IN RE WAWA, INC. DATA SECURITY LITIGATION

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA : CIVIL ACTION

IN RE WAWA, INC. This document applies to the DATA SECURITY LITIGATION : Consumer Track. : No. 19-6019 : and all related cases. MEMORANDUM PRATTER, J. JULY 30, 2021 Hackers accessed Wawa Inc.’s point-of-sale systems and installed malware targeting in- store payment terminals and gas station fuel dispensers in March 2019. Over the next several months, the hackers obtained customer payment card information, which they later offered for purchase on the “dark web.” Wawa, which operates a chain of convenience stores and gas stations throughout the eastern United States, disclosed the data breach in December 2019 and litigation followed. This case is proceeding with three distinct tracks for the class action litigation: the Consumer Track, the Employee Track, and the Financial Institution Track. This Memorandum addresses the Consumer Track Plaintiffs’ motion for preliminary approval of the class action settlement and provisional certification of the settlement class. The Consumer Track Plaintiffs have negotiated a settlement. In the settlement, Wawa agrees to three tiers of possible compensation for consumers in the form of Wawa gift cards and cash payments. Additionally, Wawa agrees to strengthen its payment processing systems and enhance its data security practices. The terms of the settlement are set out in a settlement agreement dated February 9, 2021, executed by the parties and their counsel, and later amended on April 27, 2021.

‘The Consumer Plaintiffs filed their Motion for an Order Preliminarily Approving the Class Action Settlement, Provisionally Certifying the Settlement Class, and Directing Notice on February 19, 2021. The Employee Track Plaintiffs filed an opposition to the Consumer Plaintiffs’ Motion; several generations of briefing followed. The Consumer Plaintiffs filed a Notice of an Amended Settlement Agreement, noting that the scope of the release had been clarified. The Court held a preliminary approval hearing on May 5, 2021 during which the Court urged various changes leading to the parties filing a joint status report informing the Court that language will be added to the notice to the class regarding the limited use of personal information and also agreeing that an email reminder will be sent nine months after the gift cards have been issued to claimants who had not by then used the full value of their gift cards. With these changes, the Court provisionally certifies the class for settlement purposes and preliminarily approves the Settlement Agreement, subject to a final approval hearing. LEGAL STANDARDS A proposed class must satisfy the requirements of Rule 23(a) and at least one provision of Rule 23(b). Fudton-Green v. Accolade, Inc., No. 18-cv-274, 2019 WL 316722, at *2 (E.D. Pa. Jan. 24, 2019). Rule 23(a) requires that: “(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims . . . of the representative parties are typical of the [class] claims . . . ; and (4) the representative parties will fairly and adequately protect the interests of the class.” Even after satisfying the requirements of Rule 23(a), the parties must also show that the action can be maintained under at least one of Rule 23(b)’s subsections. Fulton-Green, 2019 WL 316722, at *2, Rule 23(b)(3) requires that “questions of law or fact common to class members predominate over any questions affecting only individual members,” and that a “class action is

superior to other available methods for fairly and efficiently adjudicating the controversy.” The Court must also receive sufficient information to allow it to “determine whether to give notice of the proposal to the class.” Fed. R. Civ. P. 23(e)(1)(A). As to notice, the parties must demonstrate that “the court will likely be able to: (i) approve the proposal under Rule 23(e)(2); and (i1) certify the class for the purposes of judgment on the proposal.” Fed. R. Civ. P. 23(e)(1)(B). A court may provisionally certify a class at the preliminary stage while “leaving the final certification decision for the subsequent fairness hearing.” Hall v. Accolade, Inc., No. 17-cv-3423, 2019 WL 3996621, at *2 (E.D. Pa. Aug. 23, 2019). If a court determines that it likely will be able to approve the settlement and certify the class, it should direct notice in a “reasonable manner to all class members who would be bound by the proposal.” Fed. R. Civ, P. 23(e)(1)(B). See In re Processed Egg Prods. Antitrust Litig., No. 08-md-2002, 2014 WL 12614451, at *2-4 (E.D, Pa. Dec. 19, 2014) (conditionally certifying class, preliminarily approving settlement, and directing notice to proposed class). Pursuant to Rule 23(c)(2)(B), the notice must be the “best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” Rule 23(e)(2) requires that a settlement be “fair, reasonable, and adequate,” and sets forth several factors a court must consider in determining the fairness of a settlement. These factors include whether adequate representation was provided, a proposal was negotiated at arm’s length, adequate relief is given that takes into account the costs, risks, and possible delay of trial and appeal, the effectiveness of any proposed method of distributing relief to the class, terms of proposed attorneys’ fees, and that the proposal treats class members equitably relative to each other. Fed. R. Civ. P. 23(e}(2).

DISCUSSION I, Motion for Preliminary Certification of the Class for Settlement Purposes The parties negotiated a settlement concerning all of the Consumer Plaintiffs’ claims asserted in this litigation. The Settlement Agreement provides for monetary relief to proposed class members via a three-tier system, explained in greater detail below, that includes the distribution of Wawa gift cards or cash payments to those who experienced out-of-pocket losses

as a result of the data breach. The Settlement Agreement also includes injunctive relief designed to strengthen Wawa’s data security systems. The proposed Settlement Class is defined as: All residents of the United States who used a credit or debit card at a Wawa location at any time during the Period of the Data Security Incident of March 4, 2019 through December 12, 2019. Excluded from the Settlement Class are Wawa’s executive officers and the Judge to whom this case is assigned. See Doc. 201-1, Exhibit A, Amended Settlement Agreement (“S.A.”) § 28. The Consumer Plaintiffs assert that the proposed Settlement Class meets the requirements of Rules 23(a) and 23(b)(3), so they ask the Court to certify the proposed class for settlement purposes only. A. Rule 23(a) A court may certify a settlement class that satisfies the requirements of Rule 23(a) and at least one provision of Rule 23(b). See Fulton-Green, 2019 WL 316722, at *2, The Consumer Plaintiffs must satisfy the four prerequisites of Rule 23(a)—numerosity, commonality, typicality, and adequacy—and show that the class falls into one of the categories identified in Rule 23(b). The Consumer Plaintiffs contend that their proposed class satisfies Rule 23(a). They also contend that their proposed class complies with Rule 23(b)(3) because “questions of law or fact

common to class members predominate over any questions affecting only individual members,” and that a “class action is superior to other available methods for fairly and efficiently adjudicating

the controversy.” Accordingly, they ask that the proposed class be provisionally certified for settlement purposes, pending a final certification decision after a final fairness hearing. i, Numerosity Wawa estimates that there are over 22 million potential class members. Doc. No. 181 (It. Decl.) at § 23. This is more than enough to meet Rule 23(a)(1)’s numerosity requirement that the class be “so numerous that joinder of all members is impracticable.” ii. Commonality Rule 23(a)(2) requires that “there are questions of law or fact common to the class.” The threshold for commonality is not a high one. Here, the facts surrounding the data security incident

are the key issues in this case. These common questions include how the data breach happened, whether Wawa had a duty to protect its customers’ payment card information, and whether Wawa’s customers were harmed by the breach. See Fulton-Green, 2019 WL 316722, at *3. Therefore, for purposes of conditional class certification, this factor is satisfied. tii. Typicality Rule 23(a)(3) requires that the “claims or defenses of the representative parties are typical of the claims or defenses of the class.” This requirement is designed “to assess whether the action

can be efficiently maintained as a class and whether the named plaintiffs have incentives that align with those of absent class members so as to assure that the absentees’ interest will be fairly represented.” Hall, 2019 WL 3996621, at *7 (quoting Baby Neal v. Casey, 43 F.3d 48, 57 Gd Cir, 1994)). Here, the class representatives, all of whom were Wawa customers while the data security breach was ongoing, seek to hold Wawa “liable for damages related to the breach and share

common questions of law and fact with all other class members. [T]heir claims are typical of the class delineated for the proposed settlement.” /*ulton-Green, 2019 WL 316722, at iv, Adequacy Lastly, under Rule 23(a)(4), Plaintiffs must “fairly and adequately protect the interests of the class.” This requirement is designed to “uncover conflicts of interest between named parties and the class they seek to represent.” Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 625 (1997). The named plaintiffs here have been actively involved in this litigation and, as represented by counsel, each plaintiff has produced numerous documents and reviewed and approved the proposed settlement. Jt. Decl. (39. Plaintiffs also state that their interests and the interests of the other class members are aligned because they all seek to prove the factual averments in the complaint, to establish Wawa’s liability, and to obtain compensation from Wawa. Doc. No. 180 at 31. Adequacy also examines the “qualifications of the counsel to represent the class.” in re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 532 3d Cir. 2004) (quoting Jn re Prudential Ins. Co. Am. Sales Prac. Litig. Agent Actions, 148 F.3d 283, 313 (3d Cir. 1998)). The class representatives maintain that they have retained knowledgeable counsel who have successfully prosecuted many class actions, including those involving data breaches. Interim Co-Lead Counsel also represent that they have “vigorously” prosecuted this action even before being appointed co- lead counsel, and that they have devoted substantial time, effort, and resources on behalf of the class. See Jt. Decl. passim. Based on the submitted information, the Court is satisfied that the named plaintiffs and their counsel will adequately represent the interests of the proposed class here. The Court will

allow the named plaintiffs to be appointed as class representatives and Interim Co-Lead Counsel to be appointed as class counsel. B. Rule 23(b)(@3) After meeting all four prerequisites set forth in Rule 23(a), the Consumer Plaintiffs must still satisfy at least one subsection of Rule 23(b), They seek class certification under Rule 23(b)(3) because, they argue, the proposed class meets both of Rule 23(b)(3)’s requirements, namely, that “questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” i Common Issues When examining whether certain issues predominate, a court looks to see if “common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aperegation-defeating, individual issues.” Tyson Foods, Inc. v. Bouaphakeo, 577 US. 442, 453 (2016) (citation and internal quotation marks omitted). An action can properly be considered under Rule 23(b)(3), if “one or more of the central issues in the action are common to the class and can be said to predominate... even though other important matters will have to be tried separately, such as damages or some affirmative defenses peculiar to some individual class members.” Id. In this case, there is a myriad of questions of law and fact that predominate. These include: whether Wawa owed a duty to class members to safeguard their payment card information; whether Wawa breached that duty; whether Wawa violated state consumer protection laws, whether Wawa knew or should have known that its payment processing systems were susceptible to attack; whether Wawa complied with industry standards (i.e., the Payment Card Industry Data

Security Standard—PCI DSS); whether Wawa’s conduct or failure to act was the proximate cause of the breach; and whether plaintiffs and the class members are entitled to recovery. Given the nature of the data security incident, Wawa’s liability depends upon the duties it owed to its customers and the actions it took or did not take; it does not depend on the “narticularized conduct of individual class members.” Sullivan v. DB Invs., Inc., 667 F.3d 273, 300 (3d Cir. 2011). The Consumer Plaintiffs represent that class members would rely on “common documentary, testimonial, and expert evidence” to show both Wawa’s action and inaction and to establish liability. Doc. No. 180 at 33. The Court finds that common issues predominate in this

case. See In re NFL Players Concussion Inj. Litig., 821 F.3d 410, 427 Gd Cir, 2016) (finding commonality existed even if plaintiffs’ “particular injuries are unique [because] their negligence and fraud claims still depend on the same common questions regarding [defendant’s] conduct”). ii. Means of Adjudication Rule 23(b)(3) includes several non-exhaustive factors for a court to consider, including: “(A) the class members’ interests in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already begun by or against class members; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in managing a class action.” Here, after considering these factors, the Court finds that they weigh in favor of granting preliminary class certification for settlement purposes. Nothing before the Court even suggests that the class members would be interested in litigating their claims individually or that this litigation should proceed in a non-class forum.! The many cases filed against Wawa in state and

The Court will address the Employee Plaintiffs’ opposition to the proposed class Settlement Agreement below.

federal court were brought as class actions, and the federal actions have been consolidated in this Court, while the single state-court action in New Jersey has been stayed pending the outcome of the negotiated settlement. Jt. Decl. 14, 38. Furthermore, the cost and complexity of the litigation here would likely preclude most class members from filing suit individually. “Confronted with a request for settlement-only class certification, a district court need not inquire whether the case, if tried, would present intractable management problems . . . for the proposal is that there be no trial.” In re Processed Egg Prod. Antitrust Litig., 284 F.R.D. 249, 264 (E.D. Pa. 2012) (internal citation omitted) (quoting Amchem, 521 U.S. at 620). The proposed settlement here provides class members with an immediate tangible benefit in the form of a Wawa gift card or cash payment in addition to improved security when using a payment card at Wawa. See Fulton-Green, 2019 WL 316722, at *4 (preliminarily certifying Rule 23(b)(3) class in data breach case where “all of the claims [were] almost identical,” “the damages should be easily provable and quantifiable,” and “the value of the individual claims may be modest and thus impractical to litigate” individually). The Court concludes that the Consumer Plaintiffs have established that their proposed class warrants preliminary class certification for the purposes of settlement having met the requirements of Rules 23(a) and 23(b){3). U. Motion for Preliminary Approval of the Settlement Agreement The parties also ask the Court to preliminarily approve their settlement in accordance with Rule 23(e). The Consumer Plaintiffs’ Amended Complaint alleges that Wawa breached its duties by failing to secure its point-of-sale systems which resulted in the compromise of customers’ payment card data. A few months after filing the Amended Complaint and after a day-long

mediation, the parties reached an agreement in principle to settle. The terms of the settlement are set out in a settlement agreement, executed by the parties and their counsel, and later amended. A. Background i. Settlement Agreement and Claims Process The Settlement Agreement provides for three tiers of relief among the class members as well as injunctive relief by way of enhancements to Wawa’s payment processing procedures and terminals. See Doc. 201-1, Exhibit A, Amended Settlement Agreement (“S.A.”). All class members who do not opt out of the settlement then release any claims against Wawa arising from the data breach. Tier One provides a $5 Wawa Gift Card for customers who used a debit or credit card to make a purchase at Wawa between March 4, 2019 to December 12, 2019 and who attest that they spent at least some time monitoring their payment card as a result. Total Tier One compensation is subject to a $6 million cap and a $1 million floor. 8.A. | 36. Tier Two provides a $15 Wawa Gift Card to customers who used a payment card at Wawa during the relevant time period, had a subsequent fraudulent charge on their card, and spent at least

some time addressing the fraudulent transaction or otherwise monitoring their account. Total Tier Two compensation is subject to a $2 million cap and no floor. Jd. Gift cards under both Tiers One and Two will be fully transferable, valid for one year, and usable toward the purchase of any item sold in a Wawa convenience store (except tobacco products), including fuel if payment is completed inside the store. Tier Three provides cash payments up to $500 for customers who can demonstrate certain expenditures they made or other out-of-pocket losses resulting from the data breach. The maximum total payments for Wawa for claims in this Tier is $1 million in aggregate, Id.

The Settlement Agreement also provides for injunctive relief. These provisions will require Wawa to strengthen its data security systems, and its in-store and fuel dispenser payment terminals, to help prevent future data breaches. Other enhancements will include an annual compliance assessment/audit and vulnerability testing. The upgraded systems and other security measures are estimated to cost at least $35 million. /d. {J 38-40. As to the claims process, class members will be able to fill out a claim form online and select under which tier they are filing their claim. Jd 36. Wawa will be responsible for generating and distributing the Wawa gift cards to claimants. /d. { 81. il. Attorneys’ Fees, Class Representative Awards, and Administrative Fees Aside from class member compensation, Wawa has agreed to pay a lump sum of $3.2 million to cover attorneys’ fees and expenses, class representative awards, and the costs of settlement administration. /d. {§] 77-79. The named plaintiffs (and one additional state court plaintiff) are also applying for $1,000 service awards to recognize their time, effort, and commitment on behalf of the Settlement Class, including the production of documents and information throughout litigation. 7d. § 76. Plaintiffs request that the Court appoint KCC, LCC to

serve as the Settlement Administrator to oversee notice and to administer the claims process. Id. 42. ili, Notice The proposed notice program includes posting signs at Wawa’s payment terminals inside stores and at fuel pumps, information posted on Wawa’s website, a comprehensive settlement website, a press release, and resulting media coverage. Jd. 55. The settlement website will include detailed information about the litigation, class members’ rights, how to file a claim, how

to object to the settlement, and how to opt out of the settling class. When the notice period begins, the signs will be posted for four consecutive weeks in Wawa stores and at Wawa fuel pumps. These signs will include a QR code that customers can scan with their smartphones, which will then take them directly to the settlement website. Plaintiffs cite to Wawa’s high store traffic

as evidence that the signs will be seen by many of its customers. For example, in January 2021, Wawa’s in-store customer transaction count was 46 million and its fuel customer transaction count

was 18 million. Doc. No. 180-5, Exhibit E (O’Brien Decl.) § 2. B. Employee Plaintiffs’ Opposition The Employee Plaintiffs, who currently are represented by Shawn McGlade, a former Wawa assistant general manager and general manager, and his wife, Karen McGlade, oppose the proposed Settlement Agreement, arguing that it will extinguish employees’ rights who are also themselves consumers and, as a result, they ask the Court to order the parties “back to the bargaining table.” Doc. No. 188 at 9. They argue that they are not challenging whether the settlement terms offered to consumers are “fair, reasonable and adequate” but rather whether the settlement is appropriate for the Employee Plaintiffs. Doc. No. 196 at 5. They assert that their “objections are limited to their interests in achieving the best result possible through litigation or settlement of their claims.” Doc. No. 196 at 5. They also argue that Wawa employees have stronger claims under Pennsylvania law and, accordingly, a separate tier should be established for them. They contend that the Settlement Agreement does not represent their best interests because

no Employee Plaintiff representative was invited to participate in the mediation or the underlying negotiations which led to the the current Settlement Agreement. Doc. No. 188 at 5. They also

argue that counsel for the Consumer Plaintiffs cannot adequately represent the Employee Plaintiffs

because they are adverse to their interests, noting that the Consumer Plaintiffs joined Wawa in seeking a dismissal or stay of the Employee Plaintiffs’ payment card data claims. Jd. at 20, 22. In response, the Consumer Plaintiffs argue that the Employee Plaintiffs have essentially jumped the gun because they will be able to raise their “objections” once the settlement notices go out and the process for filing objections begins. And, at such a time, if the Employee Plaintiffs

are unsatisfied with the settlement’s terms, they will be able to opt out. Doc. No. 193 at 8. The Consumer Plaintiffs also emphasize that counsel for the Employee Plaintiffs “never once asked to participate in the mediation.” /d. at 10. Wawa adds that any redress the Employee Plaintiffs seek for using a payment card while “walking and talking like a consumer” is appropriately resolved through the Consumer Track settlement. Doc. No. 194 at 6. Wawa contends that it always expected Wawa employees who were allegedly injured as consumers would be included in any Consumer Track settlement. /d. at 6-7. i, Gift Cards The Employee Plaintiffs argue that the proposed Wawa gift cards—which they refer to as “eoupons”—do not pass muster under the Class Action Fairness Act regarding non-cash class action settlements and that Wawa is not committed to paying the full, expressed settlement amount because it will only issue compensation on a claims-made basis. Although Wawa has committed to paying up to $9 million, the Employee Plaintiffs argue that this will only occur if there is a sufficient number of eligible class members who actually submit a claim. Doc, No. 188 at 19. They argue that the issuance of gift cards provides little value to proposed class members who no longer live near a Wawa store or who choose not to shop at Wawa and that the rationale behind the effectiveness of the gift cards—Wawa’s loyal customer base—is inapplicable to employees.

They argue that Mr. McGlade, a former Wawa assistant general manager and general manager, has no desire to return to a Wawa store to redeem a gift card. The Consumer Plaintiffs argue that the Wawa gift cards are not “coupons” within the meaning of CAFA but are actually the functional equivalent of cash. Doc. No. 193 at 7-8. Moreover, the Consumer Plaintiffs contend that Wawa gift cards are not the exclusive settlement consideration because those who suffered documentable, out-of-pocket losses can submit a claim for reimbursement of up to $500. id. at 14. They also assert that “the fact that there may be a few class members who may not want to shop at Wawa anymore, or live far away from Wawa stores, does not dictate that the Settlement is fatally flawed.” Jd. Wawa argues that the Class Action Fairness Act does not prohibit settlements that involve gift cards and that while CAFA does apply to coupon settlements, a gift card is not a coupon. Wawa explains that the gift cards in this case, under Tier One and Tier Two, can be used for virtually any item Wawa sells and customers do not need to spend any of their own money to redeem the full value of the cards. /d at 13. Wawa also notes that it sells many everyday items at its stores, 78% of which cost less than $5, and that 97.2% of Wawa gift cards issued in the last

year have been redeemed. /d. Wawa argues that even if the Court were to find that these gift cards

are coupons under CAFA, this settlement warrants approval so long as the Court determines that it is “fair, reasonable, and adequate for class members.” 28 U.S.C. § 1712(e). This is the same standard as that in Rule 23, and Wawa argues that the terms of the settlement meet this standard. ii. Notice The Employee Plaintiffs also argue that the proposed notice plan is insufficient because it does not include notice via first-class mail. They argue that Wawa should mail settlement notices to all current and former Wawa employees and that publication notice also should be required

because an in-store placard—at a time when store foot store traffic has decreased due to the pandemic—is not the best method for reaching class members, Doc. No. 188 at 27-28. As support, they cite statistics showing a decrease in store visits between March 2020 to August 2020.7 Jd, at 31-33. They also contend that former employees, like Mr. McGlade, would never see in-store placards, nor would “transient customers” who only visited a Wawa store on their way through one of the six states in which Wawa operates. /d. at 34. Therefore, the Employee Plaintiffs ask the Court to deny preliminary approval until Wawa agrees to mail first-class notices to its employees and to provide publication notice for all consumers. In response, the Consumer Plaintiffs contend that the proposed notice plan—which includes not only in-store notices that will be posted for four consecutive weeks but also a settlement website, a press release, and an announcement on Wawa’s website—will ensure that class members are notified of their options vis-a-vis the settlement. The Consumer Plaintiffs argue that the Employee Plaintiffs do not account for the 2018 changes to Rule 23 which now states that notice may accomplished via “United States mail, electronic means, or other appropriate means.” Fed. R. Civ. P. 23(c)(2)(B). They argue that whether a proposed notice plan is adequate depends on an objective determination of whether the notice efforts will reach a high percentage of the class. Doc. No. 193 at 26. Accordingly, the Consumer Plaintiffs contend that the in-store notices will effectively notify Wawa’s loyal customer base because, based on Wawa’s estimates, more than 64 million customers would see the in-store notices over a four-week period. Jd. at 28. They also assert that the Employee Plaintiffs cite outdated Wawa foot traffic statistics, which only

2 The most recent statistics before the Court are from January 2021. During that month, Wawa’s in- store customer transaction count was 46 million and its fuel customer transaction count was 18 million, O’Brien Decl. 2. Since that time, it is logical to presume that, given the availability of vaccines, the lifting of COVID-19 restrictions, and the resumption of regular in-person activities, foot traffic in Wawa stores has increased as compared to the height of the pandemic.

reflected a 10 percent decrease in brand visits whereas one of Wawa’s primary competitors, 7- Eleven, experienced a 31 percent decline in brand visits over the same period. dd. Lastly, as to mail notice, the Consumer Plaintiffs argue that because Wawa employs roughly 34,000 employees, and assuming all those employees were members of the class, they would comprise approximately less than one half of a percent of the estimated 22 million people affected by the data breach. Additionally, they argue (without any obvious evidence) that current employees will almost certainly see the in-store notices and that former employees are likely to maintain contact with current employees. /d. at 30. Wawa argues that the settlement fully complies with Rule 23’s requirements. Wawa contends that foot traffic statistics from the height of a global pandemic are clearly outdated and that millions of visitors to Wawa’s stores and gas pumps would see the notices over a four-week

span. Wawa also emphasizes that the other means of proposed notice in this case, namely the settlement website, press release, and resulting media coverage, will notify former employees of the settlement. As to mail notice, Wawa contends that it is unnecessary and impracticable. Wawa maintains that it does not regularly collect email addresses for employees and that any mailing addresses for former employees are likely outdated. Doc. No. 194 at 11. Wawa also claims it has

no knowledge of which employees made purchases at Wawa during the class period, “let alone whether they did so with payment cards.” Jd. Wawa contends that former employees will have

many opportunities to learn about the settlement via the proposed notice structure as outlined in the parties’ settlement agreement. C, Rule 23(e} In determining whether to grant preliminary approval, a court should consider whether the proposed settlement has any “obvious deficiencies” as to its fairness and where it “appears to fall

within the range of possible approval.” Mehling vy. New York Life Ins. Co., 246 F.R.D, 467, 472 (E.D. Pa. 2007). Rule 23(e)(2) requires that a settlement be “fair, reasonable, and adequate,” and sets forth several factors a court must consider in determining the fairness of a settlement, including whether: (A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm’s length, (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney’s fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other. Fed. R. Civ. P. 23(e)(2). i. Arni’s-Length Negotiations The parties represent that the settlement here was the result of arms-length negotiations that took place between experienced counsel in this type of litigation, who were themselves assisted by a highly-experienced mediator—the Honorable Diane M. Welsh (Ret.) of JAMS, Doe. No, 181-2 (Welsh. Decl.). The parties participated in several rounds of offers and counteroffers, eventually reaching a settlement in principle. Welsh Decl. {{ 8-11. The mediator stated in her declaration that the “proposed settlement was the result of fair, thorough, and fully-informed arm’s-length negotiations between highly capable, experienced, and informed parties and counsel,” and that the settlement was a “comprehensive resolution that will benefit class members through meaningful relief.” Jd. J 16-17. Afterwards, the parties spent a significant amount of time revising several drafts and negotiating the final details of the written Settlement Agreement that is now before the Court. Jt.

Decl, 4] 19, 20. At this time, the Court is satisfied that the settlement negotiations between the parties indeed took place at an arm’s length.’ See In re NFL Players’ Concussion Inj. Litig., 301 F.R.D, 191, 198 (E.D. Pa. 2014) (“noting that a presumption of fairness exists where parties negotiate at arm’s length, assisted by a mediator” (citing In re CIGNA Corp. Sec. Litig., No. 02- cv-8088, 2007 WL 2071898, at *2 (E.D. Pa. July 13, 2007))). ti. Adequate Relief Interim Co-Lead Counsel represent that they thoroughly investigated the claims in this case by conducting extensive interviews of plaintiffs and other class members, reviewing documents produced by plaintiffs and by Wawa regarding the data security incident, consulting with a data security expert and private investigator, and analyzing the applicable law. Jt. Decl. §6. Wawa produced thousands of pages of documents prior to the mediation, which included a preliminary report on the data security incident (a final report was sent to Consumer Plaintiffs’ counsel after the mediation), emails regarding the incident, and other pertinent documents.* Jd. 4 11. Consumer Plaintiffs’ counsel analyzed these documents prior to the mediation and consulted with their data security expert who had conducted her own preliminary investigation into the incident. Jd.

3 While the Court acknowledges Employee Plaintiffs’ counsel’s argument that he “didn’t know there was a September mediation,” May 5, 2021 Hearing Tr. 43: 15-16, the Court ultimately finds that protestation unavailing, As the Court highlighted during the hearing, “It’s not as though there was some barrier in terms of reaching out” to opposing counsel regarding participation in the mediation. /d. at 44:1-2, As counsel for the Consumer Plaintiffs pointed out, there were several status reports that were filed which stated that a mediation was upcoming. Jd. at 50:21-25. Thus, it can hardly be said that the mediation was somehow hidden or a surprise. 4 Although the Consumer Plaintiffs and Wawa did not engage in “formal” discovery, that is not necessarily an obstacle for preliminary approval of a class action settlement, especially where, as here, the parties have exchanged important informal discovery. See Fulton-Green, 2019 WL 3 16722, at *3 (granting preliminary approval of class action settlement where despite “formal discovery” having not yet started, “the parties exchanged a substantial amount of information regarding the discrete issues in [the] case”).

Judge Welsh presided over the full-day mediation in September 2020. Welsh Decl. { 8. Each side presented additional information concerning damages and other details surrounding the incident, including a relative lack of widespread credit and debit card fraud after the data breach. Jt. Decl. 4 16. Interim Co-Lead Counsel, based on their prior experience in these types of cases and their investigation of the facts and applicable law in this case, determined that the negotiated settlement was fair, reasonable, and adequate, and in the best interests of the proposed settlement class. Id. J 22. Interim Co-Lead Counsel also represent that the settlement takes into account the costs, risks, and delay of trial and appeal, and that counsel assessed these contingencies when analyzing the terms of the settlement. /d.; Welsh. Decl. {] 16, 17. Counsel also pose that plaintiffs and the proposed settlement class would face a number of challenges absent settlement, including, among other things, opposing a motion to dismiss, obtaining class certification, and briefing motions for

summary judgment. a. Form of Relief Here, the Settlement Agreement provides both monetary and injunctive relief. First, it offers relief via Wawa gift cards or direct cash compensation for those who can document out-of- pocket losses. Second, it offers injunctive relief by way of enhanced payment system terminals and bolstered data security practices.° The crux of the Employee Plaintiffs’ criticism is that they should be able to assert their

own claims related to the payment card data breach and obtain their own relief. However, such an argument is premature. The Employee Plaintiffs will be able to voice their objections prior to, and

5 The Court noted during the preliminary hearing that the settlement’s injunctive relief was a type of “derivative protection for the customers,” but that the “major motivation” for such improvements “should be for Wawa itself.” May 5, 2021 Hearing Tr. 26:17-19. Nevertheless, class members will benefit from these improvements. 19

during, the final approval hearing. The Court will not now entertain the prospect of forcing the parties back to the bargaining table. Wawa currently has approximately 34,000 employees—and it is estimated that there were over 50,000 current and former employees during the class period. The proposed class is estimated to be over 22 million customers. If, after preliminary approval, the Employee Plaintiffs are dissatisfied with the terms of the Settlement Agreement, they will be able to object or opt out of the settlement entirely. This is an entirely plausible scenario, especially given the fact that the Court previously denied Wawa’s motion to dismiss the Employee Plaintiffs’ payment card data claims, which will allow the Employee Plaintiffs to litigate these issues on their own—should they choose to do so. See In re Wawa, Inc. Data Sec. Litig., No. 19-cv-6019, 2021 WL 1910887, at *7 (E.D. Pa. May 12, 2021). The Employee Plaintiffs have failed to demonstrate at this stage that the gift cards and cash compensation for certain individuals is not adequate or fair. The form of relief was discussed in depth at the preliminary approval hearing. Counsel for the Consumer Plaintiffs, and counsel for Wawa, stated that around 97.5 percent of Wawa gift cards are redeemed, demonstrating that the gift cards will provide value to class members. May 5, 2021 Hearing Tr. 12:14, 78:16-17. Wawa’s counsel also stated during the hearing that Wawa sells more than 3,000 products that cost less than $5. dd. at 95:13. In a dialogue with the Court, counsel for Wawa acknowledged that it is less expensive for Wawa to distribute gift cards, especially digital ones via email. Jd. at 96:2-8. Wawa’s counsel then explained that Wawa likely would not have been able to provide the same $5 and $15 amounts if it had accepted a cash or check settlement. Jd. at 101:14-17. Given the increased value presented by the gift cards, the Court finds them to be a fair and adequate form of relief, in addition to cash compensation for those who quality. Additionally, after the Court questioned whether gift card recipients would get a reminder to “actually use their

benefit” if they had not already done so, id. at 67:1-5, the parties later informed the Court that the settlement administrator will send an email reminder to claimants who have not yet used the full value of their Wawa gift cards as of nine months after the gift cards have been issued. See Doc. No. 209 at 1. The Court disagrees that this is somehow a “coupon settlement.” Indeed, “gift cards are a fundamentally distinct concept in American life from coupons.” Ja re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 952 (9th Cir. 2015). Furthermore, “[dlistrict courts that have considered the issue have not classified gift cards as coupon settlements falling under CAFA.” Jd. (listing cases). In one such case from this district, where plaintiffs brought claims under the Fair and Accurate Credit Transactions Act, the court approved $20 Rite Aid gift cards, finding they were “more like cash than coupons” because they were mailed directly to class members, did not expire, could be freely transferred, and could be used to purchase one of the many items sold at Rite Aid. Reibstein v. Rite Aid Corp., 761 F. Supp. 2d 241, 255-56 (E.D. Pa, Jan. 18, 2011). In another case, the court found that the non-cash compensation there, which involved non- transferable discount vouchers that required the purchase of a product so the consumer could obtain the voucher’s benefit, was “not a gift card.” Rougvie v. Ascena Retail Grp., Inc., No. 15- cv-724, 2016 WL 4111320, at *29 (ED. Pa. July 29, 2016). Here, the gift cards are more in line with those in Reibstein because they can be used to purchase virtually any item Wawa sells (excluding tobacco products) and there is no minimum purchase to obtain the value on the card. This is unlike Rougvie where those customers had to spend a certain amount before they received any value from the vouchers. Additionally, the Wawa gift cards here are fully transferable.® At this time, the Court sees no reason to doubt that the

$ Given this transferability, the Consumer Plaintiffs argue that “a class member could stand inside a Wawa location and give or sell his Wawa Gift Card to the next person who approaches the counter.” Doc.

settlement will provide a tangible benefit to plaintiffs and proposed class members while avoiding the costs and risks associated with continued litigation. See In re CertainTeed Fiber Cement Siding Litig., 303 F.R.D. 199, 216 (E.D. Pa. 2014) (noting that continued litigation would be “complex, expensive and lengthy,” and that a “settlement would eliminate delay and expenses and provide immediate benefit to the class”). b. Claims Process The Settlement Agreement also includes a claims process for class members to submit a claim for a Wawa gift card or cash reimbursement for any out-of-pocket expenses or losses they incurred as a result of the data security incident. This Court has previously recognized that a claim filing procedure is appropriate and acceptable in the context of a data breach settlement, F’ ulton- Green v. Accolade, inc., No. 18-cv-274, 2019 WL 4677954, at *8 (E.D. Pa. Sept. 24, 2019). Here, the proposed claims process is “straight-forward” due to the use of “easy to understand claims forms.” /d. At the hearing, the Court asked how any “Luddites,” i.e., non-electronics users, who visited Wawa during the class period and used a payment card would go about filing an online claim. May 5, 2021 Hearing Tr. 22:11. Counsel for Wawa maintained that these class members could have a friend or family member submit a claim form for them, or the claims administrator could print out a paper version of the claim form and mail it to those class members who are technology-averse. Id, at 22:13-18. The Court is satisfied that there are multiple pathways through which a class member could successfully file his or her claim, either online through the website or via a mailed paper form. The Court also noted during the preliminary hearing that it had concerns that a claimant who provided his or her email address to obtain their gift card might later receive “unsolicited

No, 193 at 19. Although the Court has its doubts as to whether such a practice is likely to occur, it nevertheless appears to be one option a claimant would have in getting value from his or her gift card.

promotional information.” /d at 49:25-50:1-2. Wawa’s counsel assured the Court that Wawa would not utilize the claims process to then send additional, non-claims related communications. Id, at 81:3-14. The Court suggested that the parties include a clear provision that any email address

or contact information a claimant provides will only be used by Wawa for the purpose of processing their claim. Id. at 81:20-25-82:1-4, The parties have since agreed to add such language to the notices. See Doc. No. 209. c. Notice As to notice, the settlement includes several methods by which class members will be notified of the settlement, including store signage, a press release, the settlement website, and Wawa’s website. These methods were chosen during the parties’ negotiations to remedy the fact that Wawa has no other available means to identify or contact potential class members who used

a credit or debit card during the class period. Jt. Decl. §31; Welsh Decl. § 14. The signs announcing the settlement will be posted for four consecutive weeks inside Wawa stores and at Wawa gas pumps. S.A. §55.b. To reduce the potential for any fraudulent claims, class members

must submit reasonable documentary proof of their Wawa purchase and, if necessary, any resulting fraudulent charges or out-of-pocket expenses. S.A. {{ 36.b.iii, 36.c.v. The Court finds that the proposed notice plan set forth by the settlement is reasonable. The Employee Plaintiffs argue that Wawa should also send notices via first-class mail to all former and

current employees who worked at Wawa during the class period. However, the post-2018 amendments to Rule 23 provide that other forms of notice besides first-class mail can be reasonable, Pursuant to Rule 23(c)(2)(B), notice to class members must be the “best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.”

Here, Wawa will be displaying signs for four consecutive weeks inside Wawa stores—near the registers—and at all Wawa fuel pumps. The estimated number of class members is over 22 million customers. Based on foot traffic data, Wawa estimates that over 64 million people would

see these signs over the four-week period (albeit that part of this number will represent customers making more than a single stop in the four-week period). See In re Nat'l Collegiate Athletic Ass'n Student-Athlete Concussion Inj. Litig., 314 F.R.D. 580, 603 (N.D. Ill. 2016) (citing the Federal Judicial Center standard which states that a notice plan that can reach 70% to 95% of the settlement class is reasonable). Aside from the in-store signage, Wawa will also be placing a notice on the Wawa website and the full details of the settlement will be available on the settlement website. Thus, mailing first-class notices to all former and current employees appears to be overinclusive, especially because there is no data on the number of employees who used a payment card at Wawa during the class period. Of course, it goes without saying that current employees are the most likely of potential class members to see the in-store signage because it will be placed next to Wawa store registers and at Wawa fuel pumps. The Court must strike a balance “between protecting the rights of absent class members and making Rule 23 workable.” Carlough v. Amchem Prod., Inc., 158 F.R.D. 314, 327 (E.D. Pa. 1993). To that end, “courts have held that it is not necessary to send individual notices to an overinclusive group of people simply because that group contains some additional class members whose identities are unknown.” Jd. Accordingly, the Court does not find that the lack of first-class mailed notices would impede class members, including former and current employees, from learning about the settlement. Furthermore, Wawa will also be issuing a press release. As stated during the preliminary hearing, Wawa’s initial disclosure of the data breach in December 2019 resulted in millions of

media impressions, which, as represented by Wawa’s counsel, is “every time someone sees a particular article.” May 5, 2021 Hearing Tr. 88:18-25-89:1-15. The Court anticipates that the preliminary approval of the settlement will also garner media attention. Other courts have found that media coverage of a settlement is a positive factor as to notice. See In re Prudential Ins. Co. Am. Sales Prac. Litig. Agent Actions, 148 F.3d 283, 327 (3d Cir. 1998) (noting that the “unsolicited

news coverage the settlement received” was a factor that “greatly increased the possibility” that

more class members would be compensated); see also Campbell v. Facebook, Inc., 951 F.3d 1106, 1115, 1128 (9th Cir. 2020) (affirming district court’s final approval of settlement where notice was provided on class counsel’s websites and based on publicly available information, “primarily through news coverage”). Thus, the Court finds that the notice program set forth by the settlement represents suitable and practicable notice under the circumstances. Through signage that will be displayed at Wawa registers and at Wawa fuel pumps for four consecutive weeks, an announcement on Wawa’s website, a dedicated settlement website, and a press release, the Court is satisfied that potential class members will properly receive notice of the settlement and their options for filing a claim or otherwise participating in the settlement process. iii, Attorneys’ Fees Interim Co-Lead Counsel represent that they have “devoted significant time and financial

resources to the litigation despite the uncertainty of prevailing as to class certification and the merits and establishing damages.” Doc. No. 180 at 27. They maintain that the topic of attomeys’ fees was not discussed with Wawa until substantive settlement terms had already been reached. Jt. Decl. § 38; Welsh Dect. § 15. Counsel states that they will apply for attorneys’ fees that constitute a negative multiplier of their aggregate lodestar. Jt. Decl. 41. Additionally, the parties

have agreed that any attorneys’ fees approved by the Court would be paid out of a separate $3.2 million dollar fund for litigation expenses, settlement administration fees, and individual service awards to the class representatives, none of which will negatively impact the settlement funds available for the class members. /d. { 44. The Employee Plaintiffs argue that the proposed attorneys’ fees are improper because class counsel will be paid in cash—$3.2 million-—-while the class members will be paid in some other

way. Doc. No. 188 at 36. They contend that such a fee request deserves greater scrutiny than the patties represent in their moving papers. /d. at 8. The Consumer Plaintiffs retort that such an objection is premature because a motion for attorneys’ fees, including supporting documentation, has not yet been filed. Doc. No. 193 at 7, Nevertheless, counsel for the Consumer Plaintiffs maintain that the attorneys’ fees agreed to by the parties are reasonable given counsel’s intention

to “move for fees reflecting a negative multiplier of counsel’s aggregate lodestar.” Id. at 20. At this time, the Court declines to further address attorneys’ fees issues because a formal motion will be filed at a later date, at which time the Court can fully analyze the request and any opposition to it. See Inre NFL Players Concussion injury Litig., 821 F.3d 410, 444 (3d Cir. 2016) (“The petition for a fee award will be submitted to the Court at a later date. Objectors will then be able to present arguments as to why the requested award is improper, and the Court will have discretion to modify the award in whatever way it sees fit.”). iv. Additional Requirements Rule 23(e)(2)(C)(iv) requires a court to consider any agreement among the parties that exists outside of the settlement agreement as identified in Rule 23(e)(3). Rule 23(e)(3) provides that “parties seeking approval must file a statement identifying any agreement made in connection

with the proposal.” Fed. R. Civ, P. 23(e)(3). In this case, as represented by the parties, no such agreement exists outside of the Settlement Agreement. Jt. Decl. { 30. v. Equitable Treatment of Class Members Relative to Each Other The Consumer Plaintiff contend that the settlement treats all class members equitably and provides them with the same available means by which to recover under the Settlement Agreement. At this time, the Court is satisfied that the three tiers of direct relief and the additional injunctive relief meet this standard. The three tiers delineate between class members who experienced fraud

or attempted fraud and provides cash compensation to those class members who can demonstrate out-of-pocket expenses; it also provides injunctive relief to all. See Sullivan, 667 F.3d at 326 (“A district court’s ‘principal obligation’ in approving a plan of allocation ‘is simply to ensure that the fund distribution is fair and reasonable as to all participants in the fund.’” (quoting Walsh v. Great Atl. & Pac. Tea Co., Inc., 726 F.2d 956, 964 (3d Cir. 1983))). CONCLUSION For the foregoing reasons, the Court preliminarily certifies the class for settlement purposes and preliminarily approves the parties’ Settlement Agreement. An appropriate order follows.

BY THE COURT: LL Exe, Lu □□□ ae Cg eas NMETED STATES DISTRICT JUDGE