Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

In re Sonic Corp. Customer Data Security Breach Litigation

United States District Court, N.D. Ohio

August 12, 2019


          OPINION & ORDER [RESOLVING DOCS. 151, 162]


         In 2017, not yet identified third parties stole Sonic[1] customer payment card data from more than three-hundred Sonic Drive-Ins. Consumer Plaintiffs sued Sonic, alleging that Sonic's inadequate security practices allowed the breach. The parties have now reached a settlement.

         Having previously obtained preliminary approval, Plaintiffs now move for final settlement approval, service awards, and attorneys' fees, costs, and expenses.

         For the following reasons, the Court CERTIFIES the Settlement Class, APPROVES the Settlement Agreement, and GRANTS service awards and attorneys' fees, costs, and expenses as stated in this order.

         I. Background

         In late September 2017, news outlets reported that Sonic customer payment card data had been compromised. Numerous lawsuits seeking class action status followed.

         On December 12, 2017, the Judicial Panel on Multidistrict Litigation transferred five cases to this Court. Three more cases followed shortly after.[2]

         After motion-to-dismiss briefing, an amended complaint, [3] three mediations, and extensive settlement discussions, the parties reached a settlement agreement. On October 10, 2019, Plaintiffs moved for preliminary approval of the class action settlement and for preliminary certification of the Settlement Class.[4]

         The Court denied Plaintiffs' initial motion for settlement approval because thirteen of the twenty-two proposed Settlement Class representatives were not members of the Settlement Class. Discovery evidence showed that these thirteen plaintiffs had made purchases at Sonic stores that were not actually impacted by the data theft.

         The parties then entered an amended settlement agreement (“Settlement Agreement”) and Plaintiffs again sought preliminary approval.[5] The Settlement Agreement defines the Settlement Class as all U.S. residents who made a debit or credit card purchase at one of 325 involved Sonic Drive-In locations between April 7, 2017 and October 28, 2017.[6]

         Under the Settlement Agreement, Sonic will pay $4, 325, 000 into a settlement fund. After notice costs, settlement administrator fees, service awards, attorneys' fees, costs, and expenses, the fund balances will be distributed to class members. Sonic will not object to Plaintiffs' requested attorneys' fees, up to one-third of the total fund ($1, 441, 66.67), reasonable costs and expenses ($311, 693.53), or service awards ($42, 000).

         On December 20, 2018, the Court preliminarily approved the settlement and preliminarily certified the class.[7]

         Plaintiffs now move for final settlement approval, for service awards, and for attorneys' fees, costs, and expenses.[8] The Court held a fairness hearing on July 25, 2019.[9]

         II. Discussion

         A. Standing

         While the parties do not dispute standing, considering the Supreme Court's recent decision in Frank v. Gaos, the Court briefly examines it.

         Article III standing requires: (1) an injury in fact, (2) a causal connection between the injury and the conduct complained of, and (3) that it is “likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.”[10] In class actions, the Court examines the class representatives only.

         Here, some class representatives allege that they experienced unauthorized charges on their payment cards (although each received complete reimbursement from their banks). Other representatives did not experience unauthorized charges but their banks preemptively cancelled their cards.

         The representatives allege they spent time dealing with issues related to their compromised credit or debit cards; most continue to spend time checking their accounts. Each representative also was deprived of their credit or debit card for some period, ranging from two days to over a year. This deprivation itself caused inconveniences-having to update account payment methods or use a less desired payment method, to name a couple. One representative did not replace her debit card for six months out of fear that it would happen again.

         Accepting the class representatives' allegations as true and construing them in their favor, the representatives suffered concrete and particularized injuries caused by Sonic.[11]Further, the sought monetary and injunctive relief would redress these harms. Plaintiffs have standing.

         B. Certifying the Settlement Class

         The Court first decides whether to certify the Settlement Class.[12] The Court gives “undiluted, even heightened, attention” to certification requirements when the class is for settlement purposes only.[13] Plaintiffs must show that: (i) the class is too numerous for joinder, (ii) there are legal or factual questions common to the entire class, (iii) the class representatives' claims are typical of the class, and (iv) they will adequately represent the class' interests. Further, because Plaintiffs seek Rule 23(b)(3) certification, they must show that common questions predominate over individualized ones and proceeding as a class is superior to other methods.


         Sonic estimates that there are 1.5 million Settlement Class members. The numerosity requirement is satisfied.

         Commonality & Predominance:

         Class claims satisfy commonality if they “depend upon a common contention” that “is capable of class-wide resolution-which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.”[14]

         The class members' claims arise from the same event-the Sonic data breach. And they concern the same general legal questions, including: whether Sonic was legally required to protect Plaintiffs' data, whether Sonic failed to adequately safeguard Plaintiffs' data, and whether Sonic failed to promptly notify Plaintiffs.


         Here, the class representatives' claims and those of the other class members both arise from the same data breach at the same 325 Sonic Drive-Ins. Further, they both involve the same general legal theories relating to Sonic's failure to adequately protect payment card data. As Settlement Class representatives advance their own interests, they also advance the interests of Settlement Class members.[15]

         Adequacy of Representation:

         Class representatives are adequate when they have vigorously prosecuted the interests of the class through qualified counsel.[16] “[A]dequacy of representation turns in part on the competency of class counsel and in part on the absence of conflicts of interest.”[17]

         As discussed above, the class representatives' interests align with other class members' interests. Class counsel are qualified, experienced, and generally able to conduct the litigation. Accordingly, the Court finds that the class representatives fairly and adequately protected the class interests.[18]


         “The ‘predominance inquiry tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.'”[19] The numerous common questions of fact and law that arise from Sonic's conduct predominate over any individualized issues.


         The class members' claims are too small to pursue individually. The class vehicle allows Plaintiffs to pool their claims and allows the Court to conserve resources.

         The Court finally certifies the class for settlement purposes.

         C. Notice Program

         The Court next considers whether the class received adequate notice of the settlement. Rule 23 and due process require “the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.”[20]

         In this case, because Sonic did not possess contact information for class members, direct notice was impossible. Instead, the notice program lasted ninety days and included: (1) in-store notice at the 325 Sonic Drive-Ins; (2) geographically targeted Facebook and Google internet ads; (3) notice in publications; (4) banner notice on Sonic's website and Facebook page; and (5) long-form notice on the Sonic website. The claim submission process was simple and required no supporting documentation, only a signature attesting that the information provided was true.[21]

         Plaintiffs' notice program was not perfect. One obvious flaw was the Southern Living magazine notice. Unlike the full page, easily readable, dual-column notice that Plaintiffs attached to their preliminary approval motion, the published notice had been compressed into a single, one-third page column with type so small that it greatly reduced the odds that the notice would be read.

         Plaintiffs and the KKC administrator give little useful information regarding how the notice program “reached” 74.1% of Settlement Class members. Plaintiffs simply aver that they used “advertising-industry standard reach calculations.”[22] Once again, without more, this is unhelpful.[23] The parties do not know the identities of Settlement Class members- hence the indirect notice program. And they give no information to explain how they were able to make this estimation.

         Despite these deficiencies, the Court finds that the Sonic Drive-In in-store notice, and the Sonic webpage and Facebook banner notices satisfy constitutional and Rule 23 standards.

         The in-store notice directly targeted the affected Sonic customer group. Common sense suggests that the class members likely to remember whether they made a purchase two years ago are likely to be longtime (and continuing) Sonic customers. Further, the in-store notices were well-designed and conspicuously posted on the main customer entrance door of all affected 325 locations.

         Additionally, the Sonic website and Facebook page banner were likely to reach Sonic customers, some of whom may have been Settlement Class members.[24]

         Although the claims rate was somewhat low (59, 953 timely claims out of an estimated 1.5 million class members)[25] the Court finds that the notice methods and claims rate were reasonable under the circumstances. Especially considering the challenges of eliciting class member response where notice is not individually addressed, where the recovery amount is limited, and where class members may not recall a life event as insignificant as eating at Sonic.

         Although the risk of fraud is likely higher than usual, the Court notes that the Settlement Agreement does require the Settlement Claims Administrator to perform basic verification and fraud detection measures.[26] Based on the unique features of this case, this is enough.

         D. The Settlement Is Fair, Reasonable, and Adequate

         Before approving a binding settlement, the Court must conclude that it is “fair, reasonable, and adequate.”[27] Following a December 1, 2018 amendment, Rule 23(e)(2) now instructs courts to consider certain factors when deciding whether the settlement meets this standard:

(A) the class representatives and class counsel have adequately represented the class;
(B) the proposal was negotiated at arm's length;
(C) the relief provided for the class is adequate, taking into account:
(i) the costs, risks, and delay of trial and appeal;
(ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class member claims;
(iii) the terms of any proposed award of attorney's fees, including timing of payment; and
(iv) any agreement required to be identified under Rule 23(e)(3); and
(D) the proposal treats class members equitably relative to each other.

         Before this Rule 23(e)(2) amendment, circuit courts had developed their own multi-factor inquiries. According to the 2018 Amendment's Advisory Committee Notes, so long as courts use the 23(e)(2) factors as the primary framework, courts may still consider circuit-specific factors in the analysis. In the Sixth Circuit, those factors are “(1) the risk of fraud or collusion; (2) the complexity, expense and likely duration of the litigation; (3) the amount of discovery engaged in by the parties; (4) the likelihood of success on the ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.