Arby’s Serves Up $2M Data Breach Deal

By Ben Kochman

Law360 (May 8, 2019, 6:58 PM EDT) – A class of Arby’s consumers that sued the fast-food chain after a three-month-long data breach asked a Georgia federal court Tuesday to give final approval to a settlement that would set aside up to $2 million for breach victims.

Arby’s customers who visited the eatery between Oct. 8, 2016, and Jan. 12, 2017, and who can document having suffered a fraudulent charge or cancellation of their payment card would be eligible for reimbursement, according to the agreed-upon terms of the deal, which won preliminary approval in November 2018. Breach victims would also get free identity theft protection service from Experian for two years.

As part of the settlement, Arby’s has also already taken several measures to bolster its payment card security, including designating someone within the company responsible for information security and creating a new written IT security policy, court papers state. Counsel for the consumer class and lead plaintiffs Jacqueline Weiss and Joseph Weiss asked the court to approve $980,000 in attorney fees, plus “reasonable costs and expenses” of $35,000 and a $4,500 incentive reward for each plaintiff.

The complaint, filed in March 2017, alleged that the restaurant chain’s failure to take steps to properly protect customer data culminated in its systems being exposed to malware, allowing hackers to access the credit and debit card information of patrons at just under 1,000 corporate-owned locations.

Arby’s should have known it was at risk, considering the massive data breaches that have affected the restaurant industry in recent years, including other national chains like Wendy’s and P.F. Chang’s, the consumers said in their complaint. The suit alleged a breach of implied contract and negligence, and that Arby’s breached state consumer protection laws.

Before coming to terms on a deal, Arby’s had asked the court to toss the suit, arguing that it has no duty to safeguard payment card data from the criminal acts of third parties.

Representatives for Arby’s and the Weisses did not immediately respond Wednesday to requests for comment.

The consumers are represented by James M. Evangelista and David J. Worley of Evangelista Worley LLC, Stuart J. Guber, Timothy J. Peter and Robert W. Killorin of Faruqi & Faruqi LLP, and J. Cameron Tribble, Roy E. Barnes and John R. Bevis of Barnes Law Group.

Arby’s is represented by Robert B. Remar of Rogers & Hardin LLP, Mark P. Szpak of Ropes & Gray LLP and Doug Meal of Orrick Herrington & Sutcliffe LLP.

The suit is Jacqueline Weiss and Joseph Weiss v. Arby’s Restaurant Group Inc., case number 1:17-cv-01035, in the U.S. District Court for the Northern District of Georgia.

–Additional reporting by Shayna Posses and Joyce Hanson. Editing by Peter Rozovsky.