League-Supported WaWa Data Breach Settlement Advances; Proves Importance of Merchant Accountability, Interchange Fees

Last week, a federal judge granted preliminary approval for a settlement in credit unions’ years-long data security breach lawsuit against WaWa convenience stores. Your League was among the many plaintiffs to sign on to the suit in 2020 on behalf of member credit unions. In total, the settlement calls for $28.5 million for credit unions, plus $9 million in attorneys’ fees. An estimated 5,000 financial institutions were affected.

“Data breach cases like this illustrate two things. First, lawmakers need to address merchant accountability with respect to data security by imposing on merchants the same strict requirements placed on financial institutions. Second, this case proves our point about the importance of interchange fees in helping credit unions recoup some of the costs incurred as a result of merchant data breaches,” said Virginia Credit Union League President/CEO Carrie Hunt. “Data security remains a legislative priority for credit unions and an issue that we repeatedly address in meetings with federal lawmakers. It’s concerning in cases like this that credit unions must turn to the courts for relief, with that often resulting in a years-long legal battle.”

For background, hackers breached Wawa’s point-of-sale system in March 2019, installing malware on payment terminals at most of the company’s 900 convenient stores over the next nine months. The information that was compromised included credit and debit card numbers, their expiration dates and cardholder names.

Your League joined lawsuits to secure monetary relief for credit unions following a number of data breaches, including two successful suits against Home Depot and Equifax. The Credit Union National Association and state leagues also participated in a successful suit against Wendy’s restaurants.