IN RE WAWA, INC. DATA SECURITY LITIGATION

• Court: District Court, E.D. Pennsylvania
• Decided: August 25, 2025
• Docket: 2:19-cv-06019
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

IN RE WAWA, INC. CIVIL ACTION DATA SECURITY LITIGATION

This document applies to the Financial Institutions Track. NO. 19-6019 and all related cases

HODGE, J. August 25, 2025

MEMORANDUM

Before the Court is Defendant Wawa, Inc.’s (“Wawa”) Motion to Compel Claims Communications (“Motion to Compel”) from Financial Institution Track Plaintiffs (“FI Plaintiffs”) (ECF No. 468) and FI Plaintiffs’ Motion for Protective Order and Response in Opposition to Wawa’s Motion (“Motion for Protective Order”) (ECF No. 470). Upon consideration of the briefing, and for reasons that follow, the Court denies Wawa’s Motion to Compel and in turn denies as moot FI Plaintiffs’ Motion for Protective Order. I. BACKGROUND1 After a December 2019 data breach at Wawa, multiple lawsuits were filed against the convenience store chain, which the Court consolidated into one action with three tracks: financial institutions, employees, and consumers. In March 2023, FI Plaintiffs negotiated a preliminary settlement agreement with Wawa. (ECF No. 411 at 2). Retired United States Magistrate Judge Diane Welsh mediated these negotiations. (Id.). The Court granted preliminary approval of the settlement in October 2023. (Id. at 20). According to Section 3.1 of the Settlement Agreement, the proposed Settlement Class is defined as “[a]ll financial institutions . . . that issued payment cards (other than American Express) that either: (a) were Alerted On Payment Cards; or (b) were used at Wawa during the period of the

1 The Court adopts the pagination supplied by the CM/ECF docketing system. incident March 4, 2019 – December 12, 2019.” (ECF No. 360-4 at 7). The Settlement provides for up to $28.5 million in direct monetary compensation for Settlement Class Members that file claims. (Id. at 33). The compensation made available to Settlement Class Members is broken down into three tiers designed to address the specific types of harm resulting from the breach. As relevant here, Tier 1 compensation consists of $5.00 per replaced payment card to those financial institutions who attest to having cancelled and replaced the impacted cards in response to the data breach, if replaced between December 12, 2019, and May 1, 2020.2 (Id. at 9). Wawa has committed a minimum of $3

million and maximum of $18.5 million for Settlement Class Members that file claims in this tier. (Id.). On April 12, 2024, initial notice was mailed out via USPS First-Class Mail directly to 4,913 affected Class Members, with reminder postcards sent on July 22, 2024; 729 timely total claims have now been verified. Only two Class Members have chosen to opt out, and no objections have been made. To date, FI Plaintiffs have achieved a claims rate of 15.2%, resulting in an expected total of $8,343,511.88 in Settlement benefits to be paid out to Class Members. On October 21, 2024, FI Plaintiffs filed an Amended Motion for Approval of Proposed Class Action Settlement (ECF No. 460) and an Amended Motion for Attorney Fees, Expenses,

Service Awards & Costs of Settlement Administration (ECF No. 461), both of which Wawa filed a Partial Opposition to. (ECF No. 466). Shortly thereafter, Wawa filed the instant Motion to Compel, seeking discovery in the form of the following: • (1) Communications between Class Counsel and Settlement Class Members (other than Named Plaintiffs) concerning the settlement;

2 “Impacted cards” means payment cards that were either (1) compromised by the data breach or (2) used at Wawa during the relevant time frame. (ECF No. 360-4 at 3, 5-6). • (2) All communications between the Settlement Administrator and Settlement Class Members related to claims (other than the claims themselves); • (3) All communications between the Settlement Administrator and Class Counsel on which Wawa was not copied or included; and • (4) Any contracts or agreements between Class Counsel and the Settlement Administrator to which Wawa was not a party. (ECF No. 468-1 at 10).3

II. LEGAL STANDARD Rule 37 of the Federal Rules of Civil Procedure governs motions to compel discovery. Under Rule 37(a), a party may file a motion to compel discovery when the opposing party fails to respond or provides incomplete or evasive answers to properly propounded document requests or interrogatories. See Fed. R. Civ. P. 37(a)(3)(B)(iii—iv). Federal Rule of Civil Procedure 26(b)(1) defines the scope of discovery as "any nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case." A matter is relevant if "it has any tendency to make a fact more or less probable than it would be without the evidence; and, the fact is of consequence in determining the action." Fed. R. Evid. 401. The scope and conduct of discovery are within the sound discretion of the trial court. In re Cendant Corp. Sec. Litig., 343 F.3d 658, 661-

62 (3d Cir. 2003). III. DISCUSSION While agreeing that “the proposed Settlement and Settlement Agreement [a]re fair, reasonable and adequate and would be deserving of final approval,” Wawa argues that the Court must exclude some of the claims FI Plaintiffs include in their proposed settlement calculation on the grounds that

3 Because Wawa makes the same arguments in its Motion to Compel as it does in its Partial Opposition, the Court refers to FI Plaintiffs’ Motions and Wawa’s Partial Opposition throughout this opinion. these claims (1) were filed, cured, or amended after the revised claims deadline of September 12, 2024; (2) should be rejected given the “disproportionate” number of claimed cards compared to the number of impacted cards; and (3) are “inherently suspicious” given the timing of their submission and Class Counsel’s involvement “outside the scope” of the Court-approved notice program. (ECF No. 466 at 1, 9). The Court addresses each of Wawa’s arguments in turn. A. Claims Allegedly Submitted After September 12, 2024 Claims Deadline 1. Background

First, Wawa objects to Analytics Consulting (“Analytics”), the proposed Settlement Administrator, accepting what Wawa deems “Late-Cured Deficient Claims”: Claim 1003100, Claim 1004263, Claim 1000975, Claim 1005248, and Claim 1005504. (ECF No. 469 at 10). Upon realizing that the relevant claimants submitted their claims without signing an attestation on the last page of the Claim Form, Analytics issued deficiency notices to each of these claimants on October 15, 2024. (Id.). Each claimant provided a completed verification page within a few days after these notices were mailed. (Id. at 12). Second, Wawa objects to four “Late-Filed Claims”: Claim 1004576, Claim 1000913, Claim 1001235, and Claim 1000874. (Id.). The relevant claimants initiated their claims prior to the deadline by entering their unique claim number and pin in the filing portal, which Analytics has

record of. (Id.). However, no further data was captured, and Analytics could not ascertain whether these submissions failed as a result of a system error or a claimant error. (Id. at 12-13). Thus, Analytics permitted each claimant that sought to correct the issue to do so, even though it was after the deadline. (Id. at 13). Third and lastly, Wawa objects to three “Late-Amended Claims”: Claim 1005075, Claim 1000181, and Claim 1002860. (Id. at 6). Claims 1005075 and 1000181 were filed by the same claimant and, respectively, reflect Visa and Mastercard branded payment cards that were cancelled and reissued due to the data breach. (Id. at 6-7). On August 9, 2024, the claimant contacted Class Counsel to obtain assistance with their claims, and Class Counsel directed the claimant to Analytics. (Id. at 7). The claimant informed Analytics that they were unsure about whether they could gather sufficient information for the claim by August 12, 2024 (the original claims deadline), but were in the process of confirming the card numbers involved. (Id.). Analytics advised the claimant to submit their claims with all available information by August 12, 2024, and to email the dedicated claims inbox with updated information. (Id.). Accordingly, the claimant submitted timely claim forms and

signed the appropriate attestations on August 12, listing one Visa card in Claim 1005075 and 100,000 MasterCard cards in Claim 1000181. On August 23, 2024, the claimant informed Analytics via email that they had finalized their research on the number of impacted cards claims (294,112 cards for Claim 1005075 and 112,590 cards for Claim 1000181). (Id.). The claimant also asked Analytics to advise how they could “properly amend the correct count of cards for [their] Tier 1 claim[s]” on account of the claimant’s unsuccessful attempt to update their claim forms using the website portal. (Id.). Analytics advised the claimant that it would update Claims 1005075 and 1000181 to reflect the amended card numbers in the email. (Id.). As to Claim 1002860, it was filed on August 5, 2024, and identified 300 impacted cards. (Id. at 8). However, immediately after filing, the relevant claimant alerted Analytics that they entered an

incorrect number of cards on the Claim Form and were unable to correct the error with the accurate number of cancelled and replaced cards (4,284) on the website portal. (Id.). Analytics advised the claimant that it would update the claim to reflect this correction. (Id.). On November 4, 2024, and November 21, 2024, Analytics asked the two claimants to provide updated claim forms and new attestations, and both claimants promptly complied. (Id.). 2. Analysis The Court accepts the aforementioned claims as valid, for even if they are technically untimely, the claimants in question made a reasonable effort to submit their claims by the September 12, 2024 deadline. Under Federal Rule of Civil Procedure 60(b)(1), a "court may relieve a party . . . from a final judgment, order, or proceeding . . . for the following reasons: (1) mistake, inadvertence, surprise, or excusable neglect." A district court "has the general equitable power to modify the terms of a class action settlement." In re Cendant Corp. Prides Litig., 233 F.3d 188, 194 (3d Cir. 2000). When

a party seeks relief for untimely claims under a settlement agreement, the Third Circuit has utilized the "excusable neglect" standard from Rule 60. See In re Orthopedic Bone Screw Prods. Liab. Litig., 246 F.3d 315, 321-22 (3d Cir. 2001) (stating that the "excusable neglect" standard "provides the analysis for consideration of untimely claims for inclusion in a class action settlement"); In re Cendant Corp. Prides Litig., 311 F.3d 298, 300 (3d Cir. 2002) (Cendant II) (applying excusable neglect to a late-filed claim). The factors for "excusable neglect" are 1) the danger of prejudice to the nonmovant; 2) the length of the delay and its potential effect on judicial proceedings; 3) the reason for the delay, including whether it was within the reasonable control of the movant; and 4) whether the movant acted in good faith. In re Orthopedic Bone Screw, 246 F.3d at 322- 23 (citing Pioneer Inv. Servs. v. Brunswick Assoc. Ltd. Partnership, 507 U.S. 380, 395 (1993)).

The Court finds that these factors collectively support accepting the claims. The evidence shows that the claims’ deficiencies resulted from clerical oversight or technological problems, and that once Analytics informed the relevant claimants about their deficiencies, the claimants diligently followed instructions to remedy the problem. Moreover, not only will the Court’s acceptance of these claims not delay the litigation, but it will not prejudice Wawa. These claims reflect a total amount of $2,100,095,00, a figure well below the $18.5 million cap on Tier 1 claims that Wawa committed to pay under the Settlement Agreement. (ECF No. 360-4 at 9). B. Number of Claimed Cards versus Number of Impacted Cards Wawa alleges that several claims seek a disproportionate number of replaced cards compared to the number of cards reported to be involved from Visa or Mastercard, sometimes referred to as the “Alerted On” cards. (ECF No. 466 at 13). The Settlement Agreement establishes that, in order to make a valid Tier 1 claim, a Class Member must attest to (1) having cancelled and replaced impacted cards and (2) the number of impacted cards replaced in response to the data breach. (ECF No. 360-4 at 9). In line with the Settlement Agreement’s terms, the Class Notice requires Class Members making Tier 1 claims to

identify and attest as to the total number of cancelled and replaced impacted cards on their Claim Form, but clarifies that Class Members “are not required to provide any other documentation.” (Id. at 36-37). Based on the terms of the Settlement Agreement, it is clear that Tier 1 benefits are available to any Class Member that cancelled and replaced payment cards used at Wawa during the time period in question. Thus, the Court agrees with FI Plaintiffs that it lacks the authority to reject claims for institutions with cancelled and replaced cards in numbers “disproportionate” to the Alerted On cards, as such action would limit Class Members’ eligibility for Tier 1 benefits in a manner not provided for in the Settlement. See Ehrheart v. Verizon Wireless, 609 F.3d 590, 593 (3d Cir. 2010) ("A district court is not a party to the settlement, nor may it modify the terms of a

voluntary agreement between the parties."); Evans v. Jeff D., 475 U.S. 717, 726-27 (1986) ("[T]he power to approve or reject a settlement negotiated by the parties before trial does not authorize the court to require the parties to accept a settlement to which they have not agreed."). C. Claims Allegedly Impacted by Class Counsel’s “Interference” in the Notice Program Wawa alleges that because Class Counsel’s August 1, 2024 Letter to Class Members was not approved by the Court and contained language different than that contained in the Court- approved notices, the letter therefore “risked misleading and confusing class members, a risk that very well may have been realized given the claims spiking immediately following its release.” (ECF No. 466 at 14-15). Wawa also alleges that, in response to the Third Circuit’s opinion in the Wawa consumer settlement matter remanding the case to the District Court to consider the reasonableness of the $3.2 million attorney’s fee award,4 “[Class] counsel has very clearly approached the claims process with a new and powerful incentive to increase the claims rate and amount.” (Id. at 16). The Court finds Wawa’s concerns with the conduct of Class Counsel to be unsubstantiated.

First, while the August 1 Letter advised class members who desire to file a Tier 1 claim to “confirm that [their] financial institution cancelled and replaced qualifying cards,” and the Claim Form advised class members desiring to file the same claim to “review [their] records to determine if [their] financial institution issued” impacted cards, the Court does not view this deviation in language to be material, for both documents accurately relay the Tier 1 claim requirements. (ECF No. 360-4 at 48; ECF No. 466-4 at 2) (emphasis added). Second, it is not evident that Class Counsel tried to conceal from Wawa their communications with Class Members or their desire to increase the claims rate. To illustrate, Class Counsel jointly declared that not only did they “reach[] out personally to hundreds of Settlement Class Members” in advance of the original claims deadline, but that after the deadline passed and before the Court extended the deadline to September 12, they

reached out to Class Members who had not yet finalized their claim submissions due to technical issues on the settlement website “to assist them with correcting their claim.” (ECF No. 460-3 at 22- 23). Likewise, in FI Plaintiffs’ Motion to Extend the August 12, 2024 Settlement Claims Deadline, Class Counsel stated that because “the claims rate is lower than expected based on Settlement Class Counsel’s experience,” they were seeking an extension of time in order “to help ensure that more Class Members are able to recover damages from this settlement.” (ECF No. 447 at 7). Moreover,

4 In re Wawa, Inc. Data Sec. Litig., 85 F.4th 712, 725 (3d Cir. 2023). regarding the 15.2% claims rate specifically, the Court also finds that this rate is not “unbelievable,” as Wawa characterizes it (ECF No. 466 at 4), for it is in fact less than that of other data breach cases involving financial institution plaintiffs. See Veridian Credit Union v. Eddie Bauer LLC, No. 2:17- cv-00356, 2019 U.S. Dist. LEXIS 171885 (W.D. Wash. June 12, 2019), ECF No. 168 at ¶ 12 (claims rate of 36% where Analytics was Settlement Administrator); First Choice Fed. Credit Union v. Wendy’s Co., No. 2:16-cv-00506, 2017 U.S. Dist. LEXIS 20754 (W.D. Pa. Feb. 13, 2017), ECF No. 185-3 at ¶ 13 (claims rate of 26.8% where Analytics was Settlement Administrator).

IV. CONCLUSION The Court denies Wawa’s Motion to Compel Claims Communications from FI Plaintiffs and, accordingly, denies FI Plaintiffs’ Motion for Protective Order and Response in Opposition to Wawa’s Motion as moot. An appropriate Order follows.

BY THE COURT: /s/ Kelley B. Hodge HODGE, KELLEY B., J.