Sonic Agrees to a $5.73 Million Class-Action Credit Union Settlement
After nearly three years of highly-contested court battles and arduous marathon negotiations, Sonic has agreed to pay $5.73 million to settle a class-action lawsuit for one of the largest payment card data breaches in 2017 that affected at least 4,000 credit unions and banks and more than five million customers.
In March 2019, the class-action claim against Sonic Corp. was brought by the $9.3 billion American Airlines Federal Credit Union in Fort Worth, Texas, the $1.8 billion Arkansas Federal Credit Union in Little Rock and the $7.9 billion Redstone Federal Credit Union in Huntsville, Ala. The credit unions alleged that Sonic’s security deficiencies enabled hackers to breach and install card-scaping malware on point-of-sale systems at more than 700 Sonic franchised drive-ins across the nation. The hackers stole payment card data and posted five million payment cards for sale on the dark web, according to court documents.
Following three days of marathon negotiations in January and February, the credit unions and Sonic arrived at a tentative agreement on Feb. 2. Last week, U.S. District Court Judge James S. Gwin in Cleveland granted preliminary approval of the proposed settlement agreement.
