.1 to vacate our orders that conditionally transferred the actions listed on Schedule A to the Northern District of Ohio for inclusion in MDL No. 2807. Plaintiffs in the actions listed on Schedule A and common defendants Sonic Corp., Sonic Franchising, LLC, Sonic Industries LLC, Sonic Industries Services Inc., Sonic Capital LLC, and Sonic Restaurants, Inc. (together, Sonic), oppose the motions to vacate. After considering the argument of counsel, we find that these actions involve common questions of fact with the actions transferred to MDL No. 2807, and that transfer under 28 U.S.C. § 1407 will serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation. The actions listed on Schedule A, like the already-centralized actions, share factual issues concerning an incident in which Sonic’s point-of-sale system was breached, allowing computer hackers to gain access to up to 5 million individuals’ personally identifiable information. See In re: Sonic Corp. Customer Data Sec. Breach Litig., 276 F. Supp. 3d 1382 (J.P.M.L. 2017). Plaintiffs in the actions pending in MDL No. 2807 bring claims on behalf of consumers affected by the breach. Plaintiffs in the actions listed on Schedule A bring claims on behalf of putative classes of financial institutions that issue or service payment cards and whose customers made purchases from Sonic stores. Movants argue that (1) the financial institution actions are not within the scope of the Panel’s initial transfer order; (2) these actions are unique because they were filed over a year after the consumer actions and on behalf of a different class; (3) no efficiencies will be gained by including them in the MDL because the consumer actions are significantly more advanced; and (4) the Western District of Oklahoma, where Sonic is headquartered, is a more appropriate forum for the financial institution actions. The financial institution actions unquestionably arise from the same 2017 data breach at issue in the consumer actions. That only consumer actions were pending when the Panel granted centralization does not preclude including financial institution actions in the MDL at this time. Indeed, the Panel often includes actions brought on behalf of financial institutions in data breach MDLs. See In re: The Home Depot, Inc., Customer Data Sec. Breach Litig., 65 F. Supp. 3d 1398, 1399 (J.P.M.L. 2014) (“All the actions, whether brought by consumers or by financial institutions, arise from a common factual core... .”). Both the consumer and financial institution actions “will share common discovery and pretrial practice, even if certain claims or defenses are not identical.” Td.

-2-

It is true that these actions are in quite different procedural postures. The consumer actions are on the cusp of settlement with a final fairness hearing scheduled for July 2019, while the financial institution actions are in their nascent stages. But all parties to the financial institution actions support transfer. And including these actions would create efficiencies by allowing for easy access to common discovery and placing the actions before a judge who is very familiar with the facts and issues in this litigation. It is unlikely that the financial institution plaintiffs’ presence in MDL No. 2807 will disrupt or delay the consumer class settlement. They are not members of the putative settlement class, and the transferee judge can place their actions on a separate litigation track, if he chooses. See id. at 1400 (“The transferee court may employ any number of pretrial techniques—such as establishing separate discovery and motion tracks—to manage this litigation efficiently.”). The Western District of Oklahoma is the location of Sonic’s headquarters, but no party to the financial institution actions has sought centralization there. Moreover, inclusion of the actions in the already-established MDL is the most efficient path for these actions. IT IS THEREFORE ORDERED that the actions listed on Schedule A are transferred to the Northern District of Ohio and, with the consent of that court, assigned to the Honorable James S. Gwin for inclusion in the coordinated or consolidated pretrial proceedings.

PANEL ON MULTIDISTRICT LITIGATION

derok Varner Sarah S. Vance Chair Lewis A. Kaplan Ellen Segal Huvelle R. David Proctor Catherine D. Perry Karen K. Caldwell Nathaniel M. Gorton

IN RE: SONIC CORP. CUSTOMER DATA SECURITY BREACH LITIGATION MDL No. 2807 SCHEDULE A

Eastern District of Arkansas ALCOA COMMUNITY FEDERAL CREDIT UNION v. SONIC CORPORATION, ET AL., C.A. No. 4:18-00770 Western District of Oklahoma AMERICAN AIRLINES FEDERAL CREDIT UNION v. SONIC CORP., ET AL., C.A. No. 5:19-00208