IN THE UNITED STATES DISTRICT COURT FOR THE ......2019/02/26 · Civil No. 2:16-cv-00506-NBF-MPK MEMORANDUM OF LAW IN SUPPORT OF PLAINTIFFS’ UNOPPOSED MOTION FOR PRELIMINARY APPROVAL

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA

FIRST CHOICE FEDERAL CREDIT UNION, AOD FEDERAL CREDIT UNION, TECH CREDIT UNION, VERIDIAN CREDIT UNION, SOUTH FLORIDA EDUCATIONAL FEDERAL CREDIT UNION, PREFERRED CREDIT UNION, ALCOA COMMUNITY FEDERAL CREDIT UNION, ASSOCIATED CREDIT UNION, CENTRUE BANK, ENVISTA CREDIT UNION, FIRST NBC BANK, NAVIGATOR CREDIT UNION, THE SEYMOUR BANK, FINANCIAL HORIZONS CREDIT UNION, NUSENDA CREDIT UNION, GREATER CINCINNATI CREDIT UNION, KEMBA FINANCIAL CREDIT UNION, WRIGHT-PATT CREDIT UNION, and MEMBERS CHOICE CREDIT UNION, on Behalf of Themselves and All Others Similarly Situated,

and

CREDIT UNION NATIONAL ASSOCIATION, GEORGIA CREDIT UNION AFFILIATES, INDIANA CREDIT UNION LEAGUE, MICHIGAN CREDIT UNION LEAGUE, and OHIO CREDIT UNION LEAGUE,

Plaintiffs,

v.

THE WENDY’S COMPANY, WENDY’S RESTAURANTS, LLC, and WENDY’S INTERNATIONAL, LLC,

Defendants.

Civil No. 2:16-cv-00506-NBF-MPK

MEMORANDUM OF LAW IN SUPPORT OF PLAINTIFFS’ UNOPPOSED MOTION FOR PRELIMINARY APPROVAL OF CLASS ACTION SETTLEMENT

Case 2:16-cv-00506-MPK Document 176 Filed 02/13/19 Page 1 of 43

i

TABLE OF CONTENTS

I. BACKGROUND .................................................................................................................2

A. The Data Breach and Early Litigation Stages ..........................................................2

B. Discovery, Further Motion Practice, and Settlement Discussions ...........................4

II. PROVISIONS OF THE SETTLEMENT AGREEMENT ...................................................5

A. The Settlement Class................................................................................................5

B. The Direct Benefits to the Settlement Class ............................................................6

1. The $50 Million Settlement Fund ................................................................6

2. Additional Security Measures ......................................................................7

C. Releases....................................................................................................................8

D. Proposed Notice Program ........................................................................................8

E. Attorneys’ Fees, Costs, and Expenses ...................................................................11

F. Service Awards ......................................................................................................11

III. THE PROPOSED SETTLEMENT IS FAIR, REASONABLE, AND ADEQUATE ......................................................................................................................12

A. Standard for Preliminary Approval of the Settlement ...........................................12

B. The Adequacy of Class Counsel and Settlement Class Representatives Supports Preliminary Approval .............................................................................14

C. The Negotiation Process Supports Preliminary Approval .....................................15

D. The Adequacy of the Settlement Benefits in Light of the Risks of Continued Litigation Supports Preliminary Approval.............................................................16

1. The Relief Provided to the Settlement Class Is Substantial .......................16

2. The Risks of Continued Litigation Are Significant ...................................18

3. The Proposed Method of Distributing Relief to the Settlement Class Is Effective .................................................................................................20

4. Class Counsel’s Request for Attorneys’ Fees, Expenses, and Costs Will Be Subject to Approval by the Court .................................................21


ii

E. That Settlement Class Members Are Treated Equitably Relative to Each Other Supports Preliminary Approval ...................................................................22

IV. THE SETTLEMENT CLASS SHOULD BE CERTIFIED ...............................................22

A. Ascertainability ......................................................................................................23

B. Rule 23(a) Requirements .......................................................................................24

1. Numerosity .................................................................................................24

2. Commonality..............................................................................................25

3. Typicality ...................................................................................................26

4. Adequacy ...................................................................................................27

C. Rule 23(b) Requirements .......................................................................................27

1. Predominance .............................................................................................28

2. Superiority..................................................................................................29

V. THE PROPOSED NOTICE PROGRAM SATISFIES RULE 23 AND DUE PROCESS AND SHOULD BE APPROVED ...................................................................31

A. The Scope of the Proposed Notice Program Is Adequate ......................................31

B. The Form and Content of the Proposed Notices Is Adequate ................................32

C. The Proposed Claim Form Is Adequate .................................................................33

D. The Settlement Administrator Is Adequate ............................................................33

VI. CO-LEAD COUNSEL SHOULD BE APPOINTED AS CLASS COUNSEL .................34

VII. CONCLUSION ..................................................................................................................34


iii

TABLE OF AUTHORITIES

PAGE(S)

CASES

In re Am. Invs. Life Ins. Co. Annuity Mktg. & Sales Practices Litig., 263 F.R.D. 226 (E.D. Pa. 2009) ...............................................................................................14

Amchem Prods., Inc. v. Windsor, 521 U.S. 591 (1997) ...........................................................................................................23, 31

AOD Fed. Credit Union v. The Wendy’s Co., No. 2:16-cv-00900 (W.D. Pa.) ...................................................................................................3

In re Asbestos Sch. Litig., 104 F.R.D. 422 (E.D. Pa. 1984), aff’d in part and rev’d in part sub nom. In re Sch. Abestos Litig., 789 F.2d 996 (3d Cir. 1986) ............................................................25

In re Auto. Refinishing Paint Antitrust Litig., MDL No. 1426, 2003 WL 23316645 (E.D. Pa. Sept. 5, 2003) ...............................................15

In re Auto. Refinishing Paint Antitrust Litig., MDL No. 1426, 2004 WL 1068807 (E.D. Pa. May 11, 2004) ................................................12

Baby Neal for and by Kanter v. Casey, 43 F.3d 48 (3rd Cir. 1994) .................................................................................................25, 28

Byrd v. Aaron’s Inc., 784 F.3d 154 (3d Cir. 2015)...............................................................................................23, 24

In re CertainTeed Corp. Roofing Shingle Prods. Liab. Litig., 269 F.R.D. 468 (E.D. Pa. 2010) .........................................................................................19, 23

In re Chambers Dev. Sec. Litig., 912 F. Supp. 822 (W.D. Pa. 1995) .....................................................................................20, 33

Cmty. Bank of Trenton v. Schnuck Mkts., Inc., 887 F.3d 803 (7th Cir. 2018) ...................................................................................................19

Comcast Corp. v. Behrend, 569 U.S. 27 (2013) ...................................................................................................................29

Cumberland Farms, Inc. v. Browning-Ferris Indus., Inc., 120 F.R.D. 642 (E.D. Pa. 1988) .........................................................................................25, 26

Fisher v. Va. Elec. & Power Co., 217 F.R.D. 201 (E.D. Va. 2003) ..............................................................................................28


iv

In re Flat Glass Antitrust Litig., 191 F.R.D. 472 (W.D. Pa. 1999) .......................................................................................24, 25

Gates v. Rohm & Haas Co., 248 F.R.D. 434 (E.D. Pa. 2008) ...................................................................................12, 14, 23

In re Gen. Instruments Sec. Litig., 209 F. Supp. 2d 423 (E.D. Pa. 2001) .......................................................................................20

In re Gen. Motors Corp. Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768 (3d Cir. 1995).................................................................................................14, 23

Girsh v. Jepson, 521 F.2d 153 (3d Cir. 1975)...............................................................................................13, 14

Hayes v. Wal-Mart Stores, Inc., 725 F.3d 349 (3d Cir. 2013).....................................................................................................28

In re Home Depot Customer Data Sec. Breach Litig., No. 1:14-md-02583 (N.D. Ga.) ....................................................................................16, 17, 23

In re Ins. Brokerage Antitrust Litig., 297 F.R.D. 136 (D.N.J. 2013) ..................................................................................................12

In re Linerboard Antitrust Litig., 292 F. Supp. 2d 631 (E.D. Pa. 2003) .................................................................................12, 15

In re Mid-Atl. Toyota Antitrust Litig., 564 F. Supp. 1379 (D. Md. 1983) ............................................................................................12

Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306 (1950) .................................................................................................................31

In re Nat’l Football League Players’ Concussion Injury Litig., 301 F.R.D. 191 (E.D. Pa. 2014), final approval aff’d, 821 F.3d 410 (3d. Cir. 2016)....................................................................................................13

O’Keefe v. Mercedes-Benz USA, LLC, 214 F.R.D. 266 (E.D. Pa. 2003) ...............................................................................................28

In re Orthopedic Bone Screw Prods. Liab. Litig., 176 F.R.D. 158 (E.D. Pa. 1997) ...............................................................................................15

Petruzzi’s, Inc. v. Darling-Del. Co., Inc., 880 F. Supp. 292 (M.D. Pa. 1995) ...........................................................................................20

In re Processed Egg Prods. Antitrust Litig., 284 F.R.D. 249 (E.D. Pa. 2012) ...............................................................................................19


v

In re Prudential Ins. Co. Am. Sales Practice Litig. Agent Actions, 148 F.3d 283 (3d Cir. 1998)...............................................................................................26, 30

In re Prudential Ins. Co. of Am. Sales Practices Litig., 177 F.R.D. 216 (D.N.J. 1997) ..................................................................................................32

In re Prudential Ins. Co. of Am. Sales Practices Litig., 962 F. Supp. 450 (D.N.J. 1997) ...................................................................................12, 13, 33

In re Remeron End-Payor Antitrust Litig., No. Civ. 02-2007 FSH, 2005 WL 2230314 (D.N.J. Sept. 13, 2005) .......................................20

Rodriguez v. McKinney, 156 F.R.D. 118 (E.D. Pa. 1994) ...............................................................................................28

S. Fla. Educ. Fed. Credit Union v. The Wendy’s Co., No. 2:16-cv-00873 (W.D. Pa.) ...................................................................................................3

Sala v. Nat’l R.R. Passenger Corp., 120 F.R.D. 494 (E.D. Pa. 1988) ...............................................................................................28

Seidman v. Am. Mobile Sys., Inc., 157 F.R.D. 354 (E.D. Pa. 1994) ...................................................................................24, 26, 27

Silvis v. Ambit Energy L.P, No. 14-5005, 2018 WL 1010812 (E.D. Pa. Feb. 22, 2018) .....................................................14

Stewart v. Abraham, 275 F.3d 220 (3d Cir. 2001).....................................................................................................25

Stewart v. Rubin, 948 F. Supp. 1077 (D.D.C. 1996), aff’d, 124 F.3d 1309 (D.C. Cir. 1997) ...............................................................................................20

Taha v. Cty. of Bucks, 862 F.3d 292 (3d Cir. 2017).....................................................................................................28

In re Target Corp. Customer Data Sec. Breach Litig., 309 F.R.D. 482 (D. Minn. 2005)........................................................................................23, 29

In re Target Customer Data Sec. Breach Litig., No. 0:14-md-02522 (D. Minn.)..........................................................................................16, 17

Tech Credit Union v. The Wendy’s Co., No. 2:16-cv-00854 (W.D. Pa.) ...................................................................................................3

In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389 (D. Mass. 2007) ..............................................................................................19


vi

Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036 (2016) .............................................................................................................29

Veridian Credit Union v. The Wendy’s Co., No. 2:16-cv-00831 (W.D. Pa.) ...................................................................................................3

Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541 (2011) .............................................................................................................25

In re Warfarin Sodium Antitrust Litig., 391 F.3d 516 (3d Cir. 2004).........................................................................................13, 23, 30

Winsouth Credit Union v. Mapco Express, Inc., No. 3:14-cv-01573 (M.D. Tenn.) .............................................................................................23

STATUTES, RULES & REGULATIONS

FEDERAL RULES OF PROCEDURE

Rule 23(a)(1)-(4) ......................................................................................................................24 Rule 23(b)(3)(A)-(D) ...............................................................................................................30 Rule 23(c)(2) ............................................................................................................................32 Rule 23(c)(2)(B)(i)-(vii)...........................................................................................................33 Rule 23(e)(1)-(2) ......................................................................................................................12 Rule 23(e)(1)(B).......................................................................................................................12 Rule 23(e)(2)(A)-(D) ...............................................................................................................13 Rule 23(e)(2)(C)(i)-(iii) ...........................................................................................................16 Rule 23(e)(2)(C)(iv) .................................................................................................................16 Rule 23(g)(1)(A)(i)-(iv) ...........................................................................................................34

OTHER AUTHORITIES

Visa Global Compromised Account Recovery Program: What Every Merchant Should Know About GCAR, VISA (2013) ..........................................................................17, 18

W. Rubenstein, NEWBERG ON CLASS ACTIONS §4:54, 206-08 (5th ed. 2012) ...............................28


1

Pursuant to Rule 23(e) of the Federal Rules of Civil Procedure, the Financial Institution

Plaintiffs 1 and Association Plaintiffs (collectively, “Plaintiffs”) respectfully submit this

memorandum of law in support of their unopposed motion for preliminary approval of a class

action settlement (the “Motion”). The proposed Settlement Agreement between Plaintiffs and

Defendants The Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC

(collectively, “Wendy’s” or “Defendants”) was reached after two-and-a-half years of litigation and

discovery and three rounds of mediation.

Under the Settlement, Wendy’s will pay $50 million into a non-reversionary fund in

exchange for a release of all claims against Wendy’s Franchisees arising from third-party criminal

cyberattacks of certain of Wendy’s independently owned and operated franchisee restaurants

involving malware variants targeting customers’ payment card information that Wendy’s reported

in 2016 (the “Data Breach”). Wendy’s also will adopt or maintain certain reasonable safeguards

to manage its data security risks. If approved, the Settlement will resolve all pending claims in

these consolidated actions and provide monetary relief to a nationwide class of payment-card-

issuing financial institutions. The Settlement is an excellent result in a complex, high-risk, hard-

fought case that provides a substantial financial recovery for payment card issuers that suffered

losses as a result of the Data Breach.

Plaintiffs have moved for an order to, among other things: (1) preliminarily approve the

terms of the Settlement as fair, reasonable, and adequate; (2) provisionally certify the Settlement

Class pursuant to Fed. R. Civ. P. 23(b)(3) and (e) for settlement purposes only; and (3) approve

the Settlement Administrator, Notice Program, form and content of the Notice, and Claim Form.

1 All capitalized terms not defined herein have the same meaning as those defined in the Settlement Agreement and Release (“Settlement” or “Settlement Agreement” or “SA”) attached hereto as Ex. A.


2

Plaintiffs request that the Motion, which Wendy’s does not oppose, be granted. The Settlement

meets all of the standards for preliminary approval. The information provided is sufficient to

permit the Court to provisionally certify the Settlement Class under Rule 23 and direct Plaintiffs

to have notice disseminated. And, the Notice Program – consisting of individualized mailed

notice, publication notice, and a toll-free number and website maintained by the Settlement

Administrator – is the best practicable notice and comports with both Rule 23 and due process.

In support of their Motion, Plaintiffs submit the proposed Settlement Agreement and its

attachments (attached hereto as Ex. A); Declaration of Gary F. Lynch (“Lynch Decl.”); Declaration

of Richard W. Simmons (“Simmons Decl.”); a proposed Preliminary Approval Order (SA Ex. 4);

and proposed Final Approval Order and Judgment (SA Ex. 5).

I. BACKGROUND

A. The Data Breach and Early Litigation Stages

Plaintiffs allege that, beginning in October 2015, computer hackers installed malware on

the point-of-sale (“POS”) systems of certain of Wendy’s independently owned and operated

franchised restaurants for the purposes of capturing and ex-filtrating customer payment card data.

¶¶2, 62.2 According to the Complaint, the Data Breach involved two malware variants deployed

against two types of POS systems in use at the time, and over a period of several months, more

than 1,000 Wendy’s franchise locations were affected. ¶¶62, 71-72, 77. Based on discovery

developed in the Litigation, Plaintiffs estimate that approximately 18 million payment cards were

exposed in the Data Breach. Lynch Decl. ¶14. As the Complaint states, a substantial amount of

the exposed payment card data was sold on the black market and then used to facilitate fraudulent

transactions at the ultimate expense of Financial Institution Plaintiffs and Settlement Class

2 All “¶” and “¶¶” references are to the Complaint, unless otherwise indicated.


3

Members. ¶¶2, 10, 78, 146-47. Plaintiffs allege financial institutions were forced to cancel and

reissue the compromised payment cards to mitigate the damage, reimburse their customers for

fraudulent transactions, and otherwise incur substantial out of pocket expenses in responding to

the Data Breach. Id. On February 9, 2016, Wendy’s first publicly disclosed that malware had

been detected at some of its restaurants. Subsequent public statements by Wendy’s in May, June,

and July 2016 gradually revealed the full size and scope of the Data Breach.

On April 25, 2016, Plaintiff First Choice Federal Credit Union filed an action against

Wendy’s in the U.S. District Court for the Western District of Pennsylvania (the “Western

District”). (ECF No. 1). Thereafter, a number of additional actions were filed by financial

institutions against Wendy’s in the Western District. See Veridian Credit Union v. The Wendy’s

Co., No. 2:16-cv-00831 (W.D. Pa. June 15, 2016) (ECF No. 1); Tech Credit Union v. The Wendy’s

Co., No. 2:16-cv-00854 (W.D. Pa. June 16, 2016) (ECF No. 1); S. Fla. Educ. Fed. Credit Union

v. The Wendy’s Co., No. 2:16-cv-00873 (W.D. Pa. June 17, 2016) (ECF No. 1); AOD Fed. Credit

Union v. The Wendy’s Co., No. 2:16-cv-00900 (W.D. Pa. June 20, 2016). By orders dated July

12, 2016, these actions were consolidated (ECF No. 20) and the Court appointed Erin Green

Comite of Scott+Scott Attorneys at Law LLP (“Scott+Scott”) and Gary F. Lynch of Carlson Lynch

Sweet Kilpela & Carpenter, LLP (“Carlson Lynch”) as interim co-lead class counsel (“Co-Lead

Counsel”). (ECF No. 21).

On July 22, 2016, Plaintiffs filed the operative Complaint, asserting claims for negligence,

negligence per se, violation of the Ohio Deceptive Trade Practices Act (“ODTPA”), Ohio Code

§§ 4165.01, et seq., and declaratory and injunctive relief. (ECF No. 32). On August 22, 2016,

Wendy’s moved to dismiss the Complaint (the “Motion to Dismiss”). (ECF No. 53). On February

13, 2017, Chief Magistrate Judge Kelly issued a Report and Recommendation, recommending that


4

the Court deny the Motion to Dismiss. (ECF No. 80). On March 31, 2017, the Court adopted the

Report and Recommendation and denied Wendy’s Motion to Dismiss. (ECF No. 88).

B. Discovery, Further Motion Practice, and Settlement Discussions

After the Motion to Dismiss was denied, the Parties engaged in significant discovery and

motion practice. Lynch Decl. ¶¶9-10; SA ¶E. In particular, Plaintiffs served Wendy’s with

document requests, and Wendy’s produced millions of pages of documents, which Plaintiffs

reviewed. Id. Plaintiffs also deposed Wendy’s corporate representative, pursuant to Fed. R. Civ.

P. 30(b)(6). Id. Additionally, Plaintiffs obtained and reviewed thousands of pages of documents

from numerous third parties in response to subpoenas Plaintiffs served, including subpoenas served

on the major card brands. Id.

Wendy’s served the Financial Institution Plaintiffs with document requests, to which the

Financial Institution Plaintiffs responded with the production of thousands pages of responsive

documents. Lynch Decl. ¶9; SA ¶F. Wendy’s also deposed 16 corporate witnesses for 15 of the

Financial Institution Plaintiffs with knowledge of facts relating to the Financial Institution

Plaintiffs’ response to the Data Breach, designated pursuant to Fed. R. Civ. P. 30(b)(6). Id.

On January 19, 2018, Plaintiffs filed a motion seeking to apply Ohio law to Plaintiffs’

claims on a nationwide basis (ECF No. 131), which Wendy’s opposed. (ECF No. 139). On May

9, 2018, Chief Magistrate Judge Kelly issued a Report and Recommendation, recommending that

the Court grant the Motion for Application of Ohio Law, as to the negligence and negligence per

se claims, and deny it as to the ODTPA claim to the extent any Financial Institution Plaintiffs not

located in Ohio sought to assert that claim. (ECF No. 147 at 14). District Judge Nora Barry Fischer

adopted the Report and Recommendation on June 6, 2018 (ECF No. 152), and shortly thereafter,

the Parties were ordered to conduct another alternative dispute resolution process. (ECF No. 153).


5

On August 27, 2018, Wendy’s filed a Motion for Judgment on the Pleadings (the “MJP”),

seeking dismissal of Plaintiffs’ claims for negligence and negligence per se on the grounds that

they fail under Ohio law. (ECF No. 163). Plaintiffs have not responded to the MJP, as the Court

extended the deadline for doing so in light of the mediation and settlement efforts. (See, e.g., ECF

No. 171).

This Settlement resulted from good faith, arm’s-length settlement negotiations, including

one full-day mediation before then-retired Honorable Edward Infante, on May 15, 2017, in San

Francisco, California,3 and two full-day mediation sessions before the Honorable Diane M. Welsh

(Ret.), on August 29, 2018 and November 16, 2018, in Philadelphia, Pennsylvania. Lynch Decl.

¶10; SA ¶I. Two representatives of the Financial Institution Plaintiffs, Susan Bradley of Plaintiff

Members Choice Credit Union and Greg Slessor of Plaintiff Veridian Credit Union, attended the

August 29, 2018 mediation. Lynch Decl. ¶11. In support of their mediation positions, the Parties

drafted detailed mediation briefs that explored the strengths and weaknesses of each side’s case,

including issues of liability, class certification, and proof of damages, and attached numerous

exhibits. Id. The Parties also participated in numerous direct discussions about possible resolution

of the Litigation. Id.; SA ¶I. The Parties did not discuss attorneys’ fees, costs, and expenses or

Service Awards prior to agreeing to the essential terms of the Settlement. Lynch Decl. ¶12; SA

¶I.

II. PROVISIONS OF THE SETTLEMENT AGREEMENT

A. The Settlement Class

For settlement purposes only, the Parties agree that the Court should certify the following

“Settlement Class” under Fed. R. Civ. P. 23(b)(3), defined as:

3 Judge Infante resumed his position on the federal bench as a U.S. Magistrate Judge for the Central District of California before the Parties’ second mediation could be scheduled.


6

All banks, credit unions, financial institutions, and other entities in the United States (including its Territories and the District of Columbia) that issued Alerted on Payment Cards. Excluded from the Settlement Class is the judge presiding over this matter and any members of her judicial staff, Wendy’s, and persons who timely and validly request exclusion from the Settlement Class.

SA ¶38. The term “Alerted on Payment Card” means any payment card (including debit or credit

cards) that was identified as having been at risk as a result of the Data Breach in an alert or

similar document by Visa, MasterCard, Discover, American Express, or JCB. SA ¶1. Based on

discovery, there are approximately 18 million Alerted on Cards. Lynch Decl. ¶14.

B. The Direct Benefits to the Settlement Class

1. The $50 Million Settlement Fund

Under the Settlement Agreement, Wendy’s will create a non-reversionary, interest-bearing

Settlement Fund of $50 million. SA ¶40. The Settlement Fund will be used to pay:

(1) disbursements to Settlement Class Members that file Approved Claims in accordance with the

Distribution Plan (described below); (2) the Costs of Settlement Administration and any taxes due

on the Settlement Fund; (3) attorneys’ fees, costs, and expenses to Class Counsel in amounts

approved by the Court; and (4) Service Awards in amounts approved by the Court. SA ¶¶40,

40(b).

Under the Distribution Plan (SA Ex. 1) that governs payments from the Settlement Fund,

Settlement Class Members that file an Approved Claim will receive a Cash Payment Award per

Claimed-On Card without having to submit documentation or prove their losses.4 SA ¶40(b); SA

Ex. 1 ¶¶2, 2.1. The amount of the cash payment will depend on the total number of eligible

payment cards submitted by Settlement Class Members, the Costs of Settlement Administration,

4 The term “Claimed-On Card” means an Alerted on Payment Card that was issued by a Settlement Class Member and for which the Settlement Class Member seeks compensation under the Settlement. SA Ex. 1 ¶1.2.


7

taxes paid on the Settlement Fund, and the amount of attorneys’ fees, costs, and expenses and

Service Awards approved by the Court. SA ¶40(b); SA Ex. 1 ¶4.2. By way of example, if valid

claims are submitted for all eligible cards, it is estimated that Settlement Class Members could

receive approximately $2.00 per Alerted on Payment Card. Lynch Decl. ¶14. If, for example,

40% of Alerted on Payment Cards are submitted in Approved Claims, then Settlement Class

Members could receive approximately $4.80 per Alerted on Payment Card. Id.

Settlement Class Members have 180 days after the Notice Deadline to submit a Claim

Form. The Claim Form (SA Ex. 1, Attachment A), is designed to be simple and straightforward;

Settlement Class Members will not be required to provide documentation of their losses beyond

identification of the number of Alerted on Payment Cards. SA ¶¶5-6; SA Ex. 1 ¶2.2.

The Parties intend and expect that the entire Settlement Fund will be distributed pursuant

to the Distribution Plan through the Claims Administration process. Nonetheless, to the extent

any funds remain after the Claims Administration process is completed, no portion of the

Settlement Fund will be returned to Wendy’s. SA ¶40(b). To the extent there are any remaining

funds, however, those funds will be distributed pro rata to Settlement Class Members, if

administratively feasible, and otherwise to cy pres entities that will be selected by Class Counsel

and approved by the Court. SA Ex. 1 ¶4.3.

2. Additional Security Measures

If the Settlement is approved, Wendy’s will, within 30 days of the issuance of the Final

Approval Order and Judgment, and subject to Board approval, adopt and/or maintain the following

measures with respect to Company-owned U.S. restaurants and systems as follows:

a. Wendy’s will continue to design and implement reasonable safeguards to manage its data security risks, including by: continuing to maintain and periodically re-evaluate its Information Security Policy and Incident Response Plan or similar document; continuing to maintain monitoring for indicators of compromise on Wendy’s computer network endpoints, to the extent required by Payment Card Industry Data Security


8

Standards (“PCI DSS”); continuing to deploy anti-virus protections on Wendy’s-owned store-based IT assets, to the extent required by PCI DSS; continuing to reasonably segment Wendy’s network topology; and continuing to conduct regular penetration testing;

b. Wendy’s will either: (a) continue to maintain Wendy’s Technology, LLC (“WeTech”) or a similar entity, which will offer to Wendy’s Franchisees certain Foundational Security Services, as may be amended from time-to-time in the WeTech Products and Services Agreement or any similar document; or (b) require Wendy’s Franchisees to use a Wendy’s-approved third-party vendor(s) for similar services; and

c. Wendy’s will continue to maintain and update, as needed, the information security standards in its Franchisee Operations Manual or a similar document that is distributed to Wendy’s Franchisees, and the manual or other similar document will continue to include information regarding the Wendy’s Franchisees’ independent obligations to comply with PCI DSS pursuant to the card brand rules.

SA ¶41(a)-(c). Wendy’s will materially maintain these additional security measures for at least

two years following the Effective Date, subject to certain limited exceptions. SA ¶42.

C. Releases

Plaintiffs, Settlement Class Members who do not opt out, and related persons and entities

(e.g., parents, subsidiaries, and counsel) will, if the Settlement is approved and effectuated, release

Wendy’s and related persons and entities from claims relating to issues in this Litigation. SA

¶¶62-63, 65. In turn, Wendy’s and their affiliated persons and entities will also release any

potential claims or counterclaims against Plaintiffs, Settlement Class Members, and their affiliated

entities relating to the institution, prosecution, or settlement of the Litigation. SA ¶64.

D. Proposed Notice Program

Subject to the Court’s approval, the Parties propose to individually notify each Settlement

Class Member through U.S. Mail and to have the Settlement Administrator establish a toll-free

number and Settlement Website to provide information about the Settlement. SA ¶49; Simmons

Decl. ¶¶14-19. Settlement Class Members will be able to file claims both electronically and by

mail. SA ¶¶35, 49(f). Publication notice through digital media also will be utilized. SA ¶49(c).


9

During the claims period, Settlement Class Members that have not filed claims will receive a post-

card reminder notice. SA ¶49(d).

Mail Notice

For purposes of effectuating individualized Mail Notice, Class Counsel have arranged for

Visa and MasterCard to submit to the Settlement Administrator the legal address of the financial

institutions that issued an Alerted on Payment Card. Lynch Decl. ¶16. Class Counsel also will

provide relevant contact information to the Settlement Administrator for financial institutions that

issued American Express, Discover, and JCB Alerted on Payment Cards. Id. The Settlement

Administrator will use this data, along with other reasonably available sources, to compile a final

list of potential Settlement Class Members to which Mail Notice will be issued. SA ¶¶49(a)-(b);

Simmons Decl. ¶13.

For any Mail Notices that are returned undeliverable with forwarding address information,

the Settlement Administrator shall re-mail the Mail Notice to the updated address as indicated. SA

¶49(b); Simmons Decl. ¶15. For any Mail Notices that are returned undeliverable without

forwarding address information, the Settlement Administrator shall use reasonable efforts to

identify updated mailing addresses (such as running the mailing address through the National

Change of Address Database) and re-mail the Mail Notice to the extent updated addresses are

identified. SA ¶49(b); Simmons Decl. ¶15. The Settlement Administrator need only make one

attempt to re-mail any Mail Notices that are returned as undeliverable. SA ¶49(b). However,

during the claims period, Settlement Class Members that have not filed claims will receive a post-

card reminder. SA ¶49(d).

Mail Notice will consist of the Long-Form Notice, as well as the Claim Form. The Long-

Form Notice (SA Ex. 2) includes a description of the material terms of the Settlement; a date by

which Settlement Class Members may object to or opt out of the Settlement; the date upon which


10

the Final Approval Hearing will occur; and the address of the Settlement Website at which

Settlement Class Members can submit a Claim Form and access the Settlement Agreement and

other related documents and information.

The Claim Form (SA Ex. 1, Attachment A) clearly informs the Settlement Class Members

of the process they must follow. It is only two pages long and requires Settlement Class Members

to provide very basic information: the name of the financial institution; the person filing out the

form; the financial institution’s contact information; and the number and brands of Alerted on

Payment Cards. This information will be easy for financial institution employees to locate and

provide. A substantially similar form will appear on the Settlement Website for purposes of

electronically submitting a claim.

Publication Notice

The Settlement Administrator will cause the proposed Summary Notice to be published in

digital publications typically read by bank and credit union executives, such as the ABA Banking

Journal, in the form depicted in SA Ex. 3. SA ¶49(c); Simmons Decl. ¶16.

Settlement Website and Telephone Support

The Settlement Administrator also will establish the Settlement Website, which will

contain all the information included in the other forms of notice and will provide links to pertinent

case documents. SA ¶¶35, 45, 46(c); Simmons Decl. ¶¶18-19. The Settlement Website will permit

Settlement Class Members to file claims electronically and will allow Settlement Class Members

to submit questions regarding the Settlement to customer support personnel. SA ¶35; Simmons

Decl. ¶¶20-21. The Settlement Administrator also will establish a toll-free number Settlement

Class Members can call for information about the Settlement. SA ¶¶45, 45(d), 49(b); Simmons

Decl. ¶17. Settlement Class Members will have the option to receive automated information or to

speak with a live operator. SA ¶45(d); Simmons Decl. ¶17.


11

Opt-Out and Objection Deadlines

All forms of notice: (1) explain the procedure by which a Settlement Class Member can

exclude itself from the Settlement prior to the Opt-Out Deadline (SA ¶50); and (2) explain the

procedure for a Settlement Class Member to object to the Settlement or Class Counsel’s

applications for awards of attorneys’ fees, expenses, or Service Awards to Settlement Class

Representatives prior to the Objection Deadline. SA ¶52. The Opt-Out and Objection Deadlines

are 60 days after the Notice Deadline. SA ¶¶21-22.

E. Attorneys’ Fees, Costs, and Expenses

Under the Settlement Agreement, Class Counsel will request 30% of the gross Settlement

Fund, including any interest earned thereon, from the Court for their attorneys’ fees and will

additionally request reimbursement of their reasonable costs and expenses from the Settlement

Fund. SA ¶67. Wendy’s agrees not to oppose Class Counsel’s request for attorneys’ fees and

reimbursement of reasonable costs and expenses to be paid from the Settlement Fund. Id.

F. Service Awards

Class Counsel will ask the Court to approve, and Wendy’s will not oppose, Service Awards

of $7,500 to each of the 15 Financial Institution Plaintiffs that were deposed and $2,500 to each of

the three Financial Institution Plaintiffs that served as named-Plaintiffs in the Litigation, but were

not deposed, or a total of $120,000, to compensate them their efforts in the Litigation and

commitment on behalf of the Settlement Class. SA ¶66. Any Service Awards approved by the

Court will be paid from the Settlement Fund. Id. Neither Class Counsel’s application for nor any

individual’s entitlement to a Service Award was conditioned in any way upon a Plaintiff’s support

for the Settlement Agreement. Id.; Lynch Decl. ¶12.


12

III. THE PROPOSED SETTLEMENT IS FAIR, REASONABLE, AND ADEQUATE

A. Standard for Preliminary Approval of the Settlement

“[S]ettlement of litigation is especially favored by courts in the class action setting.” In re

Ins. Brokerage Antitrust Litig., 297 F.R.D. 136, 144 (D.N.J. 2013) (citing In re Gen. Motors Corp.

Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 784 (3d Cir. 1995)). The procedure for

review of a proposed class action settlement is a well-established two-step process – preliminary

and final approval – that was recently codified under amended Rule 23(e). Fed. R. Civ. P. 23(e)(1)-

(2) (eff. Dec. 1, 2018); see also Gates v. Rohm & Haas Co., 248 F.R.D. 434, 438-39 (E.D. Pa.

2008); In re Auto. Refinishing Paint Antitrust Litig., MDL No. 1426, 2004 WL 1068807, at *1-2

(E.D. Pa. May 11, 2004); In re Prudential Ins. Co. of Am. Sales Practices Litig., 962 F. Supp. 450,

562 (D.N.J. 1997). When deciding preliminary approval, a court does not conduct a “definitive

proceeding on the fairness of the proposed settlement[.]” In re Mid-Atl. Toyota Antitrust Litig.,

564 F. Supp. 1379, 1384 (D. Md. 1983). That definitive determination must await the final

hearing, at which the fairness, reasonableness, and adequacy of the settlement are more fully

assessed. See In re Linerboard Antitrust Litig., 292 F. Supp. 2d 631, 638 (E.D. Pa. 2003).

Before the Court can grant preliminary approval and direct notice to the class, a plaintiff

must “show[] that the court will likely be able to . . . approve the proposal under Rule 23(e)(2)[.]”

Fed. R. Civ. P. 23(e)(1)(B) (eff. Dec. 1, 2018). Approval under amended Rule 23(e)(2) requires

that the settlement be fair, reasonable, and adequate, taking into consideration the following

factors: (1) whether “the class representatives and class counsel have adequately represented the

class”; (2) whether the settlement “was negotiated at arm’s length”; (3) whether “the relief

provided for the class is adequate”; and (4) whether the settlement “treats class members equitably

relative to each other.” Id. (e)(2)(A)-(D). There is, not surprisingly, overlap between the 2018

amendment’s fairness, reasonableness, and adequacy considerations and those set out in the Third


13

Circuit test in Girsh v. Jepson, 521 F.2d 153, 157 (3d Cir. 1975).5 Amended Rule 23(e)(2),

however, establishes a uniform set of core approval factors that the Advisory Committee Note

states “should always matter to the decision” of the district court as to whether to approve the

proposal. Fed. R. Civ. P. 23(e)(2) advisory committee’s note to 2018 amendment. Plaintiffs,

therefore, will predominantly address the amended Rule 23(e) factors now and fully address each

of the Girsh factors in their motion for final approval of the Settlement.

Generally, a court’s “first and primary concern is whether there are any obvious

deficiencies that would cast doubt on the proposed settlement’s fairness.” In re Nat’l Football

League Players’ Concussion Injury Litig., 301 F.R.D. 191, 198 (E.D. Pa. 2014), final approval

aff’d, 821 F.3d 410 (3d. Cir. 2016). “A settlement falls within the range of possible approval,” if

there is a conceivable basis for presuming that the standard applied for final approval—fairness,

adequacy, and reasonableness—will be satisfied.” Silvis v. Ambit Energy L.P, No. 14-5005, 2018

WL 1010812, at *6 (E.D. Pa. Feb. 22, 2018).6 After making such findings, a settlement agreement

is entitled to a presumption of fairness and should be preliminarily approved. See Gates, 248

F.R.D. at 439; Gen. Motors, 55 F.3d at 785; In re Am. Invs. Life Ins. Co. Annuity Mktg. & Sales

5 The factors considered for final approval of a class settlement as “fair, reasonable and adequate” include:

“(1) the complexity, expense and likely duration of the litigation . . . ; (2) the reaction of the class to the settlement . . . ; (3) the stage of the proceedings and the amount of discovery completed . . . ; (4) the risks of establishing liability . . . ; (5) the risks of establishing damages . . . ; (6) the risks of maintaining the class action through trial . . . ; (7) the ability of the defendants to withstand a greater judgment; (8) the range of reasonableness of the settlement fund in light of the best possible recovery . . . ; [and] (9) the range of reasonableness of the settlement fund in light of all the attendant risks of litigation[.]”

Id. (ellipses in original); In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 534-35 (3d Cir. 2004); Prudential, 962 F. Supp. at 562.

6 Unless otherwise indicated, internal quotations and citations are omitted.


14

Practices Litig., 263 F.R.D. 226, 238 (E.D. Pa. 2009). Ultimately, “[t]he decision of whether to

approve a proposed settlement of a class action is left to the sound discretion of the district court.”

Girsh, 521 F.2d at 156.

As discussed below, the Settlement, which provides financial institutions with substantial

monetary benefits, as well as requires meaningful improvements to Wendy’s data security

measures, is entitled to a presumption of fairness because the negotiations occurred at arm’s-length

over a period of several months, supervised by experienced neutral mediators; Class Counsel are

experienced in this type of complex litigation; the Parties were well-informed of the strengths and

weakness of each side’s positions as a result of significant discovery; and the Settlement treats

Settlement Class Members equitably relative to each other.

B. The Adequacy of Class Counsel and Settlement Class Representatives Supports Preliminary Approval

This Court previously has considered Class Counsel’s qualifications when appointing Erin

Green Comite and Gary F. Lynch as Co-Lead Counsel. (See ECF Nos. 15 & 21). Class Counsel

have extensive experience litigating complex and class actions and have demonstrated particular

success in litigating data security breach class actions. (ECF Nos. 15 at 7-18 & 15-1, Exs. A-G).

Class Counsel have aggressively litigated this action – briefing numerous substantive issues,

achieving early resolution of the choice of law issue to set the stage for class certification,

managing the review of millions pages of documents produced by Wendy’s and third parties, and

drafting comprehensive mediation statements assessing the legal and factual strengths and

weaknesses of the case – and thus have an adequate information base on which to negotiate this

Settlement. Lynch Decl. ¶19. The Settlement Class Representatives have demonstrated their

adequacy in selecting well-qualified Class Counsel, monitoring the Litigation, and participating in


15

discovery. Id. ¶20. Thus, this factor under Rule 23(e)(2)(A) weighs in favor of granting

preliminary approval.

C. The Negotiation Process Supports Preliminary Approval

Settlements that result from arm’s-length negotiations between experienced counsel are

generally entitled to deference from the court. See In re Auto. Refinishing Paint Antitrust Litig.,

MDL No. 1426, 2003 WL 23316645, at *6 (E.D. Pa. Sept. 5, 2003); Linerboard, 292 F. Supp. 2d

at 640 (holding that “[a] presumption of correctness is said to attach to a class settlement reached

in arms-length negotiations between experienced, capable counsel”). This deference reflects an

understanding that vigorous negotiations between seasoned counsel protect against collusion and

advance the fairness considerations of Rule 23(e). See In re Orthopedic Bone Screw Prods. Liab.

Litig., 176 F.R.D. 158, 184 (E.D. Pa. 1997) (concluding that the settlement was the product of

“good faith, arms’ length negotiations[,]” which eliminated “the risk that a collusive settlement

agreement may [have been] reached”).

As discussed above, the Settlement is the result of good faith, arm’s-length negotiations

between Class Counsel and Wendy’s counsel in three separately scheduled mediation sessions

with the supervision of two well-qualified, neutral mediators in addition to numerous direct

discussions about possible resolution of the Litigation. Lynch Decl. ¶10. As part of the mediation

process, the Parties exchanged, and provided to the mediators, comprehensive memoranda

outlining the strengths and weaknesses of the claims and defenses, with citation to evidence

developed during discovery. Id. ¶11. Two representatives of the Financial Institution Plaintiffs

attended one of the mediation sessions. Id. Class Counsel and Wendy’s counsel vigorously

advocated their respective clients’ positions in the settlement negotiations and were prepared to

proceed to the class certification, summary judgment, and trial phases if no settlement was reached.

Id. ¶19. Finally, Class Counsel’s attorneys’ fees, costs, and expenses and Service Awards were


16

not discussed until after the Parties agreed on the material terms of the Settlement. Id. ¶12. That

the Settlement was achieved through well-informed and arm’s-length negotiations weighs in favor

of granting preliminary approval under Rule 23(e)(2)(B).

D. The Adequacy of the Settlement Benefits in Light of the Risks of Continued Litigation Supports Preliminary Approval

When considering whether “the relief provided for the class is adequate,” amended Rule

23(e)(2)(C) requires the Court to take into account: “(i) the costs, risks, and delay of trial and

appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including

the method of processing class-member claims; [and] (iii) the terms of any proposed award of

attorney’s fees, including timing of payment[.]” Fed. R. Civ. P. 23(e)(2)(C)(i)-(iii) (eff. Dec. 1,

2018).7

1. The Relief Provided to the Settlement Class Is Substantial

The Settlement provides substantial relief to the Settlement Class. By way of example, if

valid claims are submitted for all eligible cards, it is estimated that Settlement Class Members

could receive approximately $2.00 per Alerted on Payment Card. Lynch Decl. ¶14. If, for

example, 40% of Alerted on Payment Cards are submitted in Approved Claims, then Settlement

Class Members could receive approximately $4.80 per Alerted on Payment card. Id. By

comparison, in Target and Home Depot, the settlements provided financial institutions with $1.50

and $2.00 fixed per-card recovery, respectively, without documentation of loss (with an option to

obtain a percentage of documented losses). See In re Target Customer Data Sec. Breach Litig.,

No. 0:14-md-02522, ECF No. 747-1, Ex. A at 4-5 (D. Minn. Apr. 11, 2016); In re Home Depot

Customer Data Sec. Breach Litig., No. 1:14-md-02583 (“Home Depot”), ECF No. 336-1 at 25

7 Rule 23(e) also requires the Court to consider “any agreement required to be identified under Rule 23(e)(3)[.]” Id. (e)(2)(C)(iv). No such agreements exist. Lynch Decl. ¶13.


17

(N.D. Ga. Aug. 23, 2017). Thus, on a dollar-per-card basis, this Settlement is at least comparable

to – and potentially much more significant than – other financial institution data breach settlements

that have been finally approved.

In the financial institution data breach class action settlement context, this Settlement is

unique. It represents the only nationwide class action settlement achieved in a case where the

major card brand networks, Visa and MasterCard, offered no other compensation to Settlement

Class Members. Lynch Decl. ¶15. Unlike in other settled financial institution data breach class

actions, without this Settlement, Settlement Class Members would receive no monetary

compensation for the payment card reissuance costs and fraud losses incurred as a result of this

Data Breach. Id.

As background, each major card brand network has established a process to assess

responsibility for a data breach and recover monetary compensation from the acquiring bank of a

compromised merchant to be distributed to the payment card issuers. 8 These discretionary

recovery processes, such as Visa’s Global Compromised Account Recovery (“GCAR”) program

and MasterCard’s Account Data Compromise (“ADC”) program, can provide partial

reimbursement for operational expenses (including payment card cancellation and replacement)

and incremental counterfeit fraud losses suffered as a result of a data breach.9 If certain qualifying

criteria relating to a data breach are met and a merchant is determined to be non-compliant with

PCI DSS, placing payment card data at risk, the card brands can hold the compromised merchant’s

acquiring bank liable and require it to pay a monetary assessment, which is, in turn, distributed to

8 See, e.g., Visa Global Compromised Account Recovery Program: What Every Merchant Should Know About GCAR, VISA (2013), http://www.paymentworld.com/docs/training/visa/what-every-merchant-should-know-GCAR-VOL-091213-final.pdf.

9 Id. at 2.


18

the impacted payment card issuers.10 Here, financial institutions did not receive any compensation

through the GCAR and ADC programs in connection with this Data Breach. This is significant

because Wendy’s could argue that the lack of any assessments by the major card brands signifies

that Wendy’s was not liable for any damages to financial institutions arising out of the Data

Breach. While this is not the conclusion Plaintiffs would draw, the Court could have agreed, if

Wendy’s asserted this position, and thus, the lack of card brand assessments was a risk taken into

account during the settlement negotiations.

2. The Risks of Continued Litigation Are Significant

In the opinion of Class Counsel, who have substantial experience litigating complex and

class actions, generally, and financial institution data breach class actions, specifically, the

Settlement represents a highly favorable result for the Class, especially given the risks of continued

litigation. Lynch Decl. ¶21. During the litigation to date, Wendy’s has asserted several defenses

against liability, and although Plaintiffs do not believe those defenses would carry the day, they

nevertheless pose the threat of defeating Plaintiffs’ claims or reducing their ultimate value. For

instance, Wendy’s has argued, among other defenses, that Plaintiffs’ negligence claims are barred

by the economic loss rule; Wendy’s owed Plaintiffs no common law duty to protect payment card

data from criminal intrusion; the criminal intrusion was an intervening cause of Plaintiffs’

damages; and Wendy’s is not the proper defendant because certain franchisees or outside vendors

were more directly at fault for the Data Breach than Wendy’s. (See ECF No. 139). These defenses

pose significant risks. For example, in its MJP, Wendy’s argued that the Court should follow cases

like Cmty. Bank of Trenton v. Schnuck Mkts., Inc., 887 F.3d 803, 817-18 (7th Cir. 2018), which

have refused to recognize a duty to safeguard payment card information; held that financial

10 Id. at 2-3.


19

institution claims are barred by the economic loss doctrine; and held that the financial institutions’

claims of negligence per se, based on §5 of the Federal Trade Commission Act, failed.

Plaintiffs also anticipate that Wendy’s would oppose Plaintiffs’ motion for class

certification on the basis that individualized issues would defeat predominance because, from

Wendy’s point-of-view, the Data Breach involved many different franchisees and two separate

third-party POS systems, such that each franchisee’s data security practices and the role of third-

party service providers would have to be analyzed, implicating highly individualized issues for

establishing liability and causation. For instance, in In re TJX Cos. Retail Sec. Breach Litig., 246

F.R.D. 389 (D. Mass. 2007), the court denied certification of a Rule 23(b)(3) class, holding that

issues of causation, comparative negligence, and damages would require individualized inquiry

and precluded a finding of predominance.

Accordingly, although Plaintiffs are confident in the strength of their case against Wendy’s

and the likelihood of success at each stage, the outcome is nonetheless uncertain. See In re

Processed Egg Prods. Antitrust Litig., 284 F.R.D. 249, 273 (E.D. Pa. 2012) (“Plaintiffs not only

face the risk that they will not succeed in establishing liability and damages, but also the risks

associated with certifying and maintain a class.”); In re CertainTeed Corp. Roofing Shingle Prods.

Liab. Litig., 269 F.R.D. 468, 487 (E.D. Pa. 2010) (“If it would be difficult for a plaintiff to establish

liability, this factor favors settlement.”). Moreover, even if Plaintiffs were successful through trial

in the district court, there would very likely be one or more lengthy appeals, including potentially

an interlocutory appeal under Fed. R. Civ. P. 23(f). See In re Remeron End-Payor Antitrust Litig.,

No. Civ. 02-2007 FSH, 2005 WL 2230314, at *17 (D.N.J. Sept. 13, 2005). The degree of

uncertainty supports preliminary approval of the proposed Settlement Agreement. See In re

Chambers Dev. Sec. Litig., 912 F. Supp. 822, 838 (W.D. Pa. 1995).


20

Class Counsel have considered: (1) the complexities of this litigation; (2) the risks and

expense of continuing this case through discovery, class certification, summary judgment, and trial

against Wendy’s; and (3) the likely appeal(s) if Plaintiffs do prevail at trial or earlier stages. After

weighing these against the guaranteed recovery to the Settlement Class, and what Class Counsel

believe to be the significant monetary benefits to the Settlement Class, Class Counsel firmly

believe the Settlement represents a desirable resolution of this litigation. Lynch Decl. ¶21. Courts

have accorded significant weight to the opinion of Class Counsel based on a thorough analysis of

the facts. See, e.g., In re Gen. Instruments Sec. Litig., 209 F. Supp. 2d 423, 431 (E.D. Pa. 2001);

Stewart v. Rubin, 948 F. Supp. 1077, 1099 (D.D.C. 1996), aff’d, 124 F.3d 1309 (D.C. Cir. 1997)

(“[A] court should defer to the judgment of experienced counsel who have competently evaluated

the strength of the proof.”); Petruzzi’s, Inc. v. Darling-Del. Co., Inc., 880 F. Supp. 292, 301 (M.D.

Pa. 1995) (“The opinions and recommendation of such experienced counsel are indeed entitled to

considerable weight.”).

3. The Proposed Method of Distributing Relief to the Settlement Class Is Effective

Under the Distribution Plan (SA Ex. 1) that governs payments from the Settlement Fund,

Settlement Class Members that file a an Approved Claim will receive a Cash Payment Award per

Claimed-On Card without having to provide supporting documentation or prove their losses. SA

¶40(b); SA Ex. 1 ¶¶2, 2.1. The amount of the cash payment will depend on the total number of

eligible payment cards submitted by Settlement Class Members, the Costs of Settlement

Administration, taxes paid on the Settlement Fund, and the amount of attorneys’ fees, costs, and

expenses and Service Awards approved by the Court. By way of example, valid claims are

submitted for all eligible cards, it is estimated that Settlement Class Members could receive

approximately $2.00 per Alerted on Payment Card. Lynch Decl. ¶14. If, for example, 40% of


21

Alerted on Payment Cards are submitted in Approved Claims, then Settlement Class Members

could receive approximately $4.80 per Alerted on Payment card. Id. These are examples. The

per-card amount actually paid may be higher or lower. However, the calculation to arrive at the

Cash Payment Award per Claimed-On Card is straightforward and simple.

The Claim Form is only two pages long and requires Settlement Class Members to provide

very basic information: the name of the financial institution; the person filing out the form; the

financial institution’s contact information; and the number of Alerted on Payment Cards. This

information will be easy for financial institution employees to locate and provide. No additional

documentation is required. Furthermore, Settlement Class Members can chose to submit their

claims electronically through the Settlement Website. SA ¶¶35, 49(f); SA Ex. 1 ¶¶2.1-2.2;

Simmons Decl. ¶19. Based on their experiences with the settlement of other class action data

breach cases on behalf of financial institutions, Class Counsel believes that the simplicity of the

Claim Form will increase participation from Settlement Class Members. Lynch Decl. ¶17.

4. Class Counsel’s Request for Attorneys’ Fees, Expenses, and Costs Will Be Subject to Approval by the Court

Finally, the Settlement requires that any award for payment of attorneys’ fees, expenses,

and costs is subject to proper motion to, and approval by, the Court. Class Counsel will apply to

the Court for an award of 30% of the gross Settlement Fund, including any interest earned thereon,

and will additionally request reimbursement of their reasonable costs and expenses from the

Settlement Fund. SA ¶67. Importantly, the Parties did not discuss attorneys’ fees, costs, and

expenses prior to agreeing to the essential terms of the Settlement. SA ¶I; Lynch Decl. ¶12. Thirty

days prior to the hearing on whether the Court should grant final approval to the Settlement, Class

Counsel will submit a motion for attorneys’ fees, expenses, and costs. SA ¶59. Settlement Class


22

Members that have objected to the Settlement by the Objection Deadline will have an opportunity

to file a brief in response to Class Counsel’s request for attorneys’ fees, expenses, and costs. Id.

Thus, all the considerations under Rule 23(e)(2)(C) support preliminary approval.

E. That Settlement Class Members Are Treated Equitably Relative to Each Other Supports Preliminary Approval

Finally, the Settlement Agreement is fair to the Settlement Class as a whole. It provides

no preferential treatment to some Settlement Class Members over others. Every Settlement Class

Member that submits an Approved Claim is entitled to the same relief on a per Claimed-On Card

basis without having to provide documentation or prove losses. SA Ex. 1 ¶¶2.1, 4.2. Accordingly,

this factor under Rule 23(e)(2)(D) supports preliminary approval.

All of the relevant factors – the terms of the Settlement, nature of the negotiations, well-

advanced state of the Litigation at the time of Settlement, experience of Class Counsel, risks of

proceeding, effectiveness of distribution, and equitable treatment of Settlement Class Members –

support the conclusion that the Settlement falls within the range of possible final approval and is

entitled to the presumption of fairness, permitting notice to issue to the Settlement Class.

Accordingly, the Court should preliminarily approve the Settlement.

IV. THE SETTLEMENT CLASS SHOULD BE CERTIFIED

At this stage, Plaintiffs only seek provisional certification of the Settlement Class and

authorization from the Court to send notice of the Settlement to Settlement Class Members. As a

general matter, an action may be certified for class treatment for settlement purposes. See, e.g.,

Amchem Prods., Inc. v. Windsor, 521 U.S. 591 (1997); Gen. Motors, 55 F.3d at 777-78. The Court

first approves preliminary certification of the class. Certainteed, 269 F.R.D. at 476; Gates, 248

F.R.D at 439. Final certification of the settlement class is determined by the court at the same time

as the court rules on final approval of the settlement class. Certainteed, 269 F.R.D. at 476; Gates,


23

248 F.R.D. at 439. Rule 23 governs the issue of class certification for both litigation and settlement

classes. A class should be certified where the four requirements of Rule 23(a) are satisfied, and

when one of the three subsections of Rule 23(b) is also met. Warfarin, 391 F.3d at 527-30.

The Court should certify the Settlement Class here. Indeed, courts have recently certified

similar classes in data breach cases – both for litigation purposes, see In re Target Corp. Customer

Data Sec. Breach Litig., 309 F.R.D. 482 (D. Minn. 2005), as well as for purposes of settlement.

See Home Depot, ECF Nos. 328 (D. Minn. Mar. 10, 2017) & 330 (D. Minn. Apr. 19, 2017);

Winsouth Credit Union v. Mapco Express, Inc., No. 3:14-cv-01573, ECF No. 48 (M.D. Tenn. Sept.

14, 2016).

A. Ascertainability

In addition to the Rule 23(a) and (b)(3) requirements, the Third Circuit imposes another

requirement under Rule 23: ascertainability. See Byrd v. Aaron’s Inc., 784 F.3d 154, 163 (3d Cir.

2015). In Byrd, the Third Circuit explained that “[t]he ascertainability inquiry is two-fold,

requiring a plaintiff to show that: (1) the class is defined with reference to objective criteria; and

(2) there is a reliable and administratively feasible mechanism for determining whether putative

class members fall within the class definition.” Id. Here, ascertainability is satisfied, since the

Settlement Class is defined as those payment-card-issuing financial institutions who received an

alert from at least one of the payment card brand networks, indicating that at least one of the

financial institution’s payment cards was potentially exposed in the Data Breach. SA ¶¶1, 16. The

major card brand networks each have produced in the Litigation information sufficient to identify

the vast majority of the financial institutions that issued an Alerted on Payment Card. Lynch Decl.

¶14. This allows for an objective method of verifying which financial institutions fit within the

definition of the Settlement Class, and therefore, satisfies the ascertainability requirement.


24

B. Rule 23(a) Requirements

Certification is appropriate under Rule 23(a) if:

(1) the class is so numerous that joinder of all members is impracticable;

(2) there are questions of law and fact common to the class;

(3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the interests of the class.

See Fed. R. Civ. P. 23(a)(1)-(4).

1. Numerosity

The Rule 23(a)(1) numerosity requirement does not necessitate a showing that joinder is

impossible, but only that joining all class members would be “impracticable,” i.e., difficult or

inconvenient. See In re Flat Glass Antitrust Litig., 191 F.R.D. 472, 477 (W.D. Pa. 1999). “There

is no magic minimum number necessary to satisfy the . . . numerosity requirement.” Seidman v.

Am. Mobile Sys., Inc., 157 F.R.D. 354, 359 (E.D. Pa. 1994). When considering the number of

class members necessary to satisfy the numerosity requirement, this Court has recognized that

classes as small as 40 may prove sufficient. See Stewart v. Abraham, 275 F.3d 220, 226-67 (3d

Cir. 2001) (a class with more than 40 will satisfy the numerosity requirement). In addition, when

considering the numerosity of the class, “[i]t is proper for the court to accept common sense

assumptions in order to support a finding of numerosity.” Cumberland Farms, Inc. v. Browning-

Ferris Indus., Inc., 120 F.R.D. 642, 645-46 (E.D. Pa. 1988). Class Counsel’s estimate, based on

data obtained from the card brand networks in third party discovery, is that approximately 7,500

different financial institutions issued approximately 18 million Alerted on Payment Cards. Lynch

Decl. ¶14. Accordingly, the Settlement Class size estimate far exceeds 40 members, rendering

joinder impracticable. Thus, the numerosity requirement is satisfied.


25

2. Commonality

Commonality under Rule 23(a)(2) focuses on whether there exists questions of law or fact

common to the class. Questions are common to the class if class members’ claims “depend upon

a common contention” that is “of such a nature that it is capable of class wide resolution—which

means that determination of its truth or falsity will resolve an issue that is central to the validity of

each one of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541, 2551

(2011). The Third Circuit has a very “low threshold for commonality.” See, e.g., Flat Glass, 191

F.R.D. at 478; In re Asbestos Sch. Litig., 104 F.R.D. 422, 429 (E.D. Pa. 1984), aff’d in part and

rev’d in part sub nom. In re Sch. Abestos Litig., 789 F.2d 996 (3d Cir. 1986). A common question

is one that “arises from a common nucleus of operative facts regardless of whether the underlying

facts fluctuate over the class period and vary as to individual claimants.” Id. In particular, the

commonality requirement may be satisfied by a single common issue. Baby Neal for and by

Kanter v. Casey, 43 F.3d 48, 56 (3rd Cir. 1994).

Here, there are many common issues of fact and law, for example:

a. whether Wendy’s owed a duty to the Financial Institution Plaintiffs and

Settlement Class Members to protect payment card data;

b. whether the Data Breach was caused by specific negligent acts or omissions

on the part of Wendy’s;

c. whether the Data Breach could have been prevented or mitigated if Wendy’s

had acted with reasonable care; and

d. whether the acts of third-party criminals are, as a matter of law, intervening

or superseding causes of Financial Institution Plaintiffs’ damages.


26

The answers to these questions would drive the litigation forward and resolve issues as to all

Settlement Class Members, either favorably or unfavorably. Accordingly, the Settlement Class

satisfies commonality.

3. Typicality

Rule 23(a)(3) requires that the class representative’s claims or defenses be “typical” of the

claims or defenses of the class. “The typicality requirement is a safeguard against interclass

conflicts, insuring that the named plaintiff’s interests are more or less coextensive with those of

the class.” Cumberland Farms, 120 F.R.D. at 646. “The threshold for establishing typicality is

low, and Rule 23(a)(3) will be satisfied as long as the factual or legal position of the representatives

are not markedly different from that of other members of the class.” Seidman, 157 F.R.D. at 360.

In fact, “even relatively pronounced factual differences will generally not preclude a finding of

typicality where there is a strong similarity of legal theories or where the claim arises from the

same practice or course of conduct.” In re Prudential Ins. Co. Am. Sales Practice Litig. Agent

Actions, 148 F.3d 283, 311 (3d Cir. 1998).

Here, the claims of Plaintiffs and Settlement Class Members arise from the same conduct.

Specifically, Plaintiffs’ and Settlement Class Members’ claims arise from Wendy’s alleged

implementation of data security measures at Wendy’s-branded restaurants that were unreasonable

and inadequate to protect Plaintiffs’ and Settlement Class Members’ payment card data. There are

no unique facts or circumstances that would render Plaintiffs atypical from the Settlement Class.

The exposure of Plaintiffs’ payment card data occurred through the same mechanism (two variants

of similar malware deployed in a similar fashion) during the same time period. Wendy’s alleged

conduct caused the same type of alleged injury to Settlement Class Members. Every Settlement

Class Member suffered the same varieties and types of risks and losses as a result of the Data


27

Breach, and the only notable variation among Settlement Class Members is the amount of damages

each one suffered.

4. Adequacy

The final requirement, adequacy, requires that a representative party must fairly and

adequately protect the interests of the class. Adequate representation depends on two factors:

(1) the class counsel must be “qualified, experienced, and generally able to conduct the proposed

litigation”; and (2) the proposed class representative must not have “interests [that] are antagonistic

to those of the class.” Seidman, 157 F.R.D. at 365.

As to the first factor, Plaintiffs are represented by counsel that is highly experienced and

skilled in matters relevant to this litigation. Gary Lynch of Carlson Lynch and Erin Green Comite

of Scott+Scott possess substantial experience in class actions and other complex litigation,

including data breach class actions, such as this. (See ECF Nos. 15 & 15-1, Exs. A-B). As to the

second factor, Plaintiffs and each member of the Settlement Class are aligned in their interests vis-

à-vis this Litigation and Wendy’s. All Settlement Class Members will receive settlement

distributions according to an objective methodology that values claims using the same criteria. SA

¶40(b); SA Ex. 1 ¶4.2. There are no fundamental conflicts of interest among Plaintiffs or

Settlement Class Members, and the named-Plaintiffs do not have interests antagonistic to the

Settlement Class. Several Financial Institution Plaintiffs contributed substantial time and

resources during discovery by working with Plaintiffs’ counsel to produce documents and sit for

depositions. Lynch Decl. ¶20. These efforts on behalf of the Settlement Class demonstrate that

Plaintiffs are more than adequate representatives.

C. Rule 23(b) Requirements

Having satisfied the four prerequisites of Rule 23(a), Plaintiffs need only show that the

requirements of one subsection of Rule 23(b) have been met for the claims to be certified for class-


28

wide treatment. See Baby Neal, 43 F.3d at 55. Plaintiffs seek certification under Rule 23(b)(3),

which requires a showing of predominance and superiority. Sala v. Nat’l R.R. Passenger Corp.,

120 F.R.D. 494, 498 (E.D. Pa. 1988).

1. Predominance

This rule requires only a “predominance of common questions, not a unanimity of them.”

Rodriguez v. McKinney, 156 F.R.D. 118, 119 (E.D. Pa. 1994). As long as the claims of the class

members are not in conflict with each other, class members need not be identically situated and

may have individualized issues. See O’Keefe v. Mercedes-Benz USA, LLC, 214 F.R.D. 266, 290

(E.D. Pa. 2003). “The question is whether the class is cohesive enough to warrant adjudication by

representation.” Fisher v. Va. Elec. & Power Co., 217 F.R.D. 201, 213 (E.D. Va. 2003). “[T]he

predominance requirement focuses on whether essential elements of the class’s claims can be

proven at trial with common, as opposed to individualized, evidence[.]” Hayes v. Wal-Mart Stores,

Inc., 725 F.3d 349, 359 (3d Cir. 2013).

Individualized damage variations among class members do not by themselves preclude a

finding of predominance. First, a class may be certified for liability purposes only, leaving

individual damages calculations to subsequent proceedings. See Taha v. Cty. of Bucks, 862 F.3d

292, 309 (3d Cir. 2017); W. Rubenstein, NEWBERG ON CLASS ACTIONS §4:54, 206-08 (5th ed.

2012). Second, a plaintiff class may prove classwide damages through use of representative

evidence and statistical modeling, provided that the methodology offered is mathematically sound

and comports appropriately with the plaintiffs’ liability theory. See Tyson Foods, Inc. v.

Bouaphakeo, 136 S. Ct. 1036, 1047-49 (2016); Comcast Corp. v. Behrend, 569 U.S. 27, 35-37

(2013). Apportionment and disbursement of the classwide damages to individual class members

can be accomplished at a later stage without undermining the propriety of class certification during

earlier phases. See Tyson Foods, 136 S. Ct. at 1049-50.


29

The predominate legal and factual issues in this litigation concern the nature of the Data

Breach and Wendy’s degree of responsibility under Ohio negligence law. In ruling on the choice

of law questions presented in early 2018, the Court already determined that application of Ohio

law was appropriate, with respect to the negligence and negligence per se claims, despite the

varying home states of the Plaintiffs and the spread of the malware across Wendy’s franchise

restaurants nationwide. (See ECF 147 at 11-13). The most significant remaining issues to be

litigated or tried with respect to liability were whether: Wendy’s had a legal duty to Plaintiffs to

protect payment card data; Wendy’s breached a duty of reasonable care; Wendy’s acts or omissions

were the proximate cause of Plaintiffs’ injuries; the allocation of responsibility as between

Wendy’s and its franchisees and vendors; and the economic loss rule affects Plaintiffs’ claims. All

of these issues could have been resolved on a classwide basis, with little to no emphasis on unique

circumstances of any individual Plaintiff. See, e.g., Target, 309 F.R.D. at 486-89.

These issues predominate, and the Settlement and Distribution Plan proposed by Plaintiffs

ensure that individualized damage calculations do not pose a problem. Settlement Class Members

will receive distributions from the Settlement Fund based on a pro rata basis after certain

deductions (e.g., attorneys’ fees, costs, and expenses, Costs of Settlement Administration, taxes,

and Service Awards) – a methodology that is objective, easy to calculate, and offers fair and equal

treatment to all Settlement Class Members. SA ¶40; SA Ex. 1 ¶4.3.

2. Superiority

“The superiority requirement asks the court to balance, in terms of fairness and efficiency,

the merits of a class action against those of alternative available methods of adjudication.”

Prudential, 148 F.3d at 316; Warfarin, 391 F.3d 516. Rule 23(b)(3) lists the following factors to

guide the superiority inquiry: (1) “class members’ interests in individually controlling the

prosecution . . . of separate actions”; (2) whether “litigation concerning the controversy has already


30

begun by or against class members”; (3) whether “concentrating the litigation of the claims in the

particular forum” is desirable; and (4) “the likely difficulties in managing a class action.” Fed R.

Civ. P. 23(b)(3)(A)-(D). Plaintiffs address each factor in turn.

It is in the interest of individual Settlement Class Members to proceed with this litigation

as a class action. Although Settlement Class Members collectively suffered significant damages

as a result of the Data Breach, those losses are distributed among several thousand card-issuing

financial institutions. Settlement Class Members who issued only a few Alerted on Payment Cards

will have no incentive to litigate against Wendy’s individually, as their damages may only be a

few hundred dollars. Even for larger issuers, the distributions offered by this Settlement likely

provide better net recoveries than the Settlement Class Members could obtain by suing Wendy’s

individually, after costs of litigation are considered.

Plaintiffs are not aware of other pending litigation by Settlement Class Members

concerning the same facts and claims. Litigation in this forum is desirable since the handful of

cases filed against Wendy’s in the wake of the Data Breach were all consolidated before this Court

with the consent of all named Plaintiffs. And finally, the discovery conducted to date has been

efficient and focused on the key common issues discussed above, allowing both Settlement Class

Members and Wendy’s to benefit from economies of scale and elimination of duplicative work.

The Court “need not inquire whether the case, if tried, would present intractable management

problems, for the proposal is that there be no trial.” Amchem Prods., 521 U.S. at 620. Resolving

this Litigation by way of a class settlement in this forum is therefore a superior procedure than

individual actions.

In sum, all the requirements of Rules 23(a) and (b)(3) have been satisfied and the Court

should conditionally certify the Settlement Class for the purpose of dissemination of the notice.


31

V. THE PROPOSED NOTICE PROGRAM SATISFIES RULE 23 AND DUE PROCESS AND SHOULD BE APPROVED

A. The Scope of the Proposed Notice Program Is Adequate

Rule 23(c)(2)(B) states:

For (b)(3) Classes. For any class certified under Rule 23(b)(3)—or upon ordering notice under Rule 23(e)(1) to a class proposed to be certified for purposes of settlement under Rule 23(b)(3)—the court must direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort. The notice may be by one or more of the following: United States mail, electronic means, or other appropriate means. The notice must [be] clearly and concisely state[d] in plain, easily understood language[.]

Fed. R. Civ. P. 23(c)(2)(B) (eff. Dec. 1, 2018) (emphasis in original). As the Supreme Court

explained in Mullane v. Cent. Hanover Bank & Tr. Co.:

An elementary and fundamental requirement of due process in any proceeding which is to be accorded finality is notice reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections. The notice must be of such nature as reasonably to convey the required information, and it must afford a reasonable time for those interested to make their appearance[.]

339 U.S. 306, 315 (1950). The proposed Notice Program in this case meets these standards.

When determining what constitutes the best notice practicable under the circumstances,

courts consider the individual facts in the case. See In re Prudential Ins. Co. of Am. Sales Practices

Litig., 177 F.R.D. 216, 232 (D.N.J. 1997) (quoting Carlough v. Amchem Prods., Inc., 158 F.R.D.

314, 325 (E.D. Pa. 1993)) (“In all cases the Court should strike an appropriate balance between

protecting class members and making Rule 23 workable.”); see also Fed. R. Civ. P. 23(c)(2)

advisory committee’s note to 2018 amendment (“[T]he amended rule relies on courts and counsel

to focus on the means or combination of means most likely to be effective in the case before the

court.”). Here, Settlement Class Members are financial institutions that vary in size and

sophistication. Therefore, in consultation with their proposed Settlement Administrator, the


32

Parties designed a multi-pronged Notice Program to ensure adequate dissemination of notice that,

as detailed above in §II(D), includes: individualized direct mail; publication notice through digital

media; and a dedicated telephone line and website.

For purposes of effectuating individualized Mail Notice, Class Counsel have arranged from

Visa and MasterCard to submit to the Settlement Administrator the legal address of each financial

institution that issued an Alerted on Payment Card. Lynch Decl. ¶16. Class Counsel also will

provide relevant contact information to the Settlement Administrator for financial institutions that

issued American Express, Discover, and JCB Alerted on Payment Cards. Id. The Settlement

Administrator will use this data, along with other reasonably available sources, to compile a final

list of potential Settlement Class Members to which Mail Notice will be issued. Simmons Decl.

¶13. Despite the likely reach of Mail Notice, the Settlement Administrator also will disseminate

a summary notice through several digital journals, such as the ABA Banking Journal, commonly

read by financial institution executives. Simmons Decl. ¶¶16, 22. Then, the Settlement Website

and toll-free telephone line, both with live customer support available, will further support

Settlement Class Members and facilitate resolving any questions Settlement Class Members have.

Simmons Decl. ¶¶17-21. Courts routinely find that individual direct Mail Notice, along with

publication notice, is “ideal” and “the best possible” method of notice and fully satisfies the

requirements of Rule 23(c) and due process. See, e.g., In re Prudential Ins. Co. of Am. Sales

Practices Litig., 962 F. Supp. 450, 527-28 (D.N.J. 1997); In re Chambers Dev. Sec. Litig., 912 F.

Supp. 822, 836 (W.D. Pa. 1995). The Parties’ proposed Notice Plan exceeds even this standard

by adding a dedicated telephone number and website with live customer support.

B. The Form and Content of the Proposed Notices Is Adequate

The form of the class notice is governed by Rule 23(c)(2), which provides that:

[t]he notice must clearly and concisely state in plain, easily understood language:


33

(i) the nature of the action;

(ii) the definition of the class certified;

(iii) the class claims, issues, or defenses;

(iv) that a class member may enter an appearance through an attorney if the member so desires;

(v) that the court will exclude from the class any member who requests exclusion;

(vi) the time and manner for requesting exclusion; and

(vii) the binding effect of a class judgment on members under Rule 23(c)(3).

Fed. R. Civ. P. 23(c)(2)(B)(i)-(vii). The proposed Notices are written in plain English; describe

the litigation, claims being made, and terms of the Settlement; and inform Settlement Class

Members about the deadlines and their rights to opt out or object. See SA Exs. 2-3. Thus, the

proposed Notices in this Litigation meet all of the Rule 23(c)(2)(B) requirements. See Simmons

Decl. ¶¶23-26.

C. The Proposed Claim Form Is Adequate

The Claim Form (SA Ex. 1, Attachment A) clearly informs the Settlement Class Members

of the process they must follow. It is only two pages long and requires Settlement Class Members

to provide very basic information: the name of the financial institution; the person filing out the

form; the financial institution’s contact information; and the number of Alerted on Payment Cards.

This information will be easy for financial institution employees to locate and provide. Class

Counsel believe that the Claim Form is adequate and that the stark simplicity of the process will

increase participation from Settlement Class Members. Lynch Decl. ¶17.

D. The Settlement Administrator Is Adequate

The Court should also approve Analytics Consulting LLC (“Analytics”) to serve as the

Settlement Administrator. Analytics is a well-known firm with a history of successfully

administering many class action settlements. Simmons Decl. ¶¶2-4. Class Counsel, with Wendy’s

approval, selected Analytics after obtaining and reviewing proposals from three additional


34

administration firms and believe that Analytics will be able to meet the obligations imposed on the

Settlement Administrator under the Settlement in a cost-effective manner. Lynch Decl. ¶22.

VI. CO-LEAD COUNSEL SHOULD BE APPOINTED AS CLASS COUNSEL

Gary F. Lynch and Erin Green Comite should be appointed as Class Counsel. Rule 23(g)

enumerates four factors for evaluating the adequacy of proposed class counsel: (1) “the work

counsel has done in identifying or investigating potential claims in the action”; (2) “counsel’s

experience in handling class actions, other complex litigation, and types of claims of the type

asserted in the action”; (3) “counsel’s knowledge of the applicable law”; and (4) “the resources

counsel will commit to representing the class[.]” Fed. R. Civ. P. 23(g)(1)(A)(i)-(iv).

All of these factors militate in favor of appointing Mr. Lynch and Ms. Comite as Class

Counsel. Since the Court’s appointment of Mr. Lynch and Ms. Comite as Co-Lead Counsel, they

have devoted significant time and resources to prosecuting this action on behalf of Plaintiffs and

the proposed class. Lynch Decl. ¶19. Mr. Lynch and Ms. Comite have extensive experience in

class actions, particularly those involving financial institution card data breaches, as demonstrated

by the numerous times their respective firms have been appointed to leadership positions in similar

actions. (See ECF Nos. 15 & 15-1, Exs. A-B). Accordingly, Mr. Lynch and Ms. Comite will

adequately represent the interests of the Class and should be appointed as Class Counsel.

VII. CONCLUSION

For the reasons set forth above, Plaintiffs request that the Court enter the Preliminary

Approval Order (SA Ex. 4), that grants preliminary approval to the Settlement; certifies the

Settlement Class for settlement purposes; sets opt-out and objection deadlines and a date for a

Final Approval Hearing; appoints Mr. Lynch and Ms. Comite as Class Counsel; appoints Analytics

as Settlement Administrator; and approves the proposed Notice Program.


35

Dated: February 13, 2019

CARLSON LYNCH SWEETKILPELA & CARPENTER, LLP

/s/ Gary F. Lynch Gary F. Lynch Jamisen A. Etzel 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222 T: 412-322-9243 F: 412-231-0246 [email protected] [email protected]

SCOTT+SCOTTATTORNEYS AT LAW LLP

/s/ Erin Green Comite Erin Green Comite Joseph P. Guglielmo 156 South Main Street P.O. Box 192 Colchester, CT 06415 Telephone: (860) 537-5537 Facsimile: (860) 537-4432 [email protected] [email protected]

Co-Lead Counsel and Proposed Class Counsel for Plaintiffs


36

CERTIFICATE OF SERVICE

I hereby certify that on February 13, 2019, I authorized the electronic filing of the foregoing

with the Clerk of the Court using the CM/ECF system, which will send notification of such filing

to the email addresses denoted on the Electronic Mail Notice List.

/s/ Erin Green Comite Erin Green Comite (pro hac vice)


EXHIBIT A

Case 2:16-cv-00506-MPK Document 176-1 Filed 02/13/19 Page 1 of 29

SETTLEMENT AGREEMENT AND RELEASE

This Settlement Agreement and Release (“Settlement” or “Settlement Agreement”), dated as of February 12, 2019, is made and entered into by and among the following Parties: (1) the Financial Institution Plaintiffs, for themselves and on behalf of the Settlement Class, and the Association Plaintiffs, by and through Erin Green Comite of Scott+Scott Attorneys at Law LLP and Gary F. Lynch of Carlson Lynch Sweet Kilpela & Carpenter, LLP (“Class Counsel”); and (2) The Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC (collectively, “Wendy’s”), by and through its counsel of record, Kristine M. Brown of Alston & Bird LLP, and subject to preliminary and final Court approval as required by Rule 23 of the Federal Rules of Civil Procedure.

I. RECITALS

A. On April 25, 2016, First Choice Federal Credit Union filed an action against Wendy’s in the United States District Court for the Western District of Pennsylvania after Wendy’s reported third-party criminal cyberattacks of certain of its independently owned and operated franchisee restaurants involving malware variants targeting customers’ payment card information. Thereafter, a number of additional actions were filed by financial institutions against Wendy’s in the United States District Court for the Western District of Pennsylvania.

B. By order dated July 12, 2016, these actions were consolidated (ECF No. 20) and by order dated July 12, 2016, the Court appointed Erin Green Comite of Scott+Scott Attorneys at Law, LLP and Gary F. Lynch of Carlson Lynch Sweet Kilpela & Carpenter, LLP as interim co-lead class counsel. (ECF No. 21).

C. On July 22, 2016, the Financial Institution Plaintiffs and Association Plaintiffs (collectively, “Plaintiffs”) filed the operative Consolidated Amended Class Action Complaint (“Complaint”), asserting claims for negligence, negligence per se, violation of the Ohio Deceptive Trade Practices Act (“ODTPA”), Ohio Code §§ 4165.01, et seq., and declaratory and injunctive relief. (ECF No. 32).

D. On August 22, 2016, Wendy’s moved to dismiss the Complaint (the “Motion to Dismiss”). (ECF No. 53). On February 13, 2017, Chief Magistrate Judge Kelly issued a Report and Recommendation recommending that the Court deny the Motion to Dismiss. (ECF No. 80). On March 31, 2017, the Court adopted the Report and Recommendation and denied Wendy’s Motion to Dismiss. (ECF No. 88).

E. The Parties engaged in significant motion practice and discovery. In particular, Plaintiffs served Wendy’s with document requests, and Wendy’s produced millions of pages of documents, which Plaintiffs reviewed. Plaintiffs also deposed Wendy’s corporate representative pursuant to Federal Rule of Civil Procedure 30(b)(6). Additionally, Plaintiffs obtained and reviewed thousands of pages of documents from numerous third parties in response to subpoenas Plaintiffs served, including subpoenas served on the major card brands.


2

F. Wendy’s served the Financial Institution Plaintiffs with document requests, to which the Financial Institution Plaintiffs responded with the production of thousands of pages of responsive documents. Wendy’s also deposed 16 corporate witnesses of Financial Institution Plaintiffs with knowledge of facts relating to the Financial Institution Plaintiffs’ response to the Data Breach, designated pursuant to Federal Rule of Civil Procedure 30(b)(6).

G. On January 19, 2018, Plaintiffs filed a Motion for Application of Ohio Law, seeking to apply Ohio law to Plaintiffs’ claims on a nationwide basis, which Wendy’s opposed. (ECF No. 131). On May 9, 2018, Chief Magistrate Judge Kelly issued a Report and Recommendation recommending that the Court grant the Motion for Application of Ohio Law as to the claims for negligence and negligence per se and deny it as to the ODTPA claim to the extent any Plaintiffs not located in Ohio sought to assert that claim. (ECF No. 147). On June 6, 2018, the Court adopted the Report and Recommendation. (ECF No. 152).

H. On August 27, 2018, Wendy’s filed a Motion for Judgment on the Pleadings (“MJP”), seeking dismissal of Plaintiffs’ claims for negligence and negligence per se on the grounds that they fail under Ohio law. (ECF 163). Plaintiffs have not responded to the MJP as the deadline for doing so has been extended by the Court in light of the mediation and settlement efforts.

I. This Settlement resulted from good faith, arm’s-length settlement negotiations, including one full-day mediation before the Honorable Edward Infante (Ret.) and two full-day mediation sessions before the Honorable Diane M. Welsh (Ret.). The Parties also participated in numerous direct discussions about possible resolution of the Litigation. The Parties did not discuss attorneys’ fees, costs, and expenses prior to agreeing to the essential terms of the Settlement.

J. Class Counsel conducted a thorough examination and evaluation of the relevant law and facts to assess the merits of the claims to be resolved in the Settlement and how best to serve the interests of the Settlement Class. Based on this investigation and the negotiations described above, Class Counsel have concluded, taking into account the sharply contested issues involved, the risks, uncertainty, and cost of further prosecution of the Litigation, and the substantial benefits to be received by the Settlement Class pursuant to this Settlement, that a settlement with Wendy’s on the terms set forth in this Settlement is fair, reasonable, adequate, and in the best interests of the Settlement Class.

K. Wendy’s denies all material allegations of the Complaint. Wendy’s specifically disputes that it is liable in any way for the Data Breach and that Plaintiffs and putative class members are entitled to any relief from Wendy’s. Nevertheless, given the risks, uncertainties, burden, and expense of continued litigation, Wendy’s has agreed to settle the Litigation on the terms set forth in this Settlement, subject to Court approval.

L. The Parties now agree to settle the Litigation in its entirety, without any admission of liability, with respect to all Released Claims. The Parties intend this Settlement to bind the Plaintiffs, Wendy’s, and all Settlement Class Members who do not timely and validly exclude themselves from the Settlement Class.


3

NOW, THEREFORE, in light of the foregoing, for good and valuable consideration, the receipt of which is hereby mutually acknowledged, it is hereby stipulated and agreed by the Parties that the Litigation be settled, compromised, and dismissed on the merits and with prejudice, subject to preliminary and final Court approval as required by Federal Rule of Civil Procedure 23, on the following terms and conditions:

II. DEFINITIONS

In addition to the terms defined at various points within this Settlement, the following defined terms apply throughout this Settlement:

1. “Alerted on Payment Card” means any payment card (including debit and credit cards) that was identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard, Discover, American Express, or JCB, including without limitation: (i) in an alert in the Visa US-2016-0183-PA series (e.g., US-2016-0183a-PA, US-2016-0183b-PA, US-2016-0183c-PA, US-2016-0183d-PA, US-2016-0183e-PA, US-2016-0183f-PA, US-2016-0183g-PA, US-2016-0183h-PA, US-2016-0183i-PA, US-2016-0183j-PA, US-2016-0183k-PA, US-2016-0183l-PA, US-2016-0183m-PA, US-2016-0183n-PA, US-2016-0183o-PA, US-2016-0183p-PA, US-2016-0183q-PA, US-2016-0183r-PA); (ii) in an alert in the MasterCard ADC0099-US-16-1 series and ADC001016-US-16 series (e.g., ADC001016-US-16-1, ADC001016-US-16-2, ADC001016-US-16-3, ADC001016-US-16-4, ADC001016-US-16-5, ADC001016-US-16-6, ADC001016-US-16-7, ADC001016-US-16-8, ADC001016-US-16-9, ADC001016-US-16-10, ADC001016-US-16-11, ADC001016-US-16-12, ADC001016-US-16-13, ADC0099-US-16-2, ADC0099-US-16-3, ADC0099-US-16-4, ADC0099-US-16-5); (iii) in an alert in the Discover DCA-USA-2016-6670, DCA-USA-2016-5283, and DCA-USA-2016-4698 series; (iv) in an alert or similar document by American Express similar to the foregoing Visa and MasterCard alerts; or (v) in an alert or similar document by JCB similar to the foregoing Visa and MasterCard alerts.

2. “Approved Claim” means a claim for Settlement benefits made using a Claim Form found to be valid by and in an amount approved by the Settlement Administrator.

3. “Association Plaintiffs” mean Credit Union National Association, Georgia Credit Union Affiliates, Indiana Credit Union League, Michigan Credit Union League, and Ohio Credit Union League.

4. “Claims Administration” means the processing of Claim Forms received from Settlement Class Members and the payment of Approved Claims by the Settlement Administrator, as well as any other duties and obligations of the Settlement Administrator as set forth in the Settlement.

5. “Claims Deadline” means the deadline by which Settlement Class Members must submit a claim for benefits under this Settlement. The Claims Deadline shall be 180 days after the Notice Deadline.


4

6. “Claim Form” shall mean the claim form attached as Attachment A to Exhibit 1 (including an electronic version thereof), or a claim form approved by the Court that is substantially similar to Attachment A to Exhibit 1.

7. “Class Counsel” means the Court-appointed co-lead counsel in the Litigation:

Erin Green Comite SCOTT+SCOTT ATTORNEYS AT LAW LLP 156 South Main Street Colchester, CT 06415

Gary F. Lynch CARLSON LYNCH SWEET KILPELA & CARPENTER, LLP 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222

8. “Complaint” means the operative Consolidated Amended Class Action Complaint (ECF No. 32), filed in the Litigation.

9. “Compromised Cards” means any payment card (including debit and credit cards) that was used to make a purchase during the period of the Data Breach at any Wendy’s franchisee restaurants impacted by the Data Breach.

10. “Costs of Settlement Administration” means all actual costs associated with or arising from Claims Administration, the Notice Program, and providing notice pursuant to the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1715(b). The Costs of Settlement Administration shall be paid to the Settlement Administrator as set forth in this Settlement.

11. “Court” means the United States District Court for the Western District of Pennsylvania.

12. “Data Breach” means the third-party criminal cyberattacks of certain of Wendy’s independently owned and operated franchisee restaurants involving malware variants targeting customers’ payment card information that Wendy’s reported in 2016, and that is the subject of the Litigation and Complaint.

13. “Effective Date” means the first business day after which all of the following events have occurred: (a) Class Counsel and Wendy’s counsel have executed this Settlement; (b) the Court has entered the Final Approval Order and Judgment without material change to either the Parties’ Settlement or agreed-upon proposed Final Approval Order and Judgment as described in this Settlement and attached as Exhibit 5; and (c) (i) the time for seeking rehearing, appellate, or other review of the Final Approval Order and Judgment has expired with no appeal, motion for rehearing, or motion for further review being filed, except specifically as described further in this definition, or (ii) the Settlement is affirmed on appeal or review without material change, no other appeal or petition for rehearing or review is pending, and the time period during which further petition for hearing, review, appeal, or certiorari could be taken has finally expired.


5

The Effective Date shall not be altered, precluded, or delayed in the event the Court declines to approve, in whole or in part, the payment of attorneys’ fees, costs, and expenses or Service Awards in the amounts that Class Counsel requests. Further, the Effective Date shall not be altered, precluded, or delayed in the event that an appeal is filed with the sole issues on appeal being the award of attorneys’ fees, costs, and/or expenses to Class Counsel and/or Service Awards. For purposes of the Effective Date, a “material change” includes, but is not limited to, the events set forth in Paragraph 73(a)-(e), as well as any modification to: (a) the entities included in the definition of Defendants’ Released Persons or Plaintiffs’ Released Person; (b) the definition of the Settlement Class; (c) the scope the claims released against the Defendants’ Released Persons; (d) the scope of the claims released against Plaintiffs’ Released Persons; (e) the scope of the Injunctive Relief agreed to by Wendy’s as set forth in this Settlement; (f) the amount of the Settlement Fund; and/or (g) the requirements for Settlement Class Members to exclude themselves from the Settlement.

14. “Final Approval” means the date that the Court enters an order and judgment granting final approval of the Settlement and determines the amount of fees, costs, and expenses awarded to Class Counsel and the amount of the Service Awards. In the event that the Court issues separate orders addressing the foregoing matters, then Final Approval means the date of the last of such orders.

15. “Final Approval Order and Judgment” means the order and judgment that the Court enters upon Final Approval and in the form of or materially in the form of the proposed Final Approval Order and Judgment attached as Exhibit 5. In the event that the Court issues separate orders addressing the matters constituting Final Approval, then the Final Approval Order and Judgment includes all such orders.

16. “Financial Institution Plaintiffs” means the following financial institutions named in the Complaint: First Choice Federal Credit Union, AOD Federal Credit Union, Tech Credit Union, Veridian Credit Union, South Florida Educational Federal Credit Union, Preferred Credit Union, Alcoa Community Federal Credit Union, Associated Credit Union, Envista Credit Union, Federal Deposit Insurance Corporation as Receiver for First NBC Bank (see ECF No. 126), Navigator Credit Union, The Seymour Bank, Financial Horizons Credit Union, Nusenda Credit Union, Greater Cincinnati Credit Union, Kemba Financial Credit Union, Wright-Patt Credit Union, and Members Choice Credit Union. For avoidance of doubt, the term does not include: Greenville Heritage Federal Credit Union, Centrue Bank, Align Credit Union, and North Jersey Federal Credit Union, each of which were voluntarily dismissed from the Litigation prior to the date of this Settlement. (ECF Nos. 77, 105, 114, 120).

17. “Litigation” means the consolidated action styled First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-506-NBF-MPK in the United States District Court for the Western District of Pennsylvania.

18. “Notice” means the notices of proposed class action settlement that the Parties will ask the Court to approve in connection with the motion for preliminary approval of the Settlement.


6

19. “Notice Deadline” means the date by which the Settlement Administrator is required to send out Mail Notice, which shall be thirty (30) days after entry of the Preliminary Approval Order unless a different deadline is set by the Court.

20. “Notice Program” means the notice plan and methods provided for in this Settlement and consists of (1) a direct mail notice to Settlement Class Members (“Mail Notice”); (2) Publication Notice (as described in more detail below); (3) notice posted on the Settlement Website; and (4) such other notice as is required by due process and Rule 23 of the Federal Rules of Civil Procedure. The Notice Program shall be effected in substantially the manner provided for in this Settlement.

21. “Objection Deadline” means 60 days after the Notice Deadline.

22. “Opt-Out Deadline” means 60 days after the Notice Deadline.

23. “Parties” means Wendy’s, the Association Plaintiffs, and the Financial Institution Plaintiffs, individually and on behalf of the Settlement Class.

24. “Plaintiffs” means the Association Plaintiffs and the Financial Institution Plaintiffs.

25. “Plaintiffs’ Released Persons” means Plaintiffs, their current and former parents, subsidiaries, affiliated companies, and divisions and Plaintiffs’ counsel of record in the Litigation.

26. “Preliminary Approval Order” means the order preliminarily approving the Settlement and, among other things, ordering that notice be provided to the Settlement Class, and in the form of or materially in the form of the proposed Preliminary Approval Order attached as Exhibit 4.

27. “Defendants’ Released Persons” means (a) The Wendy’s Company, Wendy’s Restaurants, LLC, Wendy’s International, LLC, and past and current Wendy’s Franchisees, (b) each of its or their respective current and former parents, subsidiaries, affiliated companies, and divisions, whether indirect or direct, and (c) the respective predecessors, successors, directors, officers, employees, principals, agents, attorneys, insurers, reinsurers, shareholders, members, advisors, consultants, representatives, partners, joint venturers, and assigns of each of the entities and persons listed in sections (a) and (b) of this Paragraph.

28. “Releasing Parties” means Plaintiffs and all Settlement Class Members who do not timely and validly exclude themselves from the Settlement, and each of these entities’ current and former parents, subsidiaries, affiliated companies, divisions, as well as these entities’ heirs, assigns, beneficiaries, and successors.

29. “Service Award” means a payment of $7,500 to each Financial Institution Plaintiff that was deposed and $2,500 to each Financial Institution Plaintiff that was not deposed, subject to Court approval, in compensation for their involvement in this Litigation and service on


7

behalf of other financial institutions. Any Service Awards will be paid out of the Settlement Fund.

30. “Settlement Agreement” or “Settlement” means this settlement agreement and release, including exhibits hereto.

31. “Settlement Administrator” means the entity to be selected by Class Counsel, subject to approval of Wendy’s, which shall not be unreasonably withheld, and approved by the Court to effectuate the Notice Program and Claims Administration per the terms of this Settlement.

32. “Settlement Class Members” or “Settlement Class” means all persons and entities that fall within the settlement class definition set forth in this Settlement.

33. “Settlement Class Representatives” means the Financial Institution Plaintiffs.

34. “Settlement Fund” means a non-reversionary fund in the amount of fifty million dollars ($50,000,000.00) to be used to pay claims of Settlement Class Members, all attorneys’ fees, costs, and expenses approved by the Court, Costs of Settlement Administration, taxes, and Service Awards approved by the Court.

35. “Settlement Website” means the website that the Settlement Administrator will establish as soon as practicable following preliminary approval, but no later than the Notice Deadline, as a means for Settlement Class Members to obtain notice of and information about the Settlement, through and including hyperlinked access to this Settlement, the Notice, the order preliminarily approving this Settlement, the Claim Form, the Complaint, and such other documents as Class Counsel and Wendy’s agree to post or that the Court orders posted on the website. These documents shall remain on the Settlement Website at least 60 days after the Effective Date. The URL of the Settlement Website shall be agreed upon by Class Counsel and Wendy’s. Settlement Class Members shall also be able to submit Claim Forms electronically via the Settlement Website. The Settlement Website shall not include any advertising and shall remain operational until at least 60 days after the Effective Date.

36. “Wendy’s” means The Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC.

37. “Wendy’s Franchisees” means any individual or entity that has entered into an agreement with Wendy’s or a current or past affiliate or related company of Wendy’s to own or operate one or more Wendy’s-branded restaurants, including franchise owners, guarantors, operators, partners, members, and shareholders.

III. SETTLEMENT CLASS

38. For settlement purposes only, the Parties agree that the Court should certify the following class pursuant to Federal Rule of Civil Procedure 23(b)(3), defined as:


8


39. For settlement purposes only, Class Counsel shall seek, and Wendy’s shall not oppose, the appointment of Class Counsel as settlement class counsel and the appointment of the Financial Institution Plaintiffs as Settlement Class Representatives. Settlement Class Representatives will move for provisional certification of the Settlement Class for settlement purposes only contemporaneously with their motion for preliminary approval of the Settlement. Wendy’s agrees not to contest provisional certification of the Settlement Class for settlement purposes only.

IV. SETTLEMENT CONSIDERATION

40. Settlement Fund. Wendy’s agrees to pay fifty million dollars ($50,000,000.00), inclusive of attorneys’ fees, costs, and expenses, Service Awards, taxes, and the Costs of Settlement Administration, into a fund to compensate Settlement Class Members on the following terms:

a. Within forty-five (45) calendar days of the Effective Date, Wendy’s shall cause to be deposited the sum of fifty million dollars ($50,000,000.00) into an escrow account established by the Settlement Administrator to create the Settlement Fund, less the Costs of Settlement Administration incurred by this date. Class Counsel and/or the Settlement Administrator shall timely furnish to Wendy’s any required account information, wiring instructions or necessary forms before the payment is made. The Settlement Fund shall be a Court-approved Qualified Settlement Fund for federal tax purposes pursuant to Treas. Reg. § 1.468B-1. The Settlement Administrator shall be responsible for all administrative, accounting and tax compliance activities in connection with the Settlement Fund and the monies deposited into the Settlement Fund, including any filing necessary to obtain Qualified Settlement Fund status pursuant to Treas. Reg. § l .468B-l. Wendy’s shall provide to the Settlement Administrator any documentation necessary to facilitate obtaining Qualified Settlement Fund status for the Settlement Fund pursuant to Treas. Reg. § 1.468B- l. All taxes on income or interest generated by the Settlement Fund, if any, shall be paid out of the Settlement Fund.

b. Disbursements from the Settlement Fund will be made to (i) pay any taxes due on the Settlement Fund; (ii) pay all attorneys’ fees, costs, and expenses approved by the Court; (iii) pay Service Awards approved by the Court; (iii) pay the Costs of Settlement Administration; and (iv) pay Settlement Class Members as set forth in the Distribution Plan attached hereto as Exhibit 1. The Parties intend that, after these payments and disbursements are made,


9

there will be no funds remaining. Nonetheless, to the extent any funds remain, no portion of the Settlement Fund will be returned to Wendy’s.

41. Injunctive Relief. In partial consideration of the full settlement and release of all Released Claims against Defendants’ Released Persons, Wendy’s, subject to Board approval, agrees to adopt and/or maintain the following measures with respect to its Company-owned U.S. restaurants and systems (unless otherwise specified below) (the “Measures”), within thirty (30) days of issuance of the Final Approval Order and Judgment, except as set forth below.

a. Wendy’s will continue to design and implement reasonable safeguards to manage its data security risks, including by: continuing to maintain and periodically re-evaluate its Information Security Policy and Incident Response Plan or similar document; continuing to maintain monitoring for indicators of compromise on Wendy’s computer network endpoints, to the extent required by Payment Card Industry Data Security Standards (“PCI DSS”); continuing to deploy anti-virus protections on Wendy’s-owned store-based IT assets, to the extent required by PCI DSS; continuing to reasonably segment Wendy’s network topology; continuing to conduct regular penetration testing.

b. Wendy’s will either (a) continue to maintain Wendy’s Technology, LLC (“WeTech”) or a similar entity, which will offer to Wendy’s Franchisees certain Foundational Security Services, as may be amended from time to time in the WeTech Products and Services Agreement or any similar document or (b) require Wendy’s Franchisees to use a Wendy’s-approved third-party vendor(s) for similar services; and

c. Wendy’s will continue to maintain and update as needed the information security standards in its Franchisee Operations Manual or a similar document that is distributed to Wendy’s Franchisees, and the manual or other similar document will continue to include information regarding the Wendy’s Franchisees’ independent obligations to comply with PCI DSS pursuant to the card brand rules.

42. The Measures set forth above will be materially maintained for at least two (2) years following the Effective Date, subject to any of the following: (a) a determination by a majority of the non-management directors that the Measure is no longer in the best interest of Wendy’s, including, but not limited to, due to circumstances making the Measure no longer applicable, feasible, or available on commercially reasonable terms; (b) a determination by the Wendy’s officer designated as the head of Wendy’s cybersecurity program and approved by a majority of the members of the Board’s Technology Committee that the Measure is no longer in the best interest of Wendy’s, including, but not limited to, due to circumstances making the Measure no longer applicable, feasible, or available on commercially reasonable terms; or (c) modifications which Wendy’s reasonably believes are required by applicable law or regulation.


10

V. PRELIMINARY APPROVAL

43. Upon execution of this Settlement, Class Counsel shall promptly move the Court for an order granting preliminary approval of this Settlement, substantially in the form of Exhibit 4. The motion for preliminary approval shall request that the Court: (1) preliminarily approve the terms of the Settlement as within the range of fair, adequate, and reasonable; (2) provisionally certify the Settlement Class pursuant to Federal Rule of Civil Procedure 23(b)(3) and (e) for settlement purposes only; (3) approve the Settlement Administrator, Notice Program set forth herein, the form and content of the Notice, and the Claim Form; (4) approve the procedures set forth in this Settlement for Settlement Class Members to exclude themselves from the Settlement Class or to object to the Settlement; (5) stay all proceedings in the Litigation unrelated to the Settlement pending Final Approval of the Settlement; (6) stay and/or enjoin, pending Final Approval of the Settlement, any actions brought by Settlement Class Members concerning any Released Claims; (7) appoint Class Counsel and Settlement Class Representatives; and (8) schedule a Final Approval hearing at a date that provides sufficient time for the deadlines contemplated by this Settlement and that is convenient for the Court, at which the Court will conduct an inquiry into the fairness of the Settlement, determine whether it was made in good faith and should be finally approved, and determine whether to approve Class Counsel’s application for attorneys’ fees, costs, and expenses and Service Awards (“Final Approval Hearing”).

44. Within ten (10) days of the filing of the motion for preliminary approval, Wendy’s shall serve or cause to be served a notice of the proposed Settlement on appropriate state officials in accordance with the requirements under CAFA.

VI. SETTLEMENT ADMINISTRATOR

45. The Settlement Administrator shall administer various aspects of the Settlement and perform such other functions as are specified for the Settlement Administrator elsewhere in this Settlement, including, but not limited to, overseeing administration of the Settlement Fund; providing Notice to Settlement Class Members as described in this Settlement; effecting Publication Notice; establishing and operating the Settlement Website and a toll-free number; administering the claims processes; and distributing cash payments according to the processes and criteria established by this Settlement.

46. The duties of the Settlement Administrator, in addition to other responsibilities that are described in this Settlement, include:

a. Implementing the Notice Program required by this Settlement;

b. Establishing and maintaining a post office box for mailed written notifications of exclusion from the Settlement Class;

c. Establishing and maintaining the Settlement Website;


11

d. Establishing and maintaining a toll-free telephone line for Settlement Class Members to call with Settlement Agreement-related inquiries, and answering the questions of Settlement Class Members who call with or otherwise communicate such inquiries;

e. Responding to any mailed Settlement Class Member inquiries;

f. Processing all written notifications of exclusion from the Settlement Class and providing deficiency notices as set forth herein;

g. Providing weekly reports and, no later than fifteen (15) days after the Opt-Out Deadline, a final report to Class Counsel and Wendy’s, that summarize the number of written notifications of exclusion received that week, the total number of written notifications of exclusion received to date, and other pertinent information as requested by Class Counsel and Wendy’s counsel;

h. In advance of the Final Approval Hearing, preparing an affidavit to submit to the Court that: (i) attests to implementation of the Notice Program in accordance with the Preliminary Approval Order; and (ii) identifies each Settlement Class Member who timely and validly provided written notification of exclusion from the Settlement Class;

i. Reviewing, determining the validity of, and responding to all claims submitted by Settlement Class Members, pursuant to criteria established by this Settlement Agreement;

j. After the Effective Date, processing and transmitting distributions to Settlement Class Members that submitted Approved Claims;

k. Providing weekly reports and a final report to Class Counsel and Wendy’s that summarize the number of claims since the prior reporting period, the total number of claims received to date, the number of any claims approved and denied since the prior reporting period, the total number of claims approved and denied to date, and other pertinent information as requested by Class Counsel and Wendy’s counsel; and

l. Performing any function related to Claims Administration at the agreed-upon instruction of the Parties, including, but not limited to, verifying that cash payments have been distributed in accordance with this Settlement.

47. Class Counsel shall have the right, to be exercised in their sole discretion, but not the obligation, to advise the Settlement Administrator to waive what Class Counsel reasonably deems to be formal or technical defects in any Claim Forms submitted, including, without limitation, failure to submit a Claim Form by the Claims Deadline, in the interests of achieving substantial justice.


12

VII. NOTICE, OPT-OUTS, AND OBJECTIONS

48. Upon preliminary approval of the Settlement, at the direction of Class Counsel, the Settlement Administrator will begin implementing the Notice Program provided herein, using the forms of Notice approved by the Court in the Preliminary Approval Order. The Notice will include, among other information: a description of the material terms of the Settlement; a date by which Settlement Class Members may object to the Settlement; the date upon which the Final Approval Hearing will occur; and the address of the Settlement Website at which Settlement Class Members may access this Settlement and other related documents and information.

49. The Notice Program has three components: (1) Mail Notice; (2) Publication Notice; and (3) Notice on the Settlement Website. The Notice Program is to be implemented as follows:

a. Within fourteen (14) days after entry of the Preliminary Approval Order, Class Counsel will provide, or will cause to be provided, available contact information to the Settlement Administrator for banks, credit unions, and other financial institutions that are potentially Settlement Class Members. Based upon information obtained from Class Counsel and from other reasonably available sources, the Settlement Administrator will prepare a final list of potential Settlement Class Members to which Notice will be issued.

b. Mail Notice will be sent to those on the final list by the Notice Deadline. The Mail Notice shall consist of the long-form notice in the form attached hereto as Exhibit 2 and Claim Form. For any Mail Notices that are returned undeliverable with forwarding address information, the Settlement Administrator shall re-mail the Mail Notice to the updated address as indicated. For any Mail Notices that are returned undeliverable without forwarding address information, the Settlement Administrator shall use reasonable efforts to identify updated mailing addresses (such as running the mailing address through the National Change of Address Database) and re-mail the Mail Notice to the extent updated addresses are identified. The Settlement Administrator need only make one attempt to re-mail any Mail Notices that are returned as undeliverable.

c. The Settlement Administrator will cause to be published in the digital edition of the ABA Banking Journal and/or other publications typically read by bank and credit union executives the summary notice attached hereto as Exhibit 3. The publications in which the notice will appear and the dates and frequency of the Publication Notice will be determined by the Settlement Administrator in consultation with the Parties. The Settlement Administrator may also utilize other means of Publication Notice in consultation with Parties.

d. The Settlement Administrator will send out at least one reminder mailing during the claims period to those Settlement Class Members that have not yet filed claims.


13

e. The Settlement Administrator will establish a toll-free number to respond to inquiries from Settlement Class Members by the Notice Deadline.

f. By the Notice Deadline, the Settlement Administrator will create and maintain the Settlement Website, which will contain the information and documents required by this Settlement. The Settlement Website will be configured so that Settlement Class Members may file claims electronically.

g. The Parties agree to provide any additional notice that the Court determines is necessary to meet the requirements of due process or Rule 23 of the Federal Rules of Civil Procedure, the cost of which shall be deemed part of the Costs of Settlement Administration and paid from the Settlement Fund as provided for in the Settlement.

50. The Notice shall include a procedure for Settlement Class Members to exclude themselves from the Settlement by notifying in writing the Settlement Administrator, Class Counsel, and Wendy’s of their intent to exclude themselves from the Settlement. The notice shall be sent via first class postage pre-paid United States mail to the addresses provided in the Notice. Such written notification must be postmarked no later than the Opt-Out Deadline, as specified in the Notice. The written notification must include the name of this Litigation (First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.)); the full name, address, and telephone number of the Settlement Class Member; the name, address, email address, telephone number, position, and signature of the individual who is acting on behalf of the Settlement Class Member; the words “Request for Exclusion” at the top of the document or a statement in the body of the document requesting exclusion from the Settlement; and the total number of payment cards issued by the Settlement Class Member that were identified as having been at risk as a result of the Data Breach in any alerts or similar documents by Visa, MasterCard, Discover, American Express, and JCB. The Settlement Administrator shall provide the Parties with copies of all opt-out notifications on a weekly basis, and a final list of all who have timely and validly excluded themselves from the Settlement, which Class Counsel may move to file under seal with the Court no later than ten (10) days prior to the Final Approval Hearing. Any Settlement Class Member who does not provide a timely notice or who does not provide all information required by this Settlement to exclude itself shall be bound by the terms of the Settlement, including all releases in the Settlement.

51. In the event that a Settlement Class Member purports to provide notice of its intention to opt-out of the Settlement but fails to provide all of the information set forth above, including specifically the identification of the number of payment cards issued by the Settlement Class Member that were identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard, Discover, American Express, and JCB, the Settlement Administrator shall, within five (5) days of receiving the deficient notice, send the Settlement Class Member a deficiency notice. The deficiency notice shall inform the Settlement Class Member that its attempt to opt out is deficient, invalid, and without legal effect. The deficiency notice shall be sent by the Settlement Administrator via email and, if email is not feasible, then by USPS Priority Express mail. The deficiency notice shall also inform the Settlement Class Member that it must re-submit to an email address to be provided by the Claims


14

Administrator a valid notice requesting exclusion that includes all of the required information, including but not limited to the number of payment cards identified as at risk, no later than ten (10) days from the date of the deficiency notice in order for its opt out to be effective. If the Settlement Class Member fails to provide all of the required information on or before that deadline, then its attempt to opt out shall be invalid and have no legal effect, and the Settlement Class Member shall be bound by the Settlement, including the releases.

52. The Notice shall also include a procedure for Settlement Class Members to object to the Settlement, Class Counsel’s request for attorneys’ fees, costs, and expenses, and/or the application for Service Awards. Objections to the Settlement, Class Counsel’s request for attorneys’ fees, costs, and expenses, and/or to the application for Service Awards must be filed electronically with the Court, or mailed to the Clerk of the Court, Class Counsel, and Wendy’s counsel. For an objection to be considered by the Court, the objection must be: (a) electronically filed by the Objection Deadline; or (b) mailed first-class postage prepaid to the Clerk of Court, Class Counsel, and Wendy’s counsel, at the addresses listed in the Notice, and postmarked by no later than the Objection Deadline, as specified in the Notice. For an objection to be considered by the Court, the objection must also set forth:

a. the name of the Litigation (First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.));

b. the full name of the objector and the full name, address, email address, and telephone number of the person acting on its behalf;

c. an explanation of the basis upon which the objector claims to be a Settlement Class Member;

d. whether the objection applies only to the objector, to a specific subset of the Settlement Class, or to the entire Settlement Class;

e. all grounds for the objection stated with specificity, accompanied by any legal support for the objection;

f. the identity of all counsel who represent the objector, including any former or current counsel who may be entitled to compensation for any reason related to the objection to the Settlement Agreement, Class Counsel’s request for attorney’s fees, costs, and expenses, or the application for Service Awards;

g. the identity of all representatives (including counsel representing the objector) who will appear at the Final Approval Hearing;

h. the number of times in which the objector has objected to a class action settlement within the five years preceding the date that the objector files the objection, the caption of each case in which the objector has made such objection, and a copy of any orders related to or ruling upon the objector’s


15

prior such objections that were issued by the trial and appellate courts in each listed case;

i. the number of times in which the objector’s counsel and/or counsel’s law firm have objected to a class action settlement within the five years preceding the date that the objector files the objection, the caption of each case in which the counsel or the firm has made such objection, and a copy of any orders related to or ruling upon counsel’s or the firm’s prior such objections that were issued by the trial and appellate courts in each listed case;

j. if the objector is represented by an attorney who intends to seek fees and expenses from anyone other than the objectors he or she represents, the objection should also include: (i) a description of the attorney’s legal background and prior experience in connection with class action litigation; (ii) the amount of fees sought by the attorney for representing the objector and the factual and legal justification for the fees being sought; (iii) a statement regarding whether the fees being sought are calculated on the basis of a lodestar, contingency, or other method; (iv) the number of hours already spent by the attorney and an estimate of the hours to be spent in the future; and (v) the attorney’s hourly rate.

k. any and all agreements that relate to the objection or the process of objecting, whether written or verbal, between the objector or objector’s counsel and any other person or entity;

l. a description of all evidence to be presented at the Final Approval Hearing in support of the objection, including a list of any witnesses, a summary of the expected testimony from each witness, and a copy of any documents or other non-oral material to be presented;

m. a statement indicating whether the objector intends to personally appear and/or testify at the Final Approval Hearing; and

n. the objector’s signature on the written objection (an attorney’s signature is not sufficient).

53. In addition, any Settlement Class Member that objects to the proposed Settlement must make itself available to be deposed regarding the grounds for its objection and must provide along with its objection the dates when the objector will be available to be deposed during the period from when the objection is filed through the date five (5) days before the Final Approval Hearing.

54. Any Settlement Class Member who both objects to the Settlement Agreement and opts out will be deemed to have opted out and the objection shall be deemed null and void.


16

55. The Mail Notice shall be sent or issued by the Notice Deadline, excluding any re-mails for Mail Notices that are returned undeliverable and any reminder mail notices to be sent during the claims period.

56. At least thirty-five (35) days before the Final Approval Hearing, the Settlement Administrator shall provide Class Counsel and Wendy’s with one or more affidavits confirming that the Notice Program was completed in accordance with the Parties’ instructions and the Court’s approval. Class Counsel shall file such affidavit(s) with the Court as an exhibit to or in conjunction with Settlement Class Representatives’ motion for final approval of the Settlement Agreement.

57. Wendy’s will pay all Costs of Settlement Administration incurred by the Settlement Administrator up to the date the Settlement Fund is funded. All Costs of Settlement Administration incurred by Wendy’s up to the date the Settlement Fund is funded shall be credited against the amount Wendy’s is to pay or cause to be paid into the Settlement Fund. After the Settlement Fund is funded, all Costs of Settlement Administration shall be paid directly from the Settlement Fund.

58. In the event that the Settlement is not approved or if Wendy’s elects to terminate the Settlement and a Settlement Fund is not created, Wendy’s will not be entitled to a return of any of the monies it has paid to the Settlement Administrator for the Costs of Settlement Administration up to that point. Class Counsel and the Settlement Administrator will take reasonable steps to ensure that no further Costs of Settlement Administration are incurred thereafter without Wendy’s express written approval.

VIII. FINAL APPROVAL ORDER AND JUDGMENT

59. Settlement Class Representatives’ motion for preliminary approval of the Settlement will include a request to the Court for a scheduled date on which the Final Approval Hearing will occur, which shall be sufficiently far in advance to allow for the deadlines contemplated by this Settlement. The Final Approval Hearing shall be scheduled no earlier than 90 days after the CAFA notices are mailed to ensure compliance with 28 U.S.C § 1715. By no later than 30 days prior to the Final Approval Hearing, Class Counsel shall file a motion for final approval of the Settlement and a motion for attorneys’ fees, costs, and expenses and for Service Awards. Objectors, if any, shall file any response to Class Counsel’s motions no later than 17 days prior to the Final Approval Hearing. By no later than 10 days prior to the Final Approval Hearing, responses shall be filed, if any, to any filings by objectors, and any replies in support of final approval of the Settlement and/or Class Counsel’s application for attorneys’ fees, costs, and expenses and for Service Awards shall be filed. At the Final Approval Hearing, the Court will consider the motion for final approval of the Settlement, and Class Counsel’s application for attorneys’ fees, costs, and expenses and for Service Awards. In the Court’s discretion, the Court also may hear argument at the Final Approval Hearing from any Settlement Class Members (or their counsel) who objects to the Settlement, Class Counsel’s application for attorneys’ fees, costs, expenses, and/or Service Awards, provided the objectors filed timely objections that meet all of the requirements listed in this Settlement.


17

60. At or following the Final Approval Hearing, the Court will determine whether to enter the Final Approval Order and Judgment granting final approval of the Settlement, and whether to approve Class Counsel’s request for attorneys’ fees, costs, expenses, and Service Awards. The proposed Final Approval Order and Judgment that will be filed with the motion for final approval shall be in a form agreed upon by Class Counsel and Wendy’s as set forth in Exhibit 5. Such proposed Final Approval Order and Judgment shall, among other things:

a. Determine that the Settlement is fair, adequate, and reasonable;

b. Finally certify the Settlement Class for settlement purposes only;

c. Determine that the notice provided satisfied Federal Rule of Civil Procedure 23 and Due Process requirements;

d. Dismiss all claims in the Complaint and the Litigation with prejudice;

e. Bar and enjoin the Releasing Parties from asserting any of the Released Claims, including during the pendency of any appeal from the Final Approval Order and Judgment;

f. Release and forever discharge Wendy’s and Defendants’ Released Persons from the Released Claims and release Plaintiffs’ Released Persons as provided in this Settlement Agreement; and

g. Reserve the Court’s continuing and exclusive jurisdiction over Wendy’s and all Settlement Class Members (including all objectors) to administer, supervise, construe, and enforce this Settlement in accordance with its terms.

IX. RELEASES

61. As of the Effective Date, the Releasing Parties, each on behalf of itself and any predecessors, successors, or assigns, shall automatically be deemed to have fully, completely, finally, irrevocably, and forever released and discharged Defendants’ Released Persons of and from any and all liabilities, rights, claims, actions, causes of action, demands, damages, penalties, costs, attorneys’ fees, losses, and remedies, whether known or unknown (including Unknown Claims), existing or potential, suspected or unsuspected, liquidated or unliquidated, legal, statutory, or equitable, that result from, arise out of, are based upon, or relate to the Data Breach, including, without limitation, any claims, actions, causes of action, demands, damages, penalties, losses, or remedies relating to, based upon, resulting from, or arising out of (1) Wendy’s information security policies and practices; (2) the allegations, facts, and/or circumstances described in the Litigation and/or Complaint; (3) Wendy’s response to and notices about the Data Breach; (4) the fraudulent use of any Compromised Cards or Alerted on Payment Cards; (5) the cancellation and reissuance of any Compromised Cards or Alerted on Payment Cards; and (6) any expenses incurred investigating, responding to, or mitigating potential


18

damage from the theft or illegal use of Compromised Cards or Alerted on Payment Cards or information relating to such cards (the “Released Claims”).

62. For the avoidance of doubt, the Released Claims include, without limitation, any claims, causes of actions, remedies, or damages that were or could have been asserted in the Litigation, and also include, without limitation, any claims that a Releasing Party may have under the law of any jurisdiction, including, without limitation, those arising under state or federal law of the United States (including, without limitation, any causes of action under the California Business & Professions Code § 17200 et seq., California Civil Code § 1750 et seq., California Civil Code § 1798.80 et seq., California Civil Code § 56.10 et seq., and any similar statutes or data breach notification statutes in effect in the United States or in any states in the United States); causes of action under the common or civil laws of any state in the United States, including but not limited to: unjust enrichment, negligence, bailment, conversion, negligence per se, breach of contract, breach of implied contract, breach of fiduciary duty, breach of implied covenant of good faith and fair dealing, misrepresentation (whether fraudulent, negligent, or innocent), fraudulent concealment or nondisclosure, invasion of privacy, public disclosure of private facts, and misappropriation of likeness and identity; any causes of action based on privacy rights provided for under the constitutions of the United States or of any states in the United States; any statutory claims under state or federal law; and also including, but not limited to, any and all claims in any state or federal court of the United States, for damages, injunctive relief, restitution, disgorgement, declaratory relief, equitable relief, attorneys’ fees and expenses, pre-judgment interest, credit or financial account monitoring services, identity theft insurance, the creation of a fund for future damages, statutory penalties, restitution, the appointment of a receiver, and any other form of relief.

63. As of the Effective Date, Defendants’ Released Persons will be deemed to have completely released and forever discharged the Releasing Parties and Plaintiffs’ Released Persons from and for any and all liabilities, claims, cross-claims, causes of action, rights, actions, suits, debts, liens, contracts, agreements, damages, costs, attorneys’ fees, losses, expenses, obligations, or demands, of any kind whatsoever, whether known or unknown, existing or potential, or suspected or unsuspected, whether raised by claim, counterclaim, setoff, or otherwise, including any known or unknown claims, which they have or may claim now or in the future to have, relating to the institution, prosecution, or settlement of the Litigation. For the avoidance of doubt, Defendants’ Released Persons’ release as set forth in this Paragraph 63 does not include entities that do not meet the definition of either Releasing Parties or Plaintiffs’ Released Persons. For the further avoidance of doubt, Defendants’ Released Persons’ release as set forth in this Paragraph 63 does not include WAND Corporation, Trustwave, Trustwave Holdings, Inc., NCR, or DUMAC Business Systems, Inc.

64. “Unknown Claims” means any of the Released Claims that any Settlement Class Member, including any of the Settlement Class Representatives, does not know or suspect to exist in its favor at the time of the release of the Defendants’ Released Persons that, if known by it, might have affected its settlement with, and release of, the Defendants’ Released Persons, or might have affected its decision not to object to and/or to participate in this Settlement. With respect to any and all Released Claims, the Parties stipulate and agree that upon the Effective Date, the Settlement Class Representatives expressly shall have, and each of the other Settlement


19

Class Members shall be deemed to have, and by operation of the Final Approval Order and Judgment shall have, waived the provisions, rights, and benefits conferred by California Civil Code § 1542 to the extent applicable, and also any and all provisions, rights, and benefits conferred by any law of any state, province, or territory of the United States (including, without limitation, Montana Code Ann. § 28-1-1602; North Dakota Cent. Code § 9-13-02; and South Dakota Codified Laws § 20-7-11), which is similar, comparable, or equivalent to California Civil Code §1542, which provides:

A general release does not extend to claims which the creditor does not know

or suspect to exist in his or her favor at the time of executing the release,

which if known by him or her must have materially affected his or her

settlement with the debtor.

Settlement Class Members, including the Settlement Class Representatives, and any of them, may hereafter discover facts in addition to, or different from, those that they now know or believe to be true with respect to the subject matter of the Released Claims, but the Settlement Class Representatives expressly shall have, and each other Settlement Class Member shall be deemed to have, and by operation of the Final Approval Order and Judgment shall have, upon the Effective Date, fully, finally, and forever settled and released any and all Released Claims, including Unknown Claims. The Parties acknowledge, and Settlement Class Members shall be deemed by operation of the Final Approval Order and Judgment to have acknowledged, that the foregoing waiver is a material element of the Settlement Agreement of which this release is a part.

65. As of the Effective Date, the Settlement Class Members shall be enjoined from prosecuting any claim they have released in this Settlement in any proceeding against any of the Defendants’ Released Persons or based on any actions taken by any of the Defendants’ Released Persons that are authorized or required by this Settlement or by the Final Approval Order and Judgment. It is further agreed that the Settlement may be pleaded as a complete defense to any proceeding or action asserting claims released by this Settlement.

X. ATTORNEYS’ FEES, COSTS, EXPENSES AND SERVICE AWARDS

66. Service Awards. Class Counsel will ask the Court to approve, and Wendy’s will not oppose, Service Awards of $7,500 to each of the fifteen (15) Financial Institution Plaintiffs that were deposed and $2,500 to each of the remaining three (3) Financial Institution Plaintiffs that were not deposed to compensate them their efforts in the Litigation and commitment on behalf of the Settlement Class. Any Service Awards approved by the Court will be paid from the Settlement Fund. Neither Class Counsel’s application for, nor any individual’s entitlement to, a Service Award shall be conditioned in any way upon such individual’s support for this Settlement.


20

67. Attorneys’ Fees, Costs, and Expenses. Class Counsel will request 30% of the gross Settlement Fund, including any interest earned thereon, from the Court for their attorneys’ fees and will additionally request reimbursement of their reasonable costs and expenses from the Settlement Fund. Wendy’s agrees not to oppose Class Counsel’s request for attorneys’ fees and reimbursement of reasonable costs and expenses from the Settlement Fund. For the avoidance of doubt, all attorneys’ fees (including any interest earned thereon), costs, and expenses, and Service Awards approved by the Court shall be paid from the Settlement Fund.

68. Within fifty-five (55) days of the Effective Date, the Settlement Administrator shall wire Court approved attorneys’ fees, costs, and expenses and Service Awards into an account designate by Class Counsel.

69. Class Counsel, in their sole discretion, shall allocate and distribute the amount of attorneys’ fees and costs and expenses awarded by the Court among Plaintiffs’ counsel of record.

70. In the event the Court declines to approve, in whole or in part, the payment of attorneys’ fees, costs, and expenses and/or Service Awards in the amounts requested by Class Counsel, the remaining provisions of this Settlement shall remain in full force and effect. No order of the Court, or modification or reversal or appeal of any order of the Court, concerning solely the amount(s) of attorneys’ fees, costs, and expenses and/or Service Awards shall constitute grounds for cancellation or termination of this Settlement.

XI. TERMINATION

71. Wendy’s shall have the sole discretion to terminate the Settlement Agreement if Settlement Class Members representing a certain number of Alerted on Payment Cards elect to opt out of the Settlement Class. That number is separately agreed to by the Parties and will be submitted to the Court for in camera review if requested. If Wendy’s elects to terminate the Settlement Agreement, it must notify Class Counsel that it intends to pursue that right pursuant to this provision, if any such right exists, no later than thirty-five (35) days after the Opt-Out Deadline.

72. If the requirements to terminate the Settlement Agreement set forth in Paragraph 71 are met and Wendy’s provides Class Counsel with notice of its intent to terminate the Settlement Agreement, Class Counsel will have 60 days from the date of such notice for the purposes of communicating with any opt-outs to attempt to have such Settlement Class Members withdraw their opt-outs and remain in the Settlement Class. The Parties will use their best efforts to resolve any issues of Settlement Class Members who have elected to opt-out, and Wendy’s agrees to cooperate fully with respect to the handling of opt-outs, including communicating to any would-be opt-outs at Class Counsel’s request, to attempt to have such Settlement Class Members revoke their opt-outs and remain in the Settlement Class. Specifically, at the request of Class Counsel, Wendy’s agrees to write a pre-prepared letter, subject to approval of Class Counsel, requesting any would-be opt-out to remain in the Settlement Class. This letter will be used only after a Settlement Class Member submits an opt-out notice.


21

73. This Settlement Agreement may be terminated by either Settlement Class Representatives or Wendy’s by serving on counsel for the opposing Party and filing with the Court a written notice of termination within fourteen (14) days (or such longer time as may be agreed between Class Counsel and Wendy’s) after any of the following occurrences:

a. Class Counsel and Wendy’s agree to termination before the Effective Date;

b. The Court rejects, materially modifies, materially amends or changes, or declines to preliminarily or finally approve, the Settlement;

c. An appellate court reverses the Final Approval Order and Judgment, and the Settlement is not reinstated and finally approved without material change by the Court on remand;

d. The Court or any reviewing appellate court incorporates material terms or provisions into, or deletes or strikes material terms or provisions from, or materially modifies, amends, or changes, the proposed Preliminary Approval Order, the Preliminary Approval Order, the proposed Final Approval Order and Judgment, the Final Approval Order and Judgment, or the Settlement; or

e. The Effective Date does not occur.

74. In the event of a termination as provided for in the Settlement, the Settlement shall be considered null and void; all of the Parties’ obligations under the Settlement shall cease to be of any force and effect and the Parties shall return to the status quo ante in the Litigation as if the Parties had not entered into this Settlement. In addition, in the event of such a termination, all of the Parties’ respective pre-Settlement claims and defenses will be preserved, including all defenses to class certification. Further, if Wendy’s elects to terminate the Settlement pursuant to Paragraph 71 and the case goes back into litigation, Wendy’s will not oppose, and will join in Plaintiffs’ request for, the immediate opening of full discovery. Wendy’s also will agree to return to mediation.

XII. NO ADMISSION OF LIABILITY

75. Wendy’s disputes the claims alleged in the Litigation and does not by this Settlement or otherwise admit any liability or wrongdoing of any kind. Wendy’s has agreed to enter into this Settlement solely to avoid the further expense, inconvenience, and distraction of burdensome and protracted litigation, and to be completely free of any further claims that were asserted or could have been asserted in the Litigation.

76. Class Counsel and Settlement Class Representatives believe that the claims asserted in the Litigation have merit, and they have examined and considered the benefits to be obtained under the Settlement, the risks associated with the continued prosecution of this complex, costly, and time-consuming Litigation, and the likelihood of success on the merits of the Litigation. Class Counsel and Settlement Class Representatives have concluded that the


22

Settlement Agreement is fair, adequate, reasonable, and in the best interests of the Settlement Class Members.

77. The Parties understand and acknowledge that this Settlement constitutes a compromise and settlement of disputed claims. No action taken by the Parties either previously or in connection with the negotiations or proceedings connected with this Settlement shall be deemed or construed to be an admission of the truth or falsity of any claims or defenses heretofore made, or an acknowledgment or admission by any party of any fault, liability, or wrongdoing of any kind whatsoever.

78. Neither the Settlement, nor any act performed or document executed pursuant to or in furtherance of the Settlement: (a) is or may be deemed to be, or may be used as, an admission of, or evidence of, the validity of any claim made by Plaintiffs or Settlement Class Members, or of any wrongdoing or liability of the Defendants’ Released Persons; or (b) is or may be deemed to be, or may be used as, an admission of, or evidence of, any fault or omission of any of the Defendants’ Released Persons, in the Litigation or in any proceeding in any court, administrative agency, or other tribunal.

XIII. MISCELLANEOUS

79. In no event shall the total amount of Approved Claims, attorneys’ fees, costs, and expenses, Service Awards, Costs of Settlement Administration, taxes, and any other fees, costs, expenses, payments, or any other obligations incurred by Wendy’s under this Settlement exceed the Settlement Fund.

80. Confidentiality. Plaintiffs’ counsel and the Parties agree that they will not make the Settlement public until the Settlement Agreement is filed with the Court for preliminary approval. Plaintiffs’ counsel and Wendy’s will work together in good faith to jointly agree to language regarding the initial public announcement/communication concerning the Settlement. Plaintiffs’ counsel and Wendy’s will also work together in good faith to jointly agree to any public statements after the initial public announcement / communication, including responding to any inquiries from the media concerning the Litigation and Settlement and posting to publicly available websites, unless otherwise agreed by the Parties. The limitations in this Paragraph 80 shall not apply to: (1) communications between Plaintiffs’ counsel and their clients (including Settlement Class Members); (2) any SEC or other contractual or legal disclosure obligations that Wendy’s may have; (3) Wendy’s communications with its employees or Wendy’s Franchisees, including in franchisee disclosure documents as it deemed necessary and appropriate; (4) the ability of the Parties to communicate with the payment card brands about the Settlement, in order to facilitate notice to the class, as provided in the Settlement Agreement; (5) the ability of Wendy’s to notify its insurers about the Settlement; (6) the ability of the Parties to communicate with necessary third parties for the purpose of facilitating the administration of the Settlement.

81. Settlement Fund Escrow Bank. Class Counsel, subject to Wendy’s approval which shall not be unreasonably withheld, shall select the Settlement Fund Escrow account and the Settlement Fund Escrow Bank. The Settlement Fund Escrow Bank shall invest the


23

Settlement Fund exclusively in an interest-bearing account or accounts where the principle will not decrease and is fully insured by the United States Government or an agency thereof, including certificates of deposit, a U.S. Treasury Fund or a bank account that is either (a) fully insured by the Federal Deposit Insurance Corporation (“FDIC”) or (b) secured by instruments backed by the full faith and credit of the United States Government. The Settlement Fund Escrow Bank shall reinvest the proceeds of these instruments as they mature in similar instruments at their then-current market rates. Wendy’s shall not bear any responsibility for or liability related to the investment of the Settlement Fund by the Settlement Fund Escrow Bank.

82. Singular and Plurals. As used in this Settlement, all references to the plural shall also mean the singular and all references to the singular shall also mean the plural whenever the context so indicates.

83. Binding Effect. This Settlement shall be binding upon, and inure to the benefit of, the successors and assigns of the Releasing Parties and the Defendants’ Released Persons.

84. Settlement Class Member Communications. Other than at Class Counsel’s request, Wendy’s shall not communicate with any Settlement Class Member during the pendency of the settlement approval process regarding this Litigation, the decision to opt-out, or relief being awarded in the Settlement, and represents that it has not previously so communicated with any Settlement Class Members regarding these topics. For purposes of clarity, this provision restricts only communications regarding the Litigation and/or Settlement; it does not purport to limit any other communications.

85. Cooperation of Parties. The Parties to this Settlement agree to cooperate in good faith to prepare and execute all documents, to seek Court approval, defend Court approval, and to do all things reasonably necessary to complete and effectuate the settlement described in this Settlement. Nothing in this provision is intended to limit any Party’s right to terminate the Settlement in accordance with its terms.

86. Obligation To Meet And Confer. Before filing any motion in the Court raising a dispute arising out of or related to this Settlement, the Parties shall consult with each other and certify to the Court that they have consulted in good faith.

87. Entire Agreement. This Settlement (along with any Exhibits attached and the agreements referenced in Paragraphs 71 and 80) constitutes a single, integrated written contract expressing the entire agreement of the Parties relative to the subject matter hereof. No covenants, agreements, representations, or warranties of any kind whatsoever have been made by any Party hereto, except as provided for herein.

88. No Conflict Intended. Any inconsistency between the headings used in this Settlement and the text of the paragraphs of this Settlement shall be resolved in favor of the text.

89. Governing Law. The Settlement shall be construed in accordance with, and be governed by, the laws of the State of Ohio, without regard to the principles thereof regarding choice of law.


24

90. Counterparts. This Settlement may be executed in any number of counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument, even though all signatories do not sign the same counterparts. Original signatures are not required. Any signature submitted by facsimile or through email of an Adobe PDF shall be deemed an original.

91. Jurisdiction. The Court shall retain jurisdiction over the implementation, enforcement, and performance of this Settlement, and shall have exclusive jurisdiction over any suit, action, proceeding or dispute arising out of or relating to this Settlement that cannot be resolved by negotiation and agreement by counsel for the Parties. The Court shall retain jurisdiction with respect to the administration, consummation, and enforcement of Settlement and shall retain jurisdiction for the purpose of enforcing all terms of the Settlement. The Court shall also retain jurisdiction over all questions and/or disputes related to the Notice Program and the Settlement Administration. As part of its agreement to render services in connection with this Settlement Agreement, the Settlement Administrator shall consent to the jurisdiction of the Court for this purpose.

92. Notices. All notices to Class Counsel provided for herein, shall be sent by overnight mail and email to:

Erin Green Comite SCOTT+SCOTT ATTORNEYS AT LAW LLP 156 South Main Street Colchester, CT 06415 [email protected]

Gary F. Lynch CARLSON LYNCH SWEET KILPELA & CARPENTER, LLP 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222 [email protected]

All notices to Wendy’s provided for herein, shall be sent by overnight mail and email to:

Kristine M. Brown Donald M. Houser ALSTON & BIRD LLP 1201 West Peachtree Street Atlanta, GA 30309 [email protected] [email protected]

The notice recipients and addresses designated above may be changed by written notice. Upon the request of any of the Parties, the Parties agree to promptly provide each other with copies of objections, requests for exclusion, or other filings received as a result of the Notice Program.


25

93. Authority. Any person executing this Settlement in a representative capacity represents and warrants that he or she is fully authorized to do so and to bind the Party on whose behalf he or she signs this Settlement to all of the terms and provisions of this Settlement.

94. No Construction Against Drafter. This Settlement shall be deemed to have been drafted by the Parties, and any rule that a document shall be interpreted against the drafter shall not apply to this Settlement.


26

Date: February 12, 2019

Erin Green Comite SCOTT+SCOTT ATTORNEYS AT LAW LLP 156 South Main Street P.O. Box 192 Colchester, CT 06415

Kristine M. Brown ALSTON & BIRD LLP 1201 West Peachtree Street, NE Atlanta, GA 30309

Counsel for Wendy’s

Gary F. Lynch CARLSON LYNCH SWEET KILPELA & CARPENTER, LLP 1133 Penn Avenue, 5th Floor Pittsburg, PA 15222

Counsel for Plaintiffs and Settlement Class




EXHIBIT 1


Exhibit 1 to the Settlement Agreement

Distribution Plan for the $50,000,000 Settlement Fund

1. Definitions. Terms defined in the Settlement Agreement to which this document is an exhibit are incorporated herein by reference. In addition, as used herein, the terms set forth in this section in boldface type will have the meaning described below. Additional terms are defined at various points in this Distribution Plan.

1.1 Claim Referee. This term means a person selected by the Parties to handle certain disputes relating to claims. A Claim Referee need not be selected or approved until and unless a dispute arises that cannot otherwise be resolved pursuant to the procedure set forth in Section 5 below. Any amounts paid to a Claim Referee will be made from the Settlement Fund.

1.2 Claimed-On Card. An Alerted on Payment Card that was issued by a Settlement Class Member and for which the Settlement Class Member seeks compensation under the Settlement.

1.3 Disputed Claim. This term has the meaning set forth in Section 5.1.

1.4 Distribution Fund. This term has the meaning set forth in Section 4.1

1.5 Cash Payment Award. This term has the meaning set forth in Section 2.1.

1.6 Supplemental Remainder. This term has the meaning set forth in Section 4.4.

2. Claims. All Settlement Class Members that submit a valid, properly completed Claim Form on or before the Claims Deadline are eligible to receive a Cash Payment Award without proof of documentation.

2.1 Cash Payment Awards. A Settlement Class Member can seek a cash payment based on the number of Alerted on Payment Cards that the Settlement Class Member issued. To be eligible to receive a Cash Payment Award, a Settlement Class Member must timely (i.e., on or before the Claims Deadline) submit a valid Claim Form and properly complete the form, providing all requested information. Settlement Class Members do not need to submit any documentation in order to be eligible to receive a Cash Payment Award. Each Settlement Class Member that timely submits a valid Claim Form and properly completes the form will be eligible for (1) a payment per Claimed-On Card issued by such Settlement Class Member (“Cash Payment Award”); and (2) a possible additional supplemental payment if funds remain in the Settlement Fund after (a) any taxes have been paid; (b) Costs of Settlement Administration have been paid; and (c) attorneys’ fees, expenses, costs, and Service Awards have been paid; and (d) all Approved Claims have been paid. The amount actually paid to Settlement Class Members per Claimed-On Card will depend upon the number of claims received as well as


2

the actual amount of taxes, Costs of Settlement Administration, and attorneys’ fees, expenses, costs, and Service Awards.

2.2 Claim Form. The Claim Form to be used by Settlement Class Members seeking Cash Payment Awards is attached as Attachment A. To receive a Cash Payment Award, Settlement Class Members must complete, sign, and timely submit the Claim Form.

3. Claim Validation Process

3.1 All Claim Forms must be submitted in the manner and by the Claims Deadline specified in the Settlement.

3.2 The Settlement Administrator will begin evaluating timely Claim Forms on or after the Effective Date. The Settlement Administrator may require supplementation of a Claim Form or additional information necessary to validate or audit a claim. To the extent that a Settlement Class Member fails to provide any supplementation or additional information so requested, the Settlement Administrator may determine that the Settlement Class Member failed to submit a valid claim and therefore reject that claim.

3.3 The Settlement Administrator, in its discretion to be reasonably exercised, will evaluate claims submitted for Cash Payment Awards to determine whether: (a) the claimant is a Settlement Class Member; (b) the Claim Form is complete and accurate; and (c) the Settlement Class Member signed the Claim Form as required.

4. Distribution of the Settlement Fund. Following the Claim Validation Process, the Settlement Administrator will distribute the Settlement Fund as follows:

4.1 Funds Available for Distribution to Settlement Class Members. The amount of the Settlement Fund available for distribution to Settlement Class Members (the “Distribution Fund”) shall equal (i) the amount of the Settlement Fund, less (ii) any taxes, Costs of Settlement Administration, attorneys’ fees, costs, and expenses, and Service Awards as further described in the Settlement Agreement.

4.2 Payment of Cash Payment Awards. Each Settlement Class Member that submits a valid claim will receive a Cash Payment Award per Claimed-On Card. Each Settlement Class Member’s Cash Payment Award shall be calculated as follows: (Distribution Fund / total number of Claimed-On Cards submitted in all timely and valid Claim Forms) x the number of the Settlement Class Member’s Claimed-On Cards as submitted in a timely and valid Claim Form.

4.3 Potential Supplemental Awards. If after payment of the Cash Payment Awards the Distribution Fund is not exhausted, then the remaining amounts (the “Supplemental Remainder”) will be distributed pro rata to all Settlement Class Members that submitted a timely and valid Claim Form based on the number of


3

Claimed-On Cards that they issued, provided that to do so is administratively feasible, and otherwise to cy pres entities that will be selected by Class Counsel and approved by the Court.

5. Dispute Resolution

5.1 If the Settlement Administrator determines that (i) a Settlement Class Member’s number of Claimed-On Cards is fewer than the number claimed by such issuer in its Claim Form (a “Disputed Claim”), the Settlement Administrator will notify the claimant by email to the email address identified in the Claim Form (or a mailing address for those that do not provide an email address).

5.2 Each recipient of any notice pursuant to Section 5.1 herein will have ten (10) days from receipt of such notice to respond to the Settlement Administrator by reply email (or regular mail for those that did not provide an email address) by stating whether the claimant accepts or rejects the Settlement Administrator’s determination regarding the Disputed Claim. If claimant fails to timely respond to the notice provided pursuant to Section 5.1, then the Settlement Administrator’s determination regarding the Disputed Claim shall be deemed final and accepted by the claimant.

5.2.1 If the claimant rejects the Settlement Administrator’s determination regarding the Disputed Claim, the Settlement Administrator will have ten (10) days to reconsider the original determination, make a final determination, and communicate the final determination to the claimant by email (or regular mail for those that did not provide an email address). The claimant will then have 10 days to reply back to the Settlement Administrator to accept or reject the final determination. If claimant fails to timely respond to the notice provided pursuant to Section 5.2.1, then the claimant shall be deemed to have accepted the Settlement Administrator’s final determination.

5.2.2 If the claimant accepts the final determination, then the Settlement Administrator’s final determination regarding the Disputed Claim will be used in calculating the Settlement Class Member’s Cash Payment Award. If the final determination regarding the Disputed Claim is timely rejected by the claimant, then the Disputed Claim will be resolved in accordance with the procedures set out in Sections 5.3 and 5.4 below.

5.3 After receipt of a claimant’s rejection of a final determination regarding a Disputed Claim, the Settlement Administrator will provide Class Counsel and Wendy’s Counsel (together “Counsel”) with a copy of the Claim Form and any documentation submitted by the claimant, and the communications between the Settlement Administrator and the claimant (the “Claim File”).

5.3.1 Counsel will confer regarding the Disputed Claim.


4

5.3.2 If Counsel agree, as applicable, that a claimant issued the number of Claimed-On Cards claimed on its Claim Form, Counsel’s determination will be final. Counsel will inform the Settlement Administrator of their determination by email, and the Settlement Administrator will provide notice of the decision to the claimant.

5.3.3 If Counsel agree, as applicable, that a claimant issued fewer than the number of Claimed-On Cards claimed on its Settlement Fund Claim Form, then Counsel will notify the Settlement Administrator by email (“Counsel’s Notice”) and, if the Settlement Class Member continues to dispute Counsel’s determination, the Disputed Claim at issue will be submitted to the “Claim Referee.” The Parties need not select a Claim Referee unless and until such time as one is needed.

5.3.4 If Counsel disagree, as applicable, during the inquiries described in 5.3.2 or 5.3.3, the Disputed Claim(s) at issue will be submitted to the Claim Referee.

5.4 After receipt of Counsel’s Notice, the Settlement Administrator will provide the Claim Referee with a copy of the Claim File. The Claim Referee will make a final determination regarding the Disputed Claim. All such final determinations will be made by the Claim Referee based on whether the number of Claimed-On Cards at issue in the Disputed Claim, or some portion thereof, is reasonably supported in fact. The Claim Referee’s decision will be final.


ATTACHMENT A


1

• Use this form if your financial institution is a Settlement Class Member that is entitled to claim into the $50 million ($50,000,000) Settlement Fund.

• Fill out this form if your financial institution wants to receive a payment per eligible card. No documentation is needed.

Materials to Gather to Complete this Form: The number of payment card accounts your financial institution issued that were identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard, Discover, American Express, or JCB.

SETTLEMENT CLASS MEMBER INFORMATION

Name of Financial Institution / Settlement Class Member

Name of Person Filling Out This Form

Your Title in the Financial Institution

Mailing Address

City State Zip Code

Daytime Phone

— —

E-Mail Address (if provided, we will communicate primarily by email about your claim)

COMPLETE AND SIGN THIS FORM AND SUBMIT ONLINE NO LATER THAN ______, 2019 at

[WEBSITE] or

SUBMIT BY MAIL POSTMARKED BY ___, 2019 at Wendy’s Data Breach Settlement, c/o___________, Settlement Administrator,

_____________


2

CERTIFICATION OF PAYMENT CARDS: Please complete all parts of the question below:

Is your financial institution the issuer of one or more payment cards that were identified in any of the categories of alertsor similar documents below? (Check All Applicable Boxes Below.)

If you check “YES” for any category of alert(s) (or similar documents), indicate how many payment card accounts your financial institution issued that were identified in the referenced alert(s) or similar documents. For purposes of completing this form, please note that a payment card number can have only one corresponding payment card account, even if your financial institution issued multiple payment cards bearing the card number.

(a) Visa alert(s) in the US-2016-0183-PA series YES NO

Number of Issued Accounts Identified in These Alerts

(b) MasterCard alert(s) in the ADC0099-US-16-1 series or ADC001016-US-16 series, YES NO

Number of Issued Accounts Identified in These Alerts:

(c) Discover cards alert(s) in the DCA-USA-2016-6670, DCA-USA-2016-5283, and DCA-USA-2016-4698 series YES NO

Number of Issued Accounts Identified in These Alerts:

(d) American Express alert(s) or similar documents relating to the Wendy’s data breach YES NO

Number of Issued Accounts Identified in These Alerts/ Documents:

(e) JCB alert(s) or similar documents relating to the Wendy’s data breach YES NO

Number of Issued Accounts Identified in These Alerts/ Documents:

If you are unable to answer YES to any part of Question 1 then your financial institution is not a Settlement Class

Member and is not eligible to participate in this Settlement. Please do not submit a form.

SIGN CLAIM FORM By submitting this Claim Form, the above-named Settlement Class Member certifies that it is eligible to make a claim in this settlement and that the information provided in this claim form is true and correct. The above-named Settlement Class Member understands that this claim may be subject to audit, verification, and Court review.

Signature of Duly Authorized Representative of Settlement Class Member Date

Print Name Title

CLAIM SUBMISSION REMINDERS

• You may submit your claim by mail or through the website at [WEBSITE].

• Please keep a copy of this claim form if submitting by mail.

• Claims must be submitted through the website by ____________, 2019, or mailed so they are postmarked, by _____________, 2019.


EXHIBIT 2


Questions? Call 1-XXX-XXX-XXXX toll free, or visit [Website]

1

UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA

If your financial institution issued one or more payment cards that was identified as having been at risk as a result of the data breach that Wendy’s

announced in 2016, it could get a payment from a class action settlement.

A federal court authorized this notice. This is not a solicitation from a lawyer.

• A settlement has been proposed to resolve lawsuits against The Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC (“Wendy’s”) brought by financial institutions and associations as a result of third-party criminal cyberattacks of certain of Wendy’s independently owned and operated franchisee restaurants involving malware variants targeting customers’ payment card information that Wendy’s reported in 2016 (the “Data Breach”).

• The lawsuits, referred to collectively as First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.), allege that Wendy’s is legally responsible for the Data Breach and assert claims for negligence, negligence per se, violation of the Ohio Deceptive Trade Practices Act, as well as for declaratory and injunctive relief. Wendy’s denies these allegations and says it did not do anything wrong.

• Under the Settlement, Wendy’s will pay $50 million into a Settlement Fund to be distributed to Settlement Class Members who timely submit valid claims. All Settlement Class Members are eligible to receive a cash payment for each payment card that was identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard, Discover, American Express, or JCB, without providing any documentation of their losses. The amount of the cash payment will depend on the total number of eligible payment cards submitted by Settlement Class Members, the Costs of Settlement Administration, taxes paid on the Settlement Fund, and the amount of attorneys’ fees, costs, and expenses, and Service Awards approved by the Court. By way of example, if valid claims are submitted for all eligible cards, it is estimated that Settlement Class Members would receive approximately $2.00 per eligible payment card. If, for example, 40% of eligible payment cards are submitted, then Settlement Class Members would receive approximately $4.80 per eligible payment card. These are examples. The per-card amount actually paid may be higher or lower.

• In addition, Wendy’s has agreed to adopt and/or maintain certain practices related to its data security. If approved by the Court, reasonable attorneys’ fees, costs, and expenses will be paid out of the Settlement Fund. In addition, if approved by the Court, service awards of $7,500 to each class representative that sat for a deposition and $2,500 to the remaining class representatives will be paid out of the Settlement Fund. Costs of Settlement Administration and any taxes on the Settlement Fund will also be paid out of the Settlement Fund.

Your financial institution’s legal rights are affected whether you act or don’t act. Read this notice carefully.

SUBMIT A CLAIM FORM If eligible, your financial institution will receive a cash payment. This is the

only way to get compensation from the Settlement.

EXCLUDE YOUR

FINANCIAL INSTITUTION

If you ask to be excluded, you will not receive a cash payment, but you may be

able to file your own lawsuit against Wendy’s and its franchisees for the same

claims. This is the only option that leaves your financial institution the right to

file its own lawsuit against Wendy’s, its franchisees, and/or Defendants’

Released Persons (defined in Settlement) for the claims that are being resolved

by the Settlement. In order to be effective, a request to be excluded from the

Settlement must include all information required by the Settlement.

OBJECT Your financial institution can remain in the Settlement Class and file an

objection telling the Court why you do not like the Settlement. If your

objections are overruled, your financial institution will be bound by the

Settlement.



2

DO NOTHING If you do nothing, you will not receive any cash payment. If you do nothing,

you will also forfeit your right to sue or bring any claim against Wendy’s, its

franchisees, and/or Defendants’ Released Persons (defined in Settlement)

related to the Data Breach.

• These rights and options—and the deadlines to exercise them—are explained in this notice.

• The Court in charge of this case still has to decide whether to approve the Settlement. Payments will be made if the Court approves the Settlement and after any appeals are resolved. Please be patient.



3

Basic Information............................................................................................................. Page X

1. Why did my financial institution get this notice package? 2. What is this lawsuit about? 3. Why is this a class action? 4. Why is there a settlement?

Who is Part of the Settlement ......................................................................................... Page X

5. How does a financial institution know if it is part of the settlement? 6. Are there exceptions to being included? 7. I am still not sure if my financial institution is included.

The Settlement Benefits ................................................................................................... Page X

8. What does the settlement provide? 9. How much will my financial institution’s payment be?

How To Get a Payment – Submitting a Claim Form ................................................... Page X

10. How can my financial institution get a payment? 11. When would my financial institution get its payment? 12. What is my financial institution giving up to get a payment or remain in the Settlement Class?

Excluding Your Financial Institution from the Settlement ......................................... Page X

13. How can my financial institution opt out of the settlement? 14. If my financial institution doesn’t opt out, can it sue Wendy’s or its franchisees for the same thing later? 15. If my financial institution excludes itself, can it get money from this settlement?

The Lawyers and Financial Institutions Representing You ........................................ Page X

16. Does my financial institution have a lawyer in the case? 17. How will the lawyers and financial institutions representing the class be paid?

Objecting to the Settlement ............................................................................................. Page X

18. How does a financial institution tell the Court that it does not like the settlement? 19. What is the difference between objecting and excluding/opting out?

The Court’s Final Approval Hearing ............................................................................. Page X

20. When and where will the Court decide whether to approve the settlement? 21. Does my financial institution have to attend the hearing?

If You Do Nothing ............................................................................................................ Page X

22. What happens if my financial institution does nothing at all?

Getting More Information .............................................................................................. Page X

23. How do I get more information?

WHAT THIS NOTICE CONTAINS



4

BASIC INFORMATION

Your financial institution may have issued payment cards identified in one of the alerts (or a similar document) sent out by the card brands (Visa, MasterCard, American Express, Discover, or JCB) related to the Data Breach.

The Court authorized this notice because you have a right to know about your financial institution’s rights under a proposed class action settlement before the Court decides whether to approve the Settlement. If the Court approves the Settlement, and after objections and appeals are resolved, a settlement administrator appointed by the Court will make the cash payments that the Settlement allows.

This package explains the lawsuits, the Settlement, your financial institution’s rights, what benefits are available, who is eligible for them, and how to get them.

The Court in charge of the case is the United States District Court for the Western District of Pennsylvania, and the case is known as First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.). The financial institutions and associations who sued are called “Plaintiffs,” and the company they sued, Wendy’s, is the “Defendant.”

The lawsuits, referred to collectively as First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.), allege that Wendy’s is legally responsible for the Data Breach and assert claims for negligence, negligence per se, violation of the Ohio Deceptive Trade Practices Act, as well as for declaratory and injunctive relief. The financial institutions seek to recover damages in the lawsuits for the expense of payment card reissuance, amounts paid to cover fraudulent payment card charges, and other costs allegedly incurred as a result of the Data Breach. Wendy’s denies any wrongdoing.

In a class action, one or more entities called “class representatives” sue on behalf of themselves and other entities with similar claims. All of these entities together are the “class” or “class members.” One court resolves the issues for all class members, except for those who exclude themselves from the settlement class.

The Court has not decided in favor of Plaintiffs or Wendy’s. Instead, both sides, with the assistance of a mediator, agreed to the Settlement. The Settlement is not an admission that Wendy’s did something wrong, but rather a compromise to end the lawsuits. By agreeing to settle, both sides avoid the costs, risks, and uncertainties of a trial and related appeals, while providing benefits to members of the Settlement Class. The Settlement Class Representatives and the attorneys for the Settlement Class think the Settlement is best for all class members.

WHO IS PART OF THE SETTLEMENT

Your financial institution is a member of the Settlement Class and affected by the Settlement if:

• It is a financial institution, bank, credit union, or other entity in the United States (including its Territories and the District of Columbia); and

• It issued one or more payment card (including debit and credit cards) that was identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard,

1. Why did my financial institution get this notice package?

2. What is this lawsuit about?

3. Why is this a class action?

4. Why is there a settlement?

5. How does a financial institution know if it is part of the settlement?



5

Discover, American Express, or JCB, including without limitation: (i) in an alert in the Visa US-2016-0183-PA series (e.g., US-2016-0183a-PA, US-2016-0183b-PA, US-2016-0183c-PA, US-2016-0183d-PA, US-2016-0183e-PA, US-2016-0183f-PA, US-2016-0183g-PA, US-2016-0183h-PA, US-2016-0183i-PA, US-2016-0183j-PA, US-2016-0183k-PA, US-2016-0183l-PA, US-2016-0183m-PA, US-2016-0183n-PA, US-2016-0183o-PA, US-2016-0183p-PA, US-2016-0183q-PA, US-2016-0183r-PA); (ii) in an alert in the MasterCard ADC0099-US-16-1 series and ADC001016-US-16 series (e.g., ADC001016-US-16-1, ADC001016-US-16-2, ADC001016-US-16-3, ADC001016-US-16-4, ADC001016-US-16-5, ADC001016-US-16-6, ADC001016-US-16-7, ADC001016-US-16-8, ADC001016-US-16-9, ADC001016-US-16-10, ADC001016-US-16-11, ADC001016-US-16-12, ADC001016-US-16-13, ADC0099-US-16-2, ADC0099-US-16-3, ADC0099-US-16-4, ADC0099-US-16-5); (iii) in an alert in the Discover DCA-USA-2016-6670, DCA-USA-2016-5283, and DCA-USA-2016-4698 series; (iv) in an alert or similar document by American Express similar to the foregoing Visa and MasterCard alerts; or (v) in an alert or similar document by JCB similar to the foregoing Visa and MasterCard alerts.

Specifically excluded from the Settlement Class is the judge presiding over this matter and any members of her judicial staff, Wendy’s, and persons who timely and validly request exclusion from the Settlement Class.

If your financial institution excludes itself from the Settlement, it is no longer part of the Settlement Class and will no longer be eligible to receive any of the Settlement benefits. This process of excluding your financial institution is also referred to as “opting out” of the Settlement.

If you are still not sure whether your financial institution is included, you can ask for free help. You can call 1-XXX-XXX-XXXX or visit [website] for more information. Or you can fill out and return the Claim Form described in Question 10, to see if you qualify.

THE SETTLEMENT BENEFITS

Wendy’s will pay $50 million ($50,000,000) into a Settlement Fund to compensate Settlement Class Members, pay the Costs of Settlement Administration and any taxes on the Settlement Fund; and, subject to the Court’s approval, pay the reasonable attorneys’ fees, costs, and expenses of the lawyers who represent the Settlement Class. Service awards of $7,500 to each of 15 class representative that sat for a deposition and $2,500 to the remaining three class representatives will also be paid out of the Settlement Fund, if the Court approves. In addition, Wendy’s has agreed to adopt and/or maintain certain practices related to its data security.

If your financial institution is eligible to participate in the Settlement and does not “opt out” of the Settlement, it may be eligible for benefits under the Settlement. If your financial institution issued any payment cards (including debit and credit cards) that were identified as having been at risk as a result of the Data Breach in an alert (or similar document) by Visa, MasterCard, Discover, American Express, or JCB, it may be eligible for a payment from the $50 million Settlement Fund.

All Settlement Class Members who file a valid claim are eligible to get a cash payment from the Settlement Fund per each payment card (including debit and credit cards) that was identified as having been at risk as a result of the Data Breach in an alert (or similar document) by Visa, MasterCard, Discover, American Express, or JCB. You are not required to submit any documentation or evidence of your financial institution’s losses to receive a payment. The amount of the cash payment will depend on the total number of eligible payment cards submitted by Settlement Class Members, the Costs of Settlement Administration, taxes paid on the Settlement Fund, and the amount of

6. Are there exceptions to being included?

7. I am still not sure if my financial institution is included.

8. What does the settlement provide?

9. How much will my financial institution’s payment be?



6

attorneys’ fees, costs, and expenses, and Service Awards approved by the Court. By way of example, if valid claims are submitted for all eligible cards, it is estimated that Settlement Class Members would receive approximately $2.00 per eligible payment card. If, for example, 40% of eligible payment cards are submitted, then Settlement Class Members would receive approximately $4.80 per eligible payment card. These are examples. The per-card amount actually paid may be higher or lower.

HOW TO GET A PAYMENT – SUBMITTING A CLAIM FORM

To qualify for a payment, you must validly complete and submit a Claim Form, which is included with this Notice. You may also get this Claim Form on the internet at [Website]. All Settlement Class Members that wish to obtain compensation must complete and submit the Claim Form. No documentation of losses is required.

To properly complete and timely submit a Claim Form, you should read the instructions carefully, include all information required by the Claim Form, sign it, and either submit the signed Claim Form electronically through [Website] by _______, 2019 or mail it to the Settlement Administrator postmarked no later than ______, 2019 at the following address:

[Settlement Administrator Address Info]

The Settlement Administrator will review your claim to determine the amount of your financial institution’s payment.

The Court will hold a hearing on _________________ to decide whether to approve the Settlement. If the Court approves the Settlement, there may be appeals. It is always uncertain whether these appeals can be resolved and resolving them takes time, perhaps more than a year. Payments to Settlement Class Members will be made after the Settlement is finally approved and any appeals or other required proceedings have been completed as set forth in the Settlement. You may visit [Website] for updates on the progress of the Settlement. Please be patient.

Unless you exclude your financial institution from the Settlement, your financial institution cannot sue, or be part of any other lawsuit against, Wendy’s, its franchisees, or Defendants’ Released Persons (as defined in Settlement) relating to the Data Breach. The specific claims your financial institution is giving up against Wendy’s and its franchisees are described in the Settlement. The terms of the release are described in Section IX of the Settlement. Read it carefully. The Settlement is available at [Website].

If you have any questions, you can talk to the law firms listed in Question 16 for free, or you can, of course, talk to your own lawyer if you have questions about what this means.

If your financial institution wants to keep its rights to sue Wendy’s and its franchisees based on claims this Settlement resolves, your financial institution must take steps to exclude itself from the Settlement Class (seeQuestions 13-15).

EXCLUDING YOUR FINANCIAL INSTITUTION FROM THE SETTLEMENT

To exclude your financial institution from the Settlement, or “opt out,” you must send a letter by U.S. Mail that includes the information in the bullet points below. If you fail to include this information, the notice of exclusion will be ineffective and the Settlement Class Member will be bound by the Settlement, including all releases.

10. How can my financial institution get payment?

11. When would my financial institution get its payment?

12. What is my financial institution giving up to get a payment or remain in the Settlement Class?

13. How can my financial institution opt out of the settlement?



7

• The name of this Litigation (First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.));

• Your financial institution’s full name, address, and phone number; • The words “Request for Exclusion” at the top of the document or a statement in the body of the

document requesting exclusion from the Settlement Class; • The name, address, email address, telephone number, position, and signature of the individual who is

acting on behalf of the Settlement Class Member; and • The total number of payment cards issued by your financial institution that were identified as having

been at risk as a result of the Data Breach in any alerts (or similar documents) by Visa, MasterCard, Discover, American Express, and JCB.

You must mail via first class postage prepaid United States mail the completed above-described letter, postmarked no later than ___________________, 2019, to each of the following addresses:

Settlement Administrator Settlement Class Counsel Defense Counsel

Wendy’s Data Breach Settlement c/o _____ P.O. Box _____ ________


Kristine M. Brown Donald M. Houser ALSTON & BIRD LLP 1201 West Peachtree Street Atlanta, GA 30309

If you ask to be excluded, your financial institution will not get any payment as part of this Settlement, and you cannot object to this Settlement. Your financial institution will not be legally bound by anything that happens in the Settlement and related proceedings. Your financial institution may be able to sue (or continue to sue) Wendy’s and its franchisees in the future. If you object to the Settlement and seek to exclude your financial institution, you will be deemed to have excluded your financial institution.

No. Unless you exclude your financial institution from the Settlement, your financial institution gives up any right to sue Wendy’s and its franchisees (as further detailed in the Settlement) for the claims that this Settlement resolves. If you have a pending lawsuit, speak to your lawyer in that case immediately. Your financial institution must exclude itself from this Settlement to continue its own lawsuit. Remember, the exclusion deadline is ______, 2019.

No. If you exclude your financial institution, do not send in a Claim Form asking for a payment.

THE LAWYERS AND FINANCIAL INSTITUTIONS REPRESENTING YOU

Yes. The Court appointed to represent your financial institution and other members of the Settlement Class the following law firms: Carlson Lynch Sweet Kilpela & Carpenter, LLP, in Pittsburgh, Pennsylvania; and Scott+Scott Attorneys at Law, LLP, in Colchester, Connecticut. You will not be charged for these lawyers. If you want to be represented by your own lawyer, you may hire one at your own expense.

In July 2016, the Court appointed a legal team of seven law firms from around the country to represent Plaintiffs. None of the lawyers has yet received any payment for their time or expenses. The lawyers intend to ask the Court to

14. If my financial institution doesn’t opt out, can it sue Wendy’s or its franchises for the same thing later?

15. If my financial institution excludes itself, can it get money from this settlement?

16. Does my financial institution have a lawyer in the case?

17. How will the lawyers and financial institutions representing the Settlement Class be paid?



8

approve an award of 30% of the gross Settlement Fund in attorneys’ fees, including any interest earned thereon, to compensate them for their time and the financial risk that they undertook when they agreed to represent the Plaintiffs on a contingent basis, which means that they would receive a fee only if the lawsuits were successful. In addition, the lawyers intend to ask the Court to reimburse them for all of the expenses they have incurred. Wendy’s has agreed not to object to the lawyers’ motion to the Court to seek a reasonable attorneys’ fee and reimbursement of expenses and these amounts will be paid out of the Settlement Fund.

The Settlement Class is represented by 18 financial institutions from 16 states. In addition to the benefits that the financial institution class representatives will receive as members of the Settlement Class and subject to the approval of the Court, Wendy’s has agreed to pay service awards of $7,500 to each of the fifteen Settlement Class Representatives that sat for a deposition and $2,500 to the remaining three Settlement Class Representatives for the efforts that they have expended on behalf of the Settlement Class. The amount of the service awards approved by the Court will be paid from the Settlement Fund.

The Court will determine whether to approve the amount of fees and expenses requested by Plaintiffs’ lawyers and the proposed service awards to the Settlement Class Representatives at the Final Approval Hearing scheduled for _________________, 2019. Plaintiffs’ lawyers will file an application for fees, expenses, and service awards 30 days before the Final Approval Hearing. The application will be available on the Settlement Website ([Website]) or you can request a copy by contacting the Settlement Administrator (see Question 23).

OBJECTING TO THE SETTLEMENT

If your financial institution is a Settlement Class Member, you can object to the Settlement if you do not think it is fair, reasonable, or adequate. You can give reasons why you think the Court should not approve it. The Court will consider your views. If you object to the Settlement and seek to exclude your financial institution, your financial institution will be deemed to have excluded itself.

Your objection must be in writing, shall not exceed twenty-five (25) pages, and must include:

• The name of this Litigation (First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.));

• Your financial institution’s full name, and the full name, address, email address, and telephone number of the person acting on its behalf;

• An explanation of the basis for why your financial institution is a Settlement Class Member; • Whether the objection applies only to your financial institution, to a specific subset of the Settlement Class,

or to the entire Settlement Class; • All grounds for the objection stated with specificity, accompanied by any legal support for the objection; • A description of all evidence to be presented at the Final Approval Hearing in support of the objection,

including a list of any witnesses, a summary of the expected testimony from each witness, and a copy of any documents or other non-oral material to be presented;

• All other information specified in the Preliminary Approval Order (available on the settlement website, [Website]), including but not limited to information relating to any objections you or your counsel have filed in other class action litigation; and

• Your signature on the written objection.

Any objection must be either filed electronically with the Court or mailed to the Clerk of the Court, Class Counsel, and Wendy’s counsel at the addresses set forth below. The objection must be electronically filed, or if mailed postmarked, no later than ___________________, 2019.

18. How does my financial institution tell the Court that it does not like the settlement?



9

Court Settlement Class Counsel Defense Counsel

Clerk of the Court USDC, Western District of Pennsylvania Joseph F. Weis, Jr. U.S. Courthouse 700 Grant Street Pittsburgh, PA 15219

Gary F. Lynch CARLSON LYNCH SWEET KILPELA & CARPENTER, LLP 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222


Kristine M. Brown Donald M. Houser ALSTON & BIRD LLP 1201 West Peachtree Street Atlanta, GA 30309

In addition, any Settlement Class Member that objects to the proposed Settlement Agreement must make itself available to be deposed regarding the grounds for its objection and must provide along with its objection the dates when the objector will be available to be deposed during the period from when the objection is filed through the date five days before the Final Approval Hearing.

Objecting is simply telling the Court that you don’t like something about the Settlement. You can object to the benefits provided by the Settlement or other terms of the Settlement only if your financial institution stays in the Settlement Class. Excluding your financial institution or “opting out” is telling the Court that you don’t want to be included in the Settlement Class. If your financial institution excludes itself, you have no basis to object to the Settlement and related releases because the Settlement no longer affects you.

THE COURT’S FINAL APPROVAL HEARING

The Court will hold a Final Approval Hearing at ____________ 2019, in Courtroom 9C before Chief Magistrate Judge Maureen P. Kelly of the United States District Court for the Western District of Pennsylvania, Joseph F. Weis, Jr. U.S. Courthouse, 700 Grant Street, Pittsburgh, PA 15219. This hearing date and time may be moved. Please refer to the settlement website ([Website]) for notice of any changes.

By no later than 30 days prior to the Final Approval Hearing, Class Counsel shall file a motion for final approval of the Settlement and a motion for attorneys’ fees, costs, and expenses and for Service Awards. Objectors, if any, shall file any response to Class Counsel’s motions no later than 17 days prior to the Final Approval Hearing. By no later than 10 days prior to the Final Approval Hearing, responses shall be filed, if any, to any filings by objectors, and any replies in support of final approval of the Settlement and/or Class Counsel’s application for attorneys’ fees, costs, and expenses and for Service Awards shall be filed.

At the Final Approval Hearing, the Court will consider, among other things, whether the Settlement is fair, reasonable, and adequate; how much Plaintiffs’ lawyers will receive as attorneys’ fees and expenses; and whether to approve service awards to the Settlement Class Representatives. If there are objections, the Court will consider them. The Court will listen to people at the hearing who file in advance a timely notice of their intention to appear (see Question 18). At or after the Final Approval Hearing, the Court will decide whether to approve the Settlement. There is no deadline by which the Court must make its decision.

No. Class Counsel will answer questions the Court may have. You are welcome, however, to come at your own

19. What is the difference between objecting and excluding/opting out?

20. When and where will the Court decide whether to approve the settlement?

21. Does my financial institution have to attend the hearing?



10

expense. If you submit an objection, you do not have to come to the Court to talk about it. As long as you submitted your objection timely and in accordance with the requirements for objecting set out of the Settlement (see Question 18), the Court will consider it. You may also pay your own lawyer to attend, but it is not necessary.

IF YOU DO NOTHING

If your financial institution is a Settlement Class Member and does nothing, it will remain a part of the Settlement Class but will not get any payments from the Settlement. And, unless your financial institution excludes itself, it will not be able to sue Wendy’s or its franchisees about the claims being resolved through this Settlement ever again. See the Settlement for more details about the releases.

GETTING MORE INFORMATION

This notice summarizes the Settlement. More details are in the Settlement itself. You can get a copy of the Settlement at ([Website]) or from the Settlement Administrator by calling toll-free 1-XXX-XXX-XXXX.

Please do not contact the Court with questions about the Settlement.

22. What happens if my financial institution does nothing at all?

23. How do I get more information?


EXHIBIT 3


WendysDataBreachSettlement.com

LEGAL NOTICE

If your financial institution issued one or more payment cards that was identified as having been at risk as a result of the data breach that Wendy’s announced in 2016, it could get a payment from a class action

settlement.

A federal court authorized this notice. This is not a solicitation from a lawyer.

A settlement of lawsuits against The Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC (“Wendy’s”) has been proposed in which Wendy’s has agreed to pay $50 million to resolve claims brought by financial institutions and associations arising from third-party criminal cyberattacks of certain of Wendy’s independently owned and operated franchisee restaurants involving malware variants targeting customers’ payment card information that Wendy’s reported in 2016 (the “Data Breach”). If your financial institution (“you”) qualifies, you may send in a claim form to get benefits, or you can exclude yourself from the Settlement, or object to it.

The United States District Court for the Western District of Pennsylvania authorized this notice. Before any money is paid, the Court will have a hearing to decide whether to approve the Settlement.

Who Is Included?

You are a member of the Settlement Class and affected by the settlement if: (1) You are a financial institution, bank, credit union, or other entity in the United States (including its Territories and the District of Columbia); and (2) You issued one or more payment cards (including debit and credit cards) that was identified as having been at risk as a result of the Data Breach in an alert or similar document by Visa, MasterCard, Discover, American Express, or JCB. (See the Settlement or Settlement Website for more details as to the payment cards that are included.)

What Is This Case About?

The lawsuits, which have been consolidated in First Choice Federal Credit Union v. The Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.), were filed by financial institutions and associations and allege that Wendy’s is legally responsible for the Data Breach. The lawsuits assert claims for negligence, negligence per se, violation of the Ohio Deceptive Trade Practices Act, as well as for declaratory and injunctive relief. The lawsuits seek, among other relief, to recover damages for the expense of payment card reissuance, amounts paid to cover fraudulent payment card charges, and other costs allegedly incurred responding to the Data Breach. Wendy’s denies any wrongdoing.

What Does the Settlement Provide?

Wendy’s has agreed to pay $50 million into a Settlement Fund out of which the Settlement Administrator will make payments to eligible Settlement Class Members. A Settlement

Class Member who submits a valid claim will receive a cash payment for each eligible payment card it issued. The amount of the cash payment will depend on the total number of eligible payment cards submitted by Settlement Class Members, the Costs of Settlement Administration, taxes paid on the Settlement Fund, and the amount of attorneys’ fees, costs, and expenses, and Service Awards approved by the Court. By way of example, if valid claims are submitted for all eligible cards, it is estimated that Settlement Class Members would receive approximately $2.00 per eligible payment card. If, for example, 40% of eligible payment cards are submitted, then Settlement Class Members would receive approximately $4.80 per eligible payment card. These are examples. The per-card amount actually paid may be higher or lower.

The Costs of Settlement Administration and taxes on the Settlement Fund will be paid from the Settlement Fund. Any attorneys’ fees, costs, and expenses, and Service Award payments that are approved by the Court also will be paid from the Settlement Fund.

How Do You Ask for a Payment?

A detailed notice and Claim Form package contains everything you need. Just call the number or visit the website below to get one. To qualify for a payment, you must send in a Claim Form, which can be submitted electronically or by mail. Claim Forms must be submitted electronically, and if mailed postmarked, by [Month 00, 2019].

What Are Your Other Options?

If you do not want to be legally bound by the Settlement, you must exclude yourself by [Month 00, 2019], or you will not be able to sue, or continue to sue, Wendy’s, its franchisees, or any other Defendants’ Released Persons (as defined in the Settlement) for any of the claims resolved by the Settlement. To exclude yourself, you must provide all required information. If you exclude yourself, you cannot get money from this Settlement. If you stay in the Settlement Class but wish to object, you must do so by [Month 00, 2019]. Details for excluding yourself or objecting to the Settlement can be found in the Settlement and on the Settlement Website.

The Court will hold a hearing in this case on [Month 00, 2019], to consider whether to approve the Settlement. At the hearing, the Court will also consider a request by the lawyers representing all Settlement Class Members for attorneys’ fees, costs, and expenses for investigating the facts, litigating the case, and negotiating the Settlement, as well as for Service


WendysDataBreachSettlement.com

Awards to the Settlement Class Representatives for their time participating in the case. You may ask to appear at the hearing, but you do not have to.

Want More Information?

For more information, call toll free at 1-XXX-XXX-

XXXX or visit the website at [Website].


EXHIBIT 4




and


Plaintiffs,

v.


Defendants.


[PROPOSED] PRELIMINARY APPROVAL ORDER


1

[PROPOSED] PRELIMINARY APPROVAL ORDER

This matter is before the Court on Plaintiffs’ Unopposed Motion for Preliminary

Approval of the Settlement between Financial Institution Plaintiffs, for themselves and on behalf

of the Settlement Class, and the Association Plaintiffs (collectively, “Plaintiffs”), and The

Wendy’s Company, Wendy’s Restaurants, LLC, and Wendy’s International, LLC (collectively,

“Wendy’s”) for consideration of whether the Settlement reached by the parties should be

preliminarily approved, the proposed Settlement Class preliminarily certified, and the proposed

plan for notifying the Settlement Class approved. Having reviewed the proposed Settlement,

together with its exhibits, and based upon the relevant papers and all prior proceedings in this

matter, the Court has determined the proposed Settlement satisfies the criteria for preliminary

approval, the proposed Settlement Class should be preliminarily certified, and the proposed

notice plan approved.1 Accordingly, good cause appearing in the record, Plaintiffs’ Motion is

GRANTED, and IT IS HEREBY ORDERED THAT:

Provisional Certification of the Settlement Class

(1) The Court provisionally certifies the following Settlement Class:


This Settlement Class is provisionally certified for purposes of settlement only.

(2) The Court determines that for settlement purposes the proposed Settlement Class

meets all the requirements of Federal Rule of Civil Procedure 23(a) and (b)(3), namely that the

class is so numerous that joinder of all members is impractical; that there are common issues of

1 Unless otherwise indicated, capitalized terms used herein have the same meaning as in the Settlement.


2

law and fact; that the claims of the class representatives are typical of absent class members; that

the class representatives will fairly and adequately protect the interests of the class as they have

no interests antagonistic to or in conflict with the class and have retained experienced and

competent counsel to prosecute this matter; that common issues predominate over any individual

issues; and that a class action is the superior means of adjudicating the controversy.

(3) The Financial Institution Plaintiffs are designated and appointed as the Settlement

Class Representatives.

(4) The following lawyers, who were previously appointed by the Court as interim

Co-lead Counsel, are designated as Class Counsel pursuant to Fed. R. Civ. P. 23(g): Erin Green

Comite of Scott+Scott Attorneys at Law, LLP; Gary F. Lynch of Carlson Lynch Sweet Kilpela &

Carpenter, LLP. The Court finds that these lawyers are experienced and will adequately protect

the interests of the Settlement Class.

Preliminary Approval of the Proposed Settlement

(5) Upon preliminary review, the Court finds the proposed Settlement is fair,

reasonable, and adequate, otherwise meets the criteria for approval, and warrants issuance of

notice to the Settlement Class. Accordingly, the proposed Settlement is preliminarily approved.

Final Approval Hearing

(6) A Final Approval Hearing shall take place before the Court on _______________,

2019, at ___ a.m./p.m. in Courtroom 9C before Chief Magistrate Judge Maureen P. Kelly of the

United States District Court for the Western District of Pennsylvania, Joseph F. Weis, Jr. U.S.

Courthouse, 700 Grant Street Pittsburgh, PA 15219, to determine, among other things, whether:

(a) the proposed Settlement Class should be finally certified for settlement purposes pursuant to

Federal Rule of Civil Procedure 23; (b) the Settlement should be finally approved as fair,


3

reasonable and adequate and, in accordance with the Settlement’s terms, all claims in the

Complaint and Litigation should be dismissed with prejudice; (c) Settlement Class Members

should be bound by the releases set forth in the Settlement; (d) the proposed Final Approval

Order and Judgment should be entered; (e) the application of Class Counsel for an award of

attorneys’ fees, costs, and expenses should be approved; and (f) the application for Service

Awards should be approved. Any other matters the Court deems necessary and appropriate will

also be addressed at the hearing.

(7) Class Counsel shall submit their application for fees, costs, and expenses and the

application for Service Awards 30 days before the Final Approval Hearing. Objectors, if any,

shall file any response to Class Counsel’s motions no later than 17 days prior to the Final

Approval Hearing. By no later than 10 days prior to the Final Approval Hearing, responses shall

be filed, if any, to any filings by objectors, and any replies in support of final approval of the

Settlement and/or Class Counsel’s application for attorneys’ fees, costs, and expenses and for

Service Awards shall be filed.

(8) Any Settlement Class Member that has not timely and properly excluded itself

from the Settlement Class in the manner described below, may appear at the Final Approval

Hearing in person or by counsel and be heard, to the extent allowed by the Court, regarding the

proposed Settlement; provided, however, that no Settlement Class Member that has elected to

exclude itself from the Settlement Class shall be entitled to object or otherwise appear, and,

further provided, that no Settlement Class Member shall be heard in opposition to the Settlement

unless the Settlement Class Member complies with the requirements of this Order pertaining to

objections, which are described below.


4

Administration

(9) Analytics Consulting, LLC (“Analytics”) is appointed as the Settlement

Administrator, with responsibility for Claims Administration, the Notice Program, and all other

obligations of the Claims Administrator as set forth in the Settlement. The Settlement

Administrator’s fees, as well as all other costs and expenses associated with notice and

administration, will be paid out of the Settlement Fund, as provided in the Settlement.

Notice to the Class

(10) The Notice Program set forth in the Settlement, including the forms of Notice and

Claim Form attached as exhibits to the Settlement, satisfy the requirements of Federal Rule of

Civil Procedure 23 and due process and thus are approved. Non-material modifications to the

exhibits may be made without further order of the Court. The Settlement Administrator is

directed to carry out the Notice Program in conformance with the Settlement and to perform all

other tasks that the Settlement requires.

(11) The Court finds that the form, content, and method of giving notice to the

Settlement Class as described in the Settlement and exhibits: (a) constitute the best practicable

notice to the Settlement Class; (b) are reasonably calculated, under the circumstances, to apprise

Settlement Class Members of the pendency of the action, the terms of the proposed Settlement,

and their rights under the proposed Settlement; (c) are reasonable and constitute due, adequate,

and sufficient notice to those persons entitled to receive notice; and (d) satisfy the requirements

of Federal Rule of Civil Procedure 23, the constitutional requirement of due process, and any

other legal requirements. The Court further finds that the notice is written in plain language,

uses simple terminology, and is designed to be readily understandable by Settlement Class

Members.


5

Exclusions from the Class

(12) Any Settlement Class Member that wishes to be excluded from the Settlement

Class must mail a written notification of the intent to exclude itself to the Settlement

Administrator, Class Counsel, and Wendy’s counsel at the addresses provided in the Notice,

postmarked no later than _________________ [90 days after the date of this Order] (the “Opt-

Out Deadline”) and sent via first class postage pre-paid United States mail. The written

notification must include the name of this Litigation (First Choice Federal Credit Union v. The

Wendy’s Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.)); the full name, address, and

telephone number of the Settlement Class Member; the name, address, email address, telephone

number, position, and signature of the individual who is acting on behalf of the Settlement Class

Member; the words “Request for Exclusion” at the top of the document or a statement in the

body of the document requesting exclusion from the Settlement; and the total number of payment

cards issued by the Settlement Class Member that were identified as having been at risk as a

result of the Data Breach in any alerts or similar documents by Visa, MasterCard, Discover,

American Express, and JCB. If the Settlement Class Member fails to provide all of the required

information on or before the deadlines specified in the Settlement and fails to cure any

deficiency within the time allowed in the Settlement, then its attempt to opt out shall be invalid

and have no legal effect, and the Settlement Class Member shall be bound by the Settlement,

including the releases, if finally approved.

(13) All Settlement Class Members who submit valid and timely notices of their intent

to be excluded from the Settlement shall not receive any benefits of or be bound by the terms of

the Settlement. Any Settlement Class Member that does not timely and validly exclude itself

from the Settlement shall be bound by the terms of the Settlement. If final judgment is entered,


6

any Settlement Class Member that has not submitted a timely, valid written notice of exclusion

from the Settlement (in accordance with the requirements of the Settlement) shall be bound by

all subsequent proceedings, orders and judgments in this matter, the Settlement, including but not

limited to the releases set forth in the Settlement, and the Final Approval Order and Judgment.

(14) The Settlement Administrator shall provide the parties with copies of all opt-out

notifications promptly upon receipt, and a final list of all that have timely and validly excluded

themselves from the Settlement Class in accordance with the terms of the Settlement, which

Class Counsel may move to file under seal with the Court no later than ten (10) days prior to the

Final Approval Hearing.

Objections to the Settlement

(15) A Settlement Class Member that complies with the requirements of this Order

may object to the Settlement, the request of Class Counsel for an award of attorneys’ fees, costs,

and expenses, and/or the request for Service Awards.

(16) No Settlement Class Member shall be heard, and no papers, briefs, pleadings, or

other documents submitted by any Settlement Class Member shall be received and considered by

the Court, unless the objection is (a) electronically filed with the Court by the Objection

Deadline; or (b) mailed first-class postage prepaid to the Clerk of Court, Class Counsel, and

Wendy’s Counsel, at the addresses listed in the Notice, and postmarked by no later than the

Objection Deadline, which shall be _______ [90 days after the date of this Order], as specified in

the Notice. Objections shall not exceed twenty-five (25) pages. For the objection to be

considered by the Court, the objection shall set forth:

a. the name of the Litigation (First Choice Federal Credit Union v. The Wendy’s

Company, Case No. 2:16-cv-00506-NBF-MPK (W.D. Pa.));


7

b. the full name of the objector and the full name, address, email address, and

telephone number of the person acting on its behalf;

c. an explanation of the basis upon which the objector claims to be a Settlement

Class Member;

d. whether the objection applies only to the objector, to a specific subset of the

Settlement Class, or to the entire Settlement Class;

e. all grounds for the objection stated with specificity, accompanied by any legal

support for the objection;

f. the identity of all counsel who represent the objector, including any former or

current counsel who may be entitled to compensation for any reason related to the

objection to the Settlement, Class Counsel’s request for attorney’s fees, costs, and

expenses, or the application for Service Awards;

g. the identity of all representatives (including counsel representing the objector)

who will appear at the Final Approval Hearing;

h. the number of times in which the objector has objected to a class action settlement

within the five years preceding the date that the objector files the objection, the

caption of each case in which the objector has made such objection, and a copy of

any orders related to or ruling upon the objector’s prior such objections that were

issued by the trial and appellate courts in each listed case;

i. the number of times in which the objector’s counsel and/or counsel’s law firm

have objected to a class action settlement within the five years preceding the date

that the objector files the objection, the caption of each case in which the counsel

or the firm has made such objection, and a copy of any orders related to or ruling


8

upon counsel’s or the firm’s prior such objections that were issued by the trial and

appellate courts in each listed case;

j. if the objector is represented by an attorney who intends to seek fees and expenses

from anyone other than the objectors he or she represents, the objection should

also include: (i) a description of the attorney’s legal background and prior

experience in connection with class action litigation; (ii) the amount of fees

sought by the attorney for representing the objector and the factual and legal

justification for the fees being sought; (iii) a statement regarding whether the fees

being sought are calculated on the basis of a lodestar, contingency, or other

method; (iv) the number of hours already spent by the attorney and an estimate of

the hours to be spent in the future; and (v) the attorney’s hourly rate;

k. any and all agreements that relate to the objection or the process of objecting,

whether written or verbal, between objector or objector’s counsel and any other

person or entity;

l. a description of all evidence to be presented at the Final Approval Hearing in

support of the objection, including a list of any witnesses, a summary of the

expected testimony from each witness, and a copy of any documents or other non-

oral material to be presented;

m. a statement identifying whether the objector intends to personally appear and/or

testify at the Final Approval Hearing;

n. the objector’s signature on the written objection (an attorney’s signature is not

sufficient).


9

(17) In addition, any Settlement Class Member that objects to the proposed Settlement

must make itself available to be deposed regarding the grounds for its objection and must

provide along with its objection the dates when the objector will be available to be deposed

during the period from when the objection is filed through the date five days before the Final

Approval Hearing.

(18) Any Settlement Class Member that fails to comply with the provisions in this

Order will waive and forfeit any and all rights it may have to object, and shall be bound by all

the terms of the Settlement, this Order, and by all proceedings, orders, and judgments, including,

but not limited to, the releases in the Settlement, if finally approved. Any Settlement Class

Member who both objects to the Settlement and opts out will be deemed to have opted out and

the objection shall be deemed null and void.

Claims Process and Distribution Plan

(19) The Settlement establishes a process for assessing and determining the validity

and value of claims and a methodology for paying Settlement Class Members that submit a

timely, valid Claim Form. The Court preliminarily approves this process.

(20) Settlement Class Members that qualify for and wish to submit a Claim Form shall

do so in accordance with the requirements and procedures specified in the Notice and the Claim

Form. If the Settlement is finally approved, all Settlement Class Members that qualify for any

benefit under the Settlement but fail to submit a claim in accordance with the requirements and

procedures specified in the Notice and Claim Form shall be forever barred from receiving any

such benefit, but will in all other respects be subject to and bound by the provisions of the

Settlement, including the releases included in the Settlement, and the Final Approval Order and

Judgment.


10

Termination of the Settlement and Use of this Order

(21) This Order shall become null and void and shall be without prejudice to the rights

of the Parties, all of which shall be restored to their respective positions existing immediately

before this Court entered this Order, if the Settlement is not finally approved by the Court or is

terminated in accordance with the terms of the Settlement. In such event, the Settlement shall

become null and void and be of no further force and effect, and neither the Settlement (including

any Settlement-related filings) nor the Court’s orders, including this Order, relating to the

Settlement shall be used or referred to for any purpose whatsoever.

(22) If the Settlement is not finally approved or there is no Effective Date under the

terms of the Settlement, then this Order shall be of no force or effect; shall not be construed or

used as an admission, concession, or declaration by or against Wendy’s of any fault,

wrongdoing, breach, or liability; shall not be construed or used as an admission, concession, or

declaration by or against any Settlement Class Representative or any other Settlement Class

Member that its claims lack merit or that the relief requested is inappropriate, improper,

unavailable; and shall not constitute a waiver by any party of any defense (including without

limitation any defense to class certification) or claims it may have in this Litigation or in any

other lawsuit.

Stay of Proceedings

(23) Except as necessary to effectuate this Order, this matter and any deadlines set by

the Court in this matter are stayed and suspended pending the Final Approval Hearing and

issuance of the Final Approval Order and Judgment, or until further order of this Court.


11

Continuance of Final Approval Hearing

(24) The Court reserves the right to adjourn or continue the Final Approval Hearing

and related deadlines without further written notice to the Settlement Class. If the Court alters

any of those dates or times, the revised dates and times shall be posted on the website maintained

by the Settlement Administrator.

Actions by Settlement Class Members

(25) The Court stays and enjoins, pending Final Approval of the Settlement, any

actions, lawsuits, or other proceedings brought by Settlement Class Members against Wendy’s

related to the Data Breach.

Summary of Deadlines

(26) The Settlement, as preliminarily approved in this Order, shall be administered

according to its terms pending the Final Approval Hearing. Deadlines arising under the

Settlement and this Order include but are not limited to the following:

• Notice Deadline: [30 days after entry of this Order]

• Objection and Opt-Out Deadline: [90 days after entry of this Order]

• Claims Deadline: [210 days after entry of this Order]

• Final Approval Hearing: [a date to be set by the Court no earlier than 230 days

after entry of this order]

• Application for Attorneys’ Fees, Expenses and Service Awards (“Fee

Application”): [30 days before the Final Approval Hearing]

• Motion for Final Approval of the Settlement (“Final Approval Motion”): [30

days before the Final Approval Hearing]


12

• Objectors’, if any, Response to Final Approval Motion and Fee Application [17

days before the Final Approval Hearing]

• Replies in Support of Final Approval and Fee Motion [10 days before the Final

Approval Hearing]

IT IS SO ORDERED this ____ day of _________, 2019.

_______________________________ Hon. Maureen P. Kelly

Chief U.S. Magistrate Judge


EXHIBIT 5




and


Plaintiffs,

v.


Defendants.


[PROPOSED] FINAL APPROVAL ORDER AND JUDGMENT


1

[PROPOSED] FINAL APPROVAL ORDER AND JUDGMENT

On ___________________ [DATE], this Court entered an order granting preliminary

approval (the “Preliminary Approval Order”) (Doc. ____) of the Settlement between the Financial

Institution Plaintiffs, on their own behalf and on behalf of the Settlement Class, and the Association

Plaintiffs (collectively, “Plaintiffs”), and Defendants The Wendy’s Company, Wendy’s

Restaurants, LLC, and Wendy’s International, LLC (collectively, “Wendy’s”), as memorialized in

Exhibit __ (Doc. __) to Plaintiffs’ Motion for Preliminary Approval of Class Action Settlement;1

On ___________________ [DATE], pursuant to the notice requirements set forth in the

Settlement and in the Preliminary Approval Order, the Settlement Class was apprised of the nature

and pendency of the Litigation, the terms of the Settlement, and their rights to request exclusion,

object, and/or appear at the final approval hearing;

On ___________________ [DATE], Plaintiffs filed their Motion for Final Approval of

the Class Action Settlement (“Final Approval Motion”) and accompanying Memorandum of Law

and supporting exhibits, and Class Counsel filed their Application for Attorneys’ Fees, Expenses

and Service Awards and accompanying Memorandum of Law and supporting exhibits (“Fee

Application”);

On ___________________ [DATE], the Court held a final approval hearing to determine,

inter alia: (1) whether the Settlement is fair, reasonable, and adequate; and (2) whether judgment

should be entered dismissing all claims in the Complaint with prejudice. Prior to the final approval

hearing, Class Counsel filed a declaration from the Settlement Administrator confirming that the

Notice Program was completed in accordance with the Parties’ instructions and the Preliminary

Approval Order. Therefore, the Court is satisfied that Settlement Class Members were properly

1 The capitalized terms used in this Final Approval Order and Judgment shall have the same meaning as defined in the Settlement except as may otherwise be indicated.


2

notified of their right to appear at the final approval hearing in support of or in opposition to the

proposed Settlement, the award of attorneys’ fees, costs, and expenses, and the payment of Service

Awards.

Having given an opportunity to be heard to all requesting persons in accordance with the

Preliminary Approval Order, having heard the presentation of Class Counsel and counsel for

Wendy’s, having reviewed all of the submissions presented with respect to the proposed

Settlement, having determined that the Settlement is fair, adequate, and reasonable, having

considered the application made by Class Counsel for attorneys’ fees, costs, and expenses, and the

application for Service Awards, and having reviewed the materials in support thereof, and good

cause appearing in the record and Plaintiffs’ Final Approval Motion is GRANTED, and Class

Counsel’s Fee Application is GRANTED, and:

IT IS HEREBY ORDERED THAT:

1. The Court has jurisdiction over the subject matter of this action and over all claims

raised therein and all Parties thereto, including the Settlement Class. The Court also has personal

jurisdiction over the Parties and the Settlement Class Members.

2. The Settlement was entered into in good faith following arm’s length negotiations

and is non-collusive.

3. The Settlement is, in all respects, fair, reasonable, and adequate, is in the best

interests of the Settlement Class, and is therefore approved. The Court finds that the Parties faced

significant risks, expenses, delays and uncertainties, including as to the outcome, of continued

litigation of this complex matter, which further supports the Court’s finding that the Settlement is

fair, reasonable, adequate and in the best interests of the Settlement Class Members. The Court

finds that the uncertainties of continued litigation in both the trial and appellate courts, as well as

the expense associated with it, weigh in favor of approval of the Settlement.


3

4. This Court grants final approval of the Settlement, including but not limited to the

releases in the Settlement and the plans for distribution of the settlement relief. The Court finds

that the Settlement is in all respects fair, reasonable, and in the best interest of the Settlement Class.

Therefore, all Settlement Class Members who have not opted out are bound by the Settlement and

this Final Approval Order and Judgment.

5. The Settlement and every term and provision thereof shall be deemed incorporated

herein as if explicitly set forth herein and shall have the full force of an Order of this Court.

6. The Parties shall effectuate the Settlement in accordance with its terms.

OBJECTIONS AND OPT-OUTS

7. ______ objections were filed by Settlement Class Members. The Court has

considered all objections and finds the objections do not counsel against Settlement approval, and

the objections are hereby overruled in all respects.

8. All persons and entities who have not objected to the Settlement in the manner

provided in the Settlement are deemed to have waived any objections to the Settlement, including

but not limited to by appeal, collateral attack, or otherwise.

9. A list of those putative Settlement Class Members who have timely and validly

elected to opt out of the Settlement and the Settlement Class in accordance with the requirements

in the Settlement (the “Opt-Out Members”) has been submitted to the Court in the Declaration of

_______________, filed in advance of the final approval hearing. That list is attached as Exhibit

A to this Order. The persons and/or entities listed in Exhibit A are not bound by the Settlement,

this Final Approval Order and Judgment, and are not entitled to any of the benefits under the

Settlement. Opt-Out Members listed in Exhibit A shall be deemed not to be Releasing Parties.


4

CLASS CERTIFICATION

10. For purposes of the Settlement and this Final Approval Order and Judgment, the

Court hereby finally certifies for settlement purposes only the following Settlement Class:


11. The Court determines that for settlement purposes the Settlement Class meets all

the requirements of Federal Rule of Civil Procedure 23(a) and (b)(3), namely that the class is so

numerous that joinder of all members is impractical; that there are common issues of law and fact;

that the claims of the class representatives are typical of absent class members; that the class

representatives will fairly and adequately protect the interests of the class as they have no interests

antagonistic to or in conflict with the class and have retained experienced and competent counsel

to prosecute this matter; that common issues predominate over any individual issues; and that a

class action is the superior means of adjudicating the controversy

12. The Court grants final approval to the appointment of the Financial Institution

Plaintiffs as the Settlement Class Representatives. The Court concludes that the Settlement Class

Representatives have fairly and adequately represented the Settlement Class and will continue to

do so.

13. The Court grants final approval to the appointment, pursuant to Rule 23(g), of Erin

Green Comite of Scott+Scott Attorneys at Law, LLP and Gary F. Lynch of Carson Lynch Sweet

Kilpela & Carpenter, LLP as Class Counsel. The Court concludes that Class Counsel have

adequately represented the Settlement Class and will continue to do so.


5

NOTICE TO THE SETTLEMENT CLASS

14. The Court finds that the Notice Program, set forth in the Settlement and effectuated

pursuant to the Preliminary Approval Order, satisfied Rule 23(c)(2), was the best notice practicable

under the circumstances, was reasonably calculated to provide and did provide due and sufficient

notice to the Settlement Class of the pendency of the Litigation, certification of the Settlement

Class for settlement purposes only, the existence and terms of the Settlement, their right to exclude

themselves, their right to object to the Settlement and to appear at the Final Approval Hearing, and

satisfied the other requirements of the Federal Rules of Civil Procedure, the United States

Constitution, and all other applicable laws.

15. The Court finds that Wendy’s has fully complied with the notice requirements of

the Class Action Fairness Act of 2005, 28 U.S.C. § 1715.

AWARD OF ATTORNEYS’ FEES AND SERVICE AWARDS

16. The Court has considered Class Counsel’s Motion for attorneys’ fees, costs, and

expenses, and for Service Awards.

17. Pursuant to Rule 23(h) and relevant Third Circuit authority, the Court awards Class

Counsel 30% of the gross Settlement Fund, which includes any interest earned thereon, as an award

of reasonable attorneys’ fees and $______________ as an award of costs and expenses to be paid

in accordance with the Settlement, and the Court finds this amount of fees, costs, and expenses to

be fair and reasonable. This award of attorneys’ fees, costs, and expenses, and any interest earned

thereon, shall be paid from the Settlement Fund in accordance with the Settlement. This award of

attorneys’ fees, costs, and expenses is independent of the Court’s consideration of the fairness,

reasonableness, and adequacy of the Settlement.

18. The Court grants Class Counsel’s request for Service Awards and awards $7,500

to each Financial Institution Plaintiff that was deposed: First Choice Federal Credit Union, AOD


6

Federal Credit Union, Tech Credit Union, Veridian Credit Union, South Florida Educational

Federal Credit Union, Preferred Credit Union, Alcoa Community Federal Credit Union,

Associated Credit Union, Envista Credit Union, First NBC Bank, Navigator Credit Union, The

Seymour Bank, Financial Horizons Credit Union, Nusenda Credit Union, and Members Choice

Credit Union. The Court awards $2,500 to each Financial Institution Plaintiff that was not

deposed: Greater Cincinnati Credit Union, Kemba Financial Credit Union, and Wright-Patt Credit

Union. The Court finds that this payment is justified by their service to the Settlement Class. These

Service Awards shall be paid from the Settlement Fund in accordance with the Settlement.

OTHER PROVISIONS

19. The Parties to the Settlement shall carry out their respective obligations thereunder.

20. Within the time period set forth in the Settlement, the relief provided for in the

Settlement shall be made available to the Settlement Class Members submitting valid Claim

Forms, pursuant to the terms and conditions of the Settlement.

21. As of the Effective Date, the Releasing Parties, each on behalf of itself and any

predecessors, successors, or assigns, shall automatically be deemed to have fully, completely,

finally, irrevocably, and forever released and discharged Defendants’ Released Persons of and

from any and all liabilities, rights, claims, actions, causes of action, demands, damages, penalties,

costs, attorneys’ fees, losses, and remedies, whether known or unknown (including Unknown

Claims), existing or potential, suspected or unsuspected, liquidated or unliquidated, legal,

statutory, or equitable, that result from, arise out of, are based upon, or relate to the Data Breach,

including, without limitation, any claims, actions, causes of action, demands, damages, penalties,

losses, or remedies relating to, based upon, resulting from, or arising out of (1) Wendy’s

information security policies and practices; (2) the allegations, facts, and/or circumstances

described in the Litigation and/or Complaint; (3) Wendy’s response to and notices about the Data


7

Breach; (4) the fraudulent use of any Compromised Cards or Alerted on Payment Cards; (5) the

cancellation and reissuance of any Compromised Cards or Alerted on Payment Cards; and (6) any

expenses incurred investigating, responding to, or mitigating potential damage from the theft or

illegal use of Compromised Cards or Alerted on Payment Cards or information relating to such

cards (the “Released Claims”).

22. For the avoidance of doubt, the Released Claims include, without limitation, any

claims, causes of actions, remedies, or damages that were or could have been asserted in the

Litigation, and also include, without limitation, any claims that a Releasing Party may have under

the law of any jurisdiction, including, without limitation, those arising under state or federal law

of the United States (including, without limitation, any causes of action under the California

Business & Professions Code § 17200 et seq., California Civil Code § 1750 et seq., California

Civil Code § 1798.80 et seq., California Civil Code § 56.10 et seq., and any similar statutes or data

breach notification statutes in effect in the United States or in any states in the United States);

causes of action under the common or civil laws of any state in the United States, including but

not limited to: unjust enrichment, negligence, bailment, conversion, negligence per se, breach of

contract, breach of implied contract, breach of fiduciary duty, breach of implied covenant of good

faith and fair dealing, misrepresentation (whether fraudulent, negligent, or innocent), fraudulent

concealment or nondisclosure, invasion of privacy, public disclosure of private facts, and

misappropriation of likeness and identity; any causes of action based on privacy rights provided

for under the constitutions of the United States or of any states in the United States; any statutory

claims under state or federal law; and also including, but not limited to, any and all claims in any

state or federal court of the United States, for damages, injunctive relief, restitution, disgorgement,

declaratory relief, equitable relief, attorneys’ fees and expenses, pre-judgment interest, credit or

financial account monitoring services, identity theft insurance, the creation of a fund for future


8

damages, statutory penalties, restitution, the appointment of a receiver, and any other form of

relief.

23. As of the Effective Date, Defendants’ Released Persons will be deemed to have

completely released and forever discharged the Releasing Parties and Plaintiffs’ Released Persons

from and for any and all liabilities, claims, cross-claims, causes of action, rights, actions, suits,

debts, liens, contracts, agreements, damages, costs, attorneys’ fees, losses, expenses, obligations,

or demands, of any kind whatsoever, whether known or unknown, existing or potential, or

suspected or unsuspected, whether raised by claim, counterclaim, setoff, or otherwise, including

any known or unknown claims, which they have or may claim now or in the future to have, relating

to the institution, prosecution, or settlement of the Litigation. For the avoidance of doubt,

Defendants’ Released Persons’ release as set forth in this Paragraph 23 does not include entities

that do not meet the definition of either Releasing Parties or Plaintiffs’ Released Persons. For the

further avoidance of doubt, Defendants’ Released Persons’ release as set forth in this Paragraph

23 does not include WAND Corporation, Trustwave, Trustwave Holdings, Inc., NCR, or DUMAC

Business Systems, Inc.

24. The Settlement Class Representatives and Settlement Class Members are enjoined

from prosecuting any Released Claims in any proceeding against any of the Defendants’ Released

Persons or prosecuting any claim based on any actions taken by any of the Defendants’ Released

Persons that are authorized or required by this Settlement or by the Final Approval Order and

Judgment. It is further agreed that the Settlement and/or this Final Approval Order and Judgment

may be pleaded as a complete defense to any proceeding subject to this section.

25. “Unknown Claims” means any of the Released Claims that any Settlement Class

Member, including any of the Settlement Class Representatives, does not know or suspect to exist

in its favor at the time of the release of the Defendants’ Released Persons that, if known by it,


9

might have affected its settlement with, and release of, the Defendants’ Released Persons, or might

have affected its decision not to object to and/or to participate in this Settlement. With respect to

any and all Released Claims, the Parties stipulate and agree that upon the Effective Date, the

Settlement Class Representatives expressly shall have, and each of the other Settlement Class

Members shall be deemed to have, and by operation of the Final Approval Order and Judgment

shall have, waived the provisions, rights, and benefits conferred by California Civil Code § 1542

to the extent applicable, and also any and all provisions, rights, and benefits conferred by any law

of any state, province, or territory of the United States (including, without limitation, Montana

Code Ann. § 28-1-1602; North Dakota Cent. Code § 9-13-02; and South Dakota Codified Laws §

20-7-11), which is similar, comparable, or equivalent to California Civil Code §1542, which

provides:

A general release does not extend to claims which the creditor does not know

or suspect to exist in his or her favor at the time of executing the release, which

if known by him or her must have materially affected his or her settlement

with the debtor.

Settlement Class Members, including the Settlement Class Representatives, and any of them, may

hereafter discover facts in addition to, or different from, those that they now know or believe to be

true with respect to the subject matter of the Released Claims, but the Settlement Class

Representatives expressly shall have, and each other Settlement Class Member shall be deemed to

have, and by operation of the Final Approval Order and Judgment shall have, upon the Effective

Date, fully, finally, and forever settled and released any and all Released Claims, including

Unknown Claims. The Parties acknowledge, and Settlement Class Members shall be deemed by

operation of the Final Approval Order and Judgment to have acknowledged, that the foregoing

waiver is a material element of the Settlement Agreement of which this release is a part.


10

26. This Final Approval Order and Judgment and the Settlement, and all acts,

statements, documents, and proceedings relating to the Settlement are not, and shall not be

construed as, used as, or deemed to be evidence of, an admission by or against Wendy’s of any

claim, any fact alleged in the Litigation, any fault, any wrongdoing, any violation of law, or any

liability of any kind on the part of Wendy’s or of the validity or certifiability for litigation of any

claims that have been, or could have been, asserted in the Litigation.

27. This Final Approval Order and Judgment, the Settlement, and all acts, statements,

documents, and proceedings relating to the Settlement shall not be offered, received, or admissible

in evidence in any action or proceeding, or be used in any way as an admission, concession or

evidence of any liability or wrongdoing of any nature or that Plaintiffs, any Settlement Class

Member, or any other person has suffered any damage; provided, however, that nothing in the

foregoing, the Settlement, or this Final Approval Order and Judgment shall be interpreted to

prohibit the use of the Settlement or this Final Approval Order and Judgment in a proceeding to

consummate or enforce the Settlement or this Final Approval Order and Judgment (including all

releases in the Settlement and Final Approval Order and Judgment), or to defend against the

assertion of any Released Claims in any other proceeding, or as otherwise required by law.

28. The Settlement’s terms shall be forever binding on, and shall have res judicata and

preclusive effect in, all pending and future lawsuits or other proceedings as to Released Claims

(and other prohibitions set forth in this Final Approval Order and Judgment) that are brought,

initiated, or maintained by, or on behalf of, any Settlement Class Member who is not an Opt-Out

Member or any other person subject to the provisions of this Final Approval Order and Judgment.

29. The Court hereby dismisses the Litigation and Complaint and all claims therein on

the merits and with prejudice, without fees or costs to any Party except as provided in this Final

Approval Order and Judgment.


11

30. Consistent with the Settlement, if the Effective Date, as defined in the Settlement

Agreement, does not occur for any reason, this Final Approval Order and Judgment and the

Preliminary Approval Order shall be deemed vacated and shall have no force and effect

whatsoever; the Settlement shall be considered null and void; all of the Parties’ obligations under

the Settlement, the Preliminary Approval Order, and this Final Approval Order and Judgment shall

cease to be of any force and effect, and the Parties shall return to the status quo ante in the Litigation

as if the Parties had not entered into the Settlement. In such an event, the Parties shall be restored

to their respective positions in the Litigation as if the Settlement Agreement had never been entered

into (and without prejudice to any of the Parties’ respective positions on the issue of class

certification or any other issue).

31. Pursuant to the All Writs Act, 28 U.S.C. § 1651, this Court shall retain the authority

to issue any order necessary to protect its jurisdiction from any action, whether in state or federal

court.

32. Without affecting the finality of this Final Approval Order and Judgment, the Court

will retain jurisdiction over the subject matter and the Parties with respect to the interpretation and

implementation of the Settlement for all purposes, including enforcement of its terms at the request

of any party and resolution of any disputes that may arise relating in any way to, arising from, the

implementation of the Settlement or the implementation of this Final Order and Judgment.

ENTERED:

DATED: _______________, 2019 By: _________________________________ Chief United States Magistrate Judge
