IN RE WAWA, INC. DATA SECURITY LITIGATION

IN THE UNITED STATES DISTRICT COURT

FOR THE EASTERN DISTRICT OF PENNSYLVANIA

IN RE WAWA, INC. CIVIL ACTION

DATA SECURITY LITIGATION

This document applies to the Financial

Institutions Track. NO. 19-6019

and all related cases

HODGE, J. August 25, 2025

MEMORANDUM

Before the Court is Defendant Wawa, Inc.’s (“Wawa”) Motion to Compel Claims

Communications (“Motion to Compel”) from Financial Institution Track Plaintiffs (“FI Plaintiffs”)

(ECF No. 468) and FI Plaintiffs’ Motion for Protective Order and Response in Opposition to Wawa’s

Motion (“Motion for Protective Order”) (ECF No. 470). Upon consideration of the briefing, and for

reasons that follow, the Court denies Wawa’s Motion to Compel and in turn denies as moot FI

Plaintiffs’ Motion for Protective Order.

I. BACKGROUND1

After a December 2019 data breach at Wawa, multiple lawsuits were filed against the

convenience store chain, which the Court consolidated into one action with three tracks: financial

institutions, employees, and consumers. In March 2023, FI Plaintiffs negotiated a preliminary

settlement agreement with Wawa. (ECF No. 411 at 2). Retired United States Magistrate Judge Diane

Welsh mediated these negotiations. (Id.). The Court granted preliminary approval of the settlement

in October 2023. (Id. at 20).

According to Section 3.1 of the Settlement Agreement, the proposed Settlement Class is

defined as “[a]ll financial institutions . . . that issued payment cards (other than American Express)

that either: (a) were Alerted On Payment Cards; or (b) were used at Wawa during the period of the

1 The Court adopts the pagination supplied by the CM/ECF docketing system.

incident March 4, 2019 – December 12, 2019.” (ECF No. 360-4 at 7). The Settlement provides for

up to $28.5 million in direct monetary compensation for Settlement Class Members that file claims.

(Id. at 33).

The compensation made available to Settlement Class Members is broken down into three

tiers designed to address the specific types of harm resulting from the breach. As relevant here, Tier

1 compensation consists of $5.00 per replaced payment card to those financial institutions who

attest to having cancelled and replaced the impacted cards in response to the data breach, if replaced

between December 12, 2019, and May 1, 2020.2 (Id. at 9). Wawa has committed a minimum of $3

million and maximum of $18.5 million for Settlement Class Members that file claims in this tier.

(Id.).

On April 12, 2024, initial notice was mailed out via USPS First-Class Mail directly to 4,913

affected Class Members, with reminder postcards sent on July 22, 2024; 729 timely total claims

have now been verified. Only two Class Members have chosen to opt out, and no objections have

been made. To date, FI Plaintiffs have achieved a claims rate of 15.2%, resulting in an expected

total of $8,343,511.88 in Settlement benefits to be paid out to Class Members.

On October 21, 2024, FI Plaintiffs filed an Amended Motion for Approval of Proposed

Class Action Settlement (ECF No. 460) and an Amended Motion for Attorney Fees, Expenses,

Service Awards & Costs of Settlement Administration (ECF No. 461), both of which Wawa filed a

Partial Opposition to. (ECF No. 466). Shortly thereafter, Wawa filed the instant Motion to Compel,

seeking discovery in the form of the following:

• (1) Communications between Class Counsel and Settlement Class Members (other than

Named Plaintiffs) concerning the settlement;

2 “Impacted cards” means payment cards that were either (1) compromised by the data breach or (2) used at Wawa

during the relevant time frame. (ECF No. 360-4 at 3, 5-6).

• (2) All communications between the Settlement Administrator and Settlement Class

Members related to claims (other than the claims themselves);

• (3) All communications between the Settlement Administrator and Class Counsel on

which Wawa was not copied or included; and

• (4) Any contracts or agreements between Class Counsel and the Settlement

Administrator to which Wawa was not a party. (ECF No. 468-1 at 10).3

II. LEGAL STANDARD

Rule 37 of the Federal Rules of Civil Procedure governs motions to compel discovery.

Under Rule 37(a), a party may file a motion to compel discovery when the opposing party fails to

respond or provides incomplete or evasive answers to properly propounded document requests or

interrogatories. See Fed. R. Civ. P. 37(a)(3)(B)(iii—iv). Federal Rule of Civil Procedure

26(b)(1) defines the scope of discovery as "any nonprivileged matter that is relevant to any party's

claim or defense and proportional to the needs of the case." A matter is relevant if "it has any

tendency to make a fact more or less probable than it would be without the evidence; and, the fact is

of consequence in determining the action." Fed. R. Evid. 401. The scope and conduct of discovery

are within the sound discretion of the trial court. In re Cendant Corp. Sec. Litig., 343 F.3d 658, 661-

62 (3d Cir. 2003).

III. DISCUSSION

While agreeing that “the proposed Settlement and Settlement Agreement [a]re fair, reasonable

and adequate and would be deserving of final approval,” Wawa argues that the Court must exclude

some of the claims FI Plaintiffs include in their proposed settlement calculation on the grounds that

3 Because Wawa makes the same arguments in its Motion to Compel as it does in its Partial

Opposition, the Court refers to FI Plaintiffs’ Motions and Wawa’s Partial Opposition throughout

this opinion.

these claims (1) were filed, cured, or amended after the revised claims deadline of September 12,

2024; (2) should be rejected given the “disproportionate” number of claimed cards compared to the

number of impacted cards; and (3) are “inherently suspicious” given the timing of their submission

and Class Counsel’s involvement “outside the scope” of the Court-approved notice program. (ECF

No. 466 at 1, 9). The Court addresses each of Wawa’s arguments in turn.

A. Claims Allegedly Submitted After September 12, 2024 Claims Deadline

1. Background

First, Wawa objects to Analytics Consulting (“Analytics”), the proposed Settlement

Administrator, accepting what Wawa deems “Late-Cured Deficient Claims”: Claim 1003100, Claim

1004263, Claim 1000975, Claim 1005248, and Claim 1005504. (ECF No. 469 at 10). Upon

realizing that the relevant claimants submitted their claims without signing an attestation on the last

page of the Claim Form, Analytics issued deficiency notices to each of these claimants on October

15, 2024. (Id.). Each claimant provided a completed verification page within a few days after these

notices were mailed. (Id. at 12).

Second, Wawa objects to four “Late-Filed Claims”: Claim 1004576, Claim 1000913, Claim

1001235, and Claim 1000874. (Id.). The relevant claimants initiated their claims prior to the

deadline by entering their unique claim number and pin in the filing portal, which Analytics has

record of. (Id.). However, no further data was captured, and Analytics could not ascertain whether

these submissions failed as a result of a system error or a claimant error. (Id. at 12-13). Thus,

Analytics permitted each claimant that sought to correct the issue to do so, even though it was after

the deadline. (Id. at 13).

Third and lastly, Wawa objects to three “Late-Amended Claims”: Claim 1005075, Claim

1000181, and Claim 1002860. (Id. at 6). Claims 1005075 and 1000181 were filed by the same

claimant and, respectively, reflect Visa and Mastercard branded payment cards that were cancelled

and reissued due to the data breach. (Id. at 6-7). On August 9, 2024, the claimant contacted Class

Counsel to obtain assistance with their claims, and Class Counsel directed the claimant to Analytics.

(Id. at 7). The claimant informed Analytics that they were unsure about whether they could gather

sufficient information for the claim by August 12, 2024 (the original claims deadline), but were in

the process of confirming the card numbers involved. (Id.). Analytics advised the claimant to submit

their claims with all available information by August 12, 2024, and to email the dedicated claims

inbox with updated information. (Id.). Accordingly, the claimant submitted timely claim forms and

signed the appropriate attestations on August 12, listing one Visa card in Claim 1005075 and

100,000 MasterCard cards in Claim 1000181. On August 23, 2024, the claimant informed Analytics

via email that they had finalized their research on the number of impacted cards claims (294,112

cards for Claim 1005075 and 112,590 cards for Claim 1000181). (Id.). The claimant also asked

Analytics to advise how they could “properly amend the correct count of cards for [their] Tier 1

claim[s]” on account of the claimant’s unsuccessful attempt to update their claim forms using the

website portal. (Id.). Analytics advised the claimant that it would update Claims 1005075 and

1000181 to reflect the amended card numbers in the email. (Id.).

As to Claim 1002860, it was filed on August 5, 2024, and identified 300 impacted cards. (Id.

at 8). However, immediately after filing, the relevant claimant alerted Analytics that they entered an

incorrect number of cards on the Claim Form and were unable to correct the error with the accurate

number of cancelled and replaced cards (4,284) on the website portal. (Id.). Analytics advised the

claimant that it would update the claim to reflect this correction. (Id.).

On November 4, 2024, and November 21, 2024, Analytics asked the two claimants to

provide updated claim forms and new attestations, and both claimants promptly complied. (Id.).

2. Analysis

The Court accepts the aforementioned claims as valid, for even if they are technically

untimely, the claimants in question made a reasonable effort to submit their claims by the

September 12, 2024 deadline.

Under Federal Rule of Civil Procedure 60(b)(1), a "court may relieve a party . . . from a final

judgment, order, or proceeding . . . for the following reasons: (1) mistake, inadvertence, surprise,

or excusable neglect." A district court "has the general equitable power to modify the terms of a

class action settlement." In re Cendant Corp. Prides Litig., 233 F.3d 188, 194 (3d Cir. 2000). When

a party seeks relief for untimely claims under a settlement agreement, the Third Circuit has utilized

the "excusable neglect" standard from Rule 60. See In re Orthopedic Bone Screw Prods. Liab.

Litig., 246 F.3d 315, 321-22 (3d Cir. 2001) (stating that the "excusable neglect" standard "provides

the analysis for consideration of untimely claims for inclusion in a class action settlement"); In re

Cendant Corp. Prides Litig., 311 F.3d 298, 300 (3d Cir. 2002) (Cendant II) (applying excusable

neglect to a late-filed claim). The factors for "excusable neglect" are 1) the danger of prejudice to

the nonmovant; 2) the length of the delay and its potential effect on judicial proceedings; 3) the

reason for the delay, including whether it was within the reasonable control of the movant; and 4)

whether the movant acted in good faith. In re Orthopedic Bone Screw, 246 F.3d at 322-

23 (citing Pioneer Inv. Servs. v. Brunswick Assoc. Ltd. Partnership, 507 U.S. 380, 395 (1993)).

The Court finds that these factors collectively support accepting the claims. The evidence

shows that the claims’ deficiencies resulted from clerical oversight or technological problems, and

that once Analytics informed the relevant claimants about their deficiencies, the claimants diligently

followed instructions to remedy the problem. Moreover, not only will the Court’s acceptance of

these claims not delay the litigation, but it will not prejudice Wawa. These claims reflect a total

amount of $2,100,095,00, a figure well below the $18.5 million cap on Tier 1 claims that Wawa

committed to pay under the Settlement Agreement. (ECF No. 360-4 at 9).

B. Number of Claimed Cards versus Number of Impacted Cards

Wawa alleges that several claims seek a disproportionate number of replaced cards

compared to the number of cards reported to be involved from Visa or Mastercard, sometimes

referred to as the “Alerted On” cards. (ECF No. 466 at 13).

The Settlement Agreement establishes that, in order to make a valid Tier 1 claim, a Class

Member must attest to (1) having cancelled and replaced impacted cards and (2) the number of

impacted cards replaced in response to the data breach. (ECF No. 360-4 at 9). In line with the

Settlement Agreement’s terms, the Class Notice requires Class Members making Tier 1 claims to

identify and attest as to the total number of cancelled and replaced impacted cards on their Claim

Form, but clarifies that Class Members “are not required to provide any other documentation.” (Id.

at 36-37).

Based on the terms of the Settlement Agreement, it is clear that Tier 1 benefits are available

to any Class Member that cancelled and replaced payment cards used at Wawa during the time

period in question. Thus, the Court agrees with FI Plaintiffs that it lacks the authority to reject

claims for institutions with cancelled and replaced cards in numbers “disproportionate” to the

Alerted On cards, as such action would limit Class Members’ eligibility for Tier 1 benefits in a

manner not provided for in the Settlement. See Ehrheart v. Verizon Wireless, 609 F.3d 590, 593 (3d

Cir. 2010) ("A district court is not a party to the settlement, nor may it modify the terms of a

voluntary agreement between the parties."); Evans v. Jeff D., 475 U.S. 717, 726-27 (1986) ("[T]he

power to approve or reject a settlement negotiated by the parties before trial does not authorize the

court to require the parties to accept a settlement to which they have not agreed.").

C. Claims Allegedly Impacted by Class Counsel’s “Interference” in the Notice

Program

Wawa alleges that because Class Counsel’s August 1, 2024 Letter to Class Members was

not approved by the Court and contained language different than that contained in the Court-

approved notices, the letter therefore “risked misleading and confusing class members, a risk that

very well may have been realized given the claims spiking immediately following its release.” (ECF

No. 466 at 14-15). Wawa also alleges that, in response to the Third Circuit’s opinion in the Wawa

consumer settlement matter remanding the case to the District Court to consider the reasonableness

of the $3.2 million attorney’s fee award,4 “[Class] counsel has very clearly approached the claims

process with a new and powerful incentive to increase the claims rate and amount.” (Id. at 16).

The Court finds Wawa’s concerns with the conduct of Class Counsel to be unsubstantiated.

First, while the August 1 Letter advised class members who desire to file a Tier 1 claim to “confirm

that [their] financial institution cancelled and replaced qualifying cards,” and the Claim Form

advised class members desiring to file the same claim to “review [their] records to determine if

[their] financial institution issued” impacted cards, the Court does not view this deviation in

language to be material, for both documents accurately relay the Tier 1 claim requirements. (ECF

No. 360-4 at 48; ECF No. 466-4 at 2) (emphasis added). Second, it is not evident that Class Counsel

tried to conceal from Wawa their communications with Class Members or their desire to increase

the claims rate. To illustrate, Class Counsel jointly declared that not only did they “reach[] out

personally to hundreds of Settlement Class Members” in advance of the original claims deadline,

but that after the deadline passed and before the Court extended the deadline to September 12, they

reached out to Class Members who had not yet finalized their claim submissions due to technical

issues on the settlement website “to assist them with correcting their claim.” (ECF No. 460-3 at 22-

23). Likewise, in FI Plaintiffs’ Motion to Extend the August 12, 2024 Settlement Claims Deadline,

Class Counsel stated that because “the claims rate is lower than expected based on Settlement Class

Counsel’s experience,” they were seeking an extension of time in order “to help ensure that more

Class Members are able to recover damages from this settlement.” (ECF No. 447 at 7). Moreover,

4 In re Wawa, Inc. Data Sec. Litig., 85 F.4th 712, 725 (3d Cir. 2023).

regarding the 15.2% claims rate specifically, the Court also finds that this rate is not “unbelievable,”

as Wawa characterizes it (ECF No. 466 at 4), for it is in fact less than that of other data breach cases

involving financial institution plaintiffs. See Veridian Credit Union v. Eddie Bauer LLC, No. 2:17-

cv-00356, 2019 U.S. Dist. LEXIS 171885 (W.D. Wash. June 12, 2019), ECF No. 168 at ¶ 12

(claims rate of 36% where Analytics was Settlement Administrator); First Choice Fed. Credit

Union v. Wendy’s Co., No. 2:16-cv-00506, 2017 U.S. Dist. LEXIS 20754 (W.D. Pa. Feb. 13, 2017),

ECF No. 185-3 at ¶ 13 (claims rate of 26.8% where Analytics was Settlement Administrator).

IV. CONCLUSION

The Court denies Wawa’s Motion to Compel Claims Communications from FI Plaintiffs and,

accordingly, denies FI Plaintiffs’ Motion for Protective Order and Response in Opposition to Wawa’s

Motion as moot. An appropriate Order follows.

BY THE COURT:

/s/ Kelley B. Hodge

HODGE, KELLEY B., J.