Wawa, Inc. Data Security Litigation v.

141 F.4th 456
CourtCourt of Appeals for the Third Circuit
DecidedJune 25, 2025
Docket24-1874
StatusPublished
Cited by1 cases

This text of 141 F.4th 456 (Wawa, Inc. Data Security Litigation v.) is published on Counsel Stack Legal Research, covering Court of Appeals for the Third Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Wawa, Inc. Data Security Litigation v., 141 F.4th 456 (3d Cir. 2025).

Opinion

PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT

_______________________

No. 24-1874 _______________________

In re: WAWA, INC. DATA SECURITY LITIGATION

THEODORE H. FRANK, Appellant _______________________

On Appeal from the United States District Court for the Eastern District of Pennsylvania District Court No. 2:19-cv-06019 District Judge: The Honorable Gene E. K. Pratter __________________________

Argued April 10, 2025

Before: HARDIMAN, PORTER, and SMITH, Circuit Judges.

(Filed: June 25, 2025) Adam E. Schulman [ARGUED] Hamilton Lincoln Law Institute 1629 K Street NW Suite 300 Washington, DC 20006 Counsel for Appellant

Gerard A. Dever Matthew H. Duncan [ARGUED] Roberta D. Liebenberg Rachel K. Sommer Fine Kaplan & Black One S. Broad Street Suite 2300 Philadelphia, PA 19107

Samantha E. Holbrook Benjamin F. Johns Shub Johns & Holbrook 200 Barr Harbor Drive Four Tower Bridge, Suite 400 West Conshohocken, PA 19428

Sherrie R. Savett Berger Montague 1818 Market Street Suite 3600 Philadelphia, PA 19103 Counsel for Plaintiff-Appellee Kenneth Brulinski

Kristin M. Hadgis 2 Eric C. Kim Terese M. Schireson Gregory T. Parks [ARGUED] Morgan Lewis & Bockius 2222 Market Street 12th Floor Philadelphia, PA 19103

Michael E. Kenneally Morgan Lewis & Bockius 1111 Pennsylvania Avenue NW Suite 800 North Washington, DC 20004 Counsel for Defendants-Appellees WAWA INC. and Wild Goose Holding Co.

Brenna Bird William Admussen [ARGUED] Office of Attorney General of Iowa 1305 E Walnut Street Hoover State Office Building, 2nd Floor Des Moines, IA 50319 Counsel for Amicus Curiae Attorney General for Iowa in Support of Appellant

Patrick C. Valencia Iowa Department of Justice 1305 E Walnut Street Hoover State Office Building Des Moines, IA 50319 Counsel for Amicus Curiae Attorney Generals for 3 Alaska, Arkansas, Florida, Georgia, Idaho, Iowa, Indiana, Louisiana, Montana, Ohio, South Carolina, Tennessee, Utah, Virginia, West Virginia in Support of Appellant

__________________________

OPINION OF THE COURT __________________________

SMITH, Circuit Judge. Federal Rule of Civil Procedure 1 counsels that the body of rules that follow it are intended “to secure the just, speedy, and inexpensive determination of every action and proceeding.” Although more an exhortation than a legal prescription, the language of Rule 1 nevertheless gives voice to fundamental values that are at the heart of our Nation’s commitment to process, as parties to litigation seek the vindication of legal rights and the enforcement of legal duties in federal courts. Although we conclude that fairness and justice have been achieved by the settlement ultimately reached by the parties in this consumer class action, whether it was accomplished through the types of efficiency envisioned by the drafters of the rules probably rests in the eye of the beholder. Rule 23, which is central to the appeal before us, is no less bound by the values invoked in Rule 1 than is any other rule of civil procedure. In the discussion which follows, we not

4 only address the issues raised by Appellant but also consider the roles played throughout this litigation and its settlement by counsel, by the District Judge, and by an objector. The instant matter is making its second visit to our Court. Because we are satisfied that the parties before us, and their counsel, have acquitted themselves appropriately, and that the experienced District Judge thoroughly pursued the inquiries required of her in ultimately approving the subject class action’s settlement in its entirety, we will affirm. I. BACKGROUND This is a data breach class action. Data breaches are increasing at an alarming pace, rising nearly threefold in the United States from 2020 to 2024. Ani Petrosyan, Annual Number of Data Compromises and Individuals Impacted in the United States from 2005 to 2024, STATISTA (Apr. 2, 2025), https://perma.cc/LS84-6MPZ. The underlying breach occurred within the Wawa convenience store chain, which has approximately 850 locations throughout the mid-Atlantic region and Florida. The chain sells fuel as well as convenience store items such as coffee, pastries, and milk. During the cyber incursion which gave rise to this litigation, hackers stole payment information including credit and debit card numbers, expiration dates, and cardholder names on cards used at all Wawa stores and fuel dispensers. Wawa discovered the breach on December 10, 2019, and took steps to have it contained by December 12, 2019. On December 19, 2019, Wawa’s CEO released a public statement detailing that Wawa had experienced a data security incident

5 involving malware1 on its payment processing servers. Wawa’s internal investigation determined that the malware began running on March 4, 2019, and affected payment processing systems at potentially all of Wawa’s locations until it was contained. On January 27, 2020, the stolen payment information was put up for sale on “Joker’s Stash marketplace,” an exchange found on the dark web at which stolen card information is bought and sold. Wawa Breach May Have Compromised More Than 30 Million Payment Cards, KREBSONSECURITY (Jan. 28, 2020), https://perma.cc/9ADW- ZAH4. As is common in “class action world,” a race to the courthouse promptly ensued. Plaintiffs began filing a variety of state statutory and common law claims in the U.S. District Court for the Eastern District of Pennsylvania (“EDPA”) on December 20, 2019, pursuant to the Class Action Fairness Act (“CAFA”). A total of 15 actions were consolidated on January 8, 2020, by order of then-Chief Judge Juan Sanchez of the EDPA. Three litigation tracks were developed, separating the plaintiffs into broad groups: a financial institution track, an employee track, and a consumer track. It is the consumer track that is at issue in the appeal before us. The consumer track was primarily represented by Berger Montague, P.C.; Fine, Kaplan and Black, R.P.C.; Chimicles Schwartz Kriner & Donaldson- Smith, LLP; and Nussbaum Law Group, P.C. Consumer

1 “Malware is malicious software designed to disrupt, damage, or gain unauthorized access to computer systems.” What is Malware?, MICROSOFT, https://perma.cc/478P-57WG (last accessed May 2025). 6 Plaintiffs filed a Consolidated Class Action Complaint on July 27, 2020, pursuant to Rule 23(a), (b)(2), and (b)(3). The Complaint alleged a range of counts including negligence, negligence per se, breach of implied contract, unjust enrichment, and violations of multiple state consumer protection and data privacy acts. Plaintiffs sought relief, which included both damages and an injunction requiring Wawa to “(i) strengthen its data security systems and monitoring procedures to prevent further breaches; (ii) submit to future annual audits of those systems; and (iii) provide several years of free credit monitoring and identity theft insurance to all class members.” Appx337. A. Settlement Discussions Settlement talks began a few months later. The parties retained a mediator2 to supervise a mediation which was conducted on September 15, 2020. The session lasted almost twelve hours and was, according to the mediator, “extensive, hard fought, conducted at arm’s length, and [] performed in good faith without collusion or other improper conduct.” Appx435. The parties emerged from their combined efforts having achieved a settlement in principle. Class members were to receive a range of benefits as part of that initial settlement plan. The primary benefit provided was either compensation for out-of-pocket losses or

2 Diane Welsh, a former Magistrate Judge in the EDPA, served as the mediator.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
141 F.4th 456, Counsel Stack Legal Research, https://law.counselstack.com/opinion/wawa-inc-data-security-litigation-v-ca3-2025.