IN RE WAWA, INC. DATA SECURITY LITIGATION

District Court, E.D. Pennsylvania·Decided May 12, 2021·No. 2:19-cv-06019·Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA : CIVIL ACTION

IN RE WAWA, INC. This document applies to the DATA SECURITY LITIGATION : Employee Track.

No. 19-6019 and all related cases. MEMORANDUM PRATTER, J. May 12, 2021 Wawa, Inc. operates a chain of convenience stores and gas stations throughout the eastern United States. Hackers accessed Wawa’s point-of-sale systems and installed malware in March 2019 that targeted Wawa’s in-store payment terminals and gas station fuel dispensers. The hackers obtained customer payment card information over the next several months, making it available for purchase on the “dark web.” Wawa disclosed the data breach in December 2019. Lawsuits followed. The Court’s case management plan delineated three distinct tracks for the litigation: the Consumer Track, the Employee Track, and the Financial Institution Track. This Memorandum addresses the Employee Track Plaintiffs. The named plaintiffs for the Employee Track are Shawn McGlade, a former Wawa assistant general manager and general manager, and his wife, Karen McGlade. They bring seven counts against Wawa in their amended class action complaint. The first five counts relate to the data breach, asserting that Wawa negligently allowed payment card information and personally identifiable information, such as social security numbers, of Wawa employees to be exposed. The Employee Plaintiffs’ remaining two counts allege overtime violations for all Wawa assistant general managers from January 2017 through January 2020. Wawa moves to dismiss all

seven of the counts in the Amended Complaint. For the reasons that follow, the Court will grant in part and deny in part Wawa’s motion to dismiss. BACKGROUND The Employee Plaintiffs bring claims on behalf of current and former Wawa employees, their spouses, and also the current and former Wawa assistant general managers. The Employee Plaintiffs assert two sets of claims against Wawa: the first set of claims concerns the data breach and exposure of personally identifiable information, which, Employee Plaintiffs claim, included both employee payment card information and confidential employee information, such as social security numbers. The second set of claims concerns Wawa’s alleged failure to pay its assistant general managers overtime wages. As stated briefly above, in March 2019, hackers breached Wawa’s point-of-sale systems and installed malware on payment terminals and fuel dispensers, which enabled them to steal payment card information for several months. This information was later posted for purchase on the “dark web.” Wawa disclosed the data security incident in late December 2019. The Employee Plaintiffs allege that Wawa required its employees to provide their personally identifiable information, including social security numbers, as a condition of employment, and subsequently failed to safeguard that oo Wawa employees can use an employee discount to purchase certain items at Wawa stores. As a result, the Employee Plaintiffs allege that Wawa knew its employees would use their own payment cards to purchase discounted food, beverages, and other essential items at Wawa stores during their work shifts.| Because Wawa employees, like named plaintiff Mr. McGlade, took advantage of the employee discount and used

The Employee Plaintiffs allege that Wawa “required” employees “to use their own payment cards” to make purchases. Presumably, they could have also paid for items with cash.

their own payment cards to purchase store items, the Employee Plaintiffs allege that Wawa owed them a duty to exercise reasonable care to protect the employees’ payment card data. Mr. McGlade served as an assistant general manager from September 2014 until March 2017, when he was promoted to the position of general manager. As part of his employment, Mr. McGlade alleges that he gave Wawa his confidential personally identifiable information and that of his family.2 Mr. McGlade alleges that since September 2019, several new, unauthorized accounts were opened in his name, which led to a drop in his credit score and required his wife to spend a substantial amount of time and effort to cancel the unauthorized accounts. The McGlades allege that, despite Wawa’s contention that the data breach was limited to payment card information, they believe that their personally identifiable information, including social security numbers, was also compromised. The Employee Plaintiffs allege that on the day the data breach was publicly announced, neither Mr. McGlade nor any other Wawa general managers were advised that their information had been compromised. Instead, they claim that Wawa misrepresented the data theft situation as limited to only customer payment card information. Mr. McGlade’s employment was terminated in January 2020, shortly after the data breach was disclosed. Unrelated to the data breach, Mr. McGlade also alleges that, since December 2015, Wawa has failed to pay its assistant general managers for overtime hours worked. In December 2015, Wawa reclassified its assistant general managers as non-exempt employees under the Fair Labor Standards Act. Even after assistant general managers were reclassified as non-exempt, which entitled them to overtime pay, Mr. McGlade alleges that he was required to work “off the clock”

2 Mr. McGlade alleges that, “[a]s a condition of his employment by Wawa, [he] was required to provide his [personally identifiable information], including his social security number, home address, and the names of his wife and minor children, among other items of confidential [personally identifiable information].”

while he was an assistant general manager. Mr. McGlade claims that he was then fired for enforcing Wawa’s policy of not allowing assistant general managers and other employees to work overtime. He alleges that Wawa’s policy “ma[de] [assistant general managers] work off the clock.” The Employee Plaintiffs rely on Gervasio v. Wawa Inc., a District of New Jersey FLSA case, as support for their allegations that Wawa refused to pay its assistant general managers overtime both when Wawa had misclassified them as exempt and after they were reclassified as non-exempt.? Gervasio eventually settled through mediation, with over 300 plaintiffs opting in to the class, but Mr. McGlade states that he did not opt in to the Gervasio class out of fear of retaliation. LEGAL STANDARD A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of a complaint. The court must assess whether a complaint has “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible when its factual allegations are “enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. 555-56. “The Third Circuit instructs the reviewing court to conduct a two-part analysis. First, any legal conclusions are separated from the well-pleaded factual allegations and disregarded. Second, the court determines whether the facts alleged establish a plausible claim for relief.” Satterfield v. Gov't Ins. Employees Co., No. 20-cv-1400, 2020 WL 7229763, at *1 (E.D. Pa. Dec. 8, 2020) (citing Fowler v. UPMC Shadyside, 578 F.3d 203, 210-11 (3d Cir. 2009)). “A claim has facial

The case, Gervasio v. Wawa Inc., No. 17-cv-245, 2018 WL 385189, at *1 (D.N.J. Jan. 11, 2018), is discussed in greater detail below. See infra, note 10 and accompanying text.

Free access — add to your briefcase to read the full text and ask questions with AI

IN RE WAWA, INC. DATA SECURITY LITIGATION, (E.D. Pa. 2021).

IN RE WAWA, INC. DATA SECURITY LITIGATION (IN RE WAWA, INC. DATA SECURITY LITIGATION) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
KRUPSKI v. COSTA CROCIERE S. P. A
560 U.S. 538 (Supreme Court, 2010)
Mayle v. Felix
545 U.S. 644 (Supreme Court, 2005)
Glover v. Federal Deposit Insurance
698 F.3d 139 (Third Circuit, 2012)
Grider v. Keystone Health Plan Central, Inc.
500 F.3d 322 (Third Circuit, 2007)
Phillips v. County of Allegheny
515 F.3d 224 (Third Circuit, 2008)
Santos Ex Rel. Beato v. United States
559 F.3d 189 (Third Circuit, 2009)
Fowler v. UPMC SHADYSIDE
578 F.3d 203 (Third Circuit, 2009)
Arizmendi v. Lawson
914 F. Supp. 1157 (E.D. Pennsylvania, 1996)
Alan Schmidt v. John Skolas
770 F.3d 241 (Third Circuit, 2014)
Bensel v. Allied Pilots Ass'n
387 F.3d 298 (Third Circuit, 2004)
McKenna v. City of Philadelphia
304 F. App'x 89 (Third Circuit, 2008)
Sandra Connelly v. Lane Construction Corp
809 F.3d 780 (Third Circuit, 2016)
Judith Cunningham v. M&T Bank Corp
814 F.3d 156 (Third Circuit, 2016)
Dittman, B., Aplt. v. UPMC
196 A.3d 1036 (Supreme Court of Pennsylvania, 2018)
D. S.-W. v. United States
962 F.3d 745 (Third Circuit, 2020)
Walton v. Eaton Corp.
563 F.2d 66 (Third Circuit, 1977)