Basic Information

1. Why is this notice being provided?

This notice explains that the Court has allowed or “certified” a class action lawsuit that may affect your financial institution. In this lawsuit, the Plaintiff financial institutions allege that, between April 7, 2017 and October 28, 2017, hackers targeted point-of-sale systems at certain Sonic drive-in restaurants to steal payment card data when customers used their credit card or debit cards. Plaintiffs allege the breach occurred because Sonic maintained inadequate data security that put financial institutions’ payment card information at risk. Sonic denies these allegations and asserts that it had adequate safeguards in place and did nothing wrong.

Judge James S. Gwin of the United States District Court for the Northern District of Ohio is currently overseeing this case. The case is known as In re: Sonic Corp. Customer Data Breach Litigation (Financial Institutions) MDL Case No. 1:17-md-02807-JSG.

2. What is a Class Action?

In a class action lawsuit, one or more plaintiffs called “Class Representatives” (in this case the financial institutions American Airlines Federal Credit Union, Arkansas Federal Credit Union, and Redstone Federal Credit Union) sue defendants on behalf of themselves and also others who have similar claims. The entities together are called a “Class.” The resolution of the Class Representatives’ claims will resolve the certified claims for everyone in the class — except for those entities that choose to exclude themselves from the class action.

More information about why the Court is allowing this lawsuit to be a class action is in the Court’s Amended Opinion and Order certifying the class, which is under the “Case Documents” tab.

3. Is there any money available now?

No. It has not yet been determined whether Sonic did anything wrong, nor have the two sides agreed to settle the case; so, there is no money or benefits available to the Class at this time and there is no guarantee that there ever will be. If money or benefits become available, Class Members may have to take additional steps to get a share, such as submitting a claim form and submitting evidence showing that Sonic’s acts or failures to act caused any fraud reimbursement or card replacement.

The Claims In This Lawsuit

4. What is this lawsuit about?

Plaintiffs allege that, between April 7, 2017 and October 28, 2017, hackers targeted point-of-sale systems with inadequate data security at certain Sonic drive-in restaurants, enabling the hackers to steal payment card data when customers used their credit or debit cards. Sonic denies the allegations in their entirety and asserts that it had adequate safeguards in place and denies any wrongdoing.

5. What has the Court certified?

The Court has certified a class consisting of: “All banks, credit unions, and financial institutions in the United States that received notice and took action to reissue credit cards or debit cards or reimbursed a compromised account involved in the Sonic Data Breach.”

6. What are the Plaintiffs asking for?

Plaintiffs are asking the Court to compensate the Class for the costs associated with responding to the Sonic Data Breach, including for the costs of reissuing payment cards that were alerted by card brands as being potentially at risk because of the Sonic Data Breach and for reimbursing fraud on alerted accounts. Plaintiffs are also asking for the Court to order Sonic to implement appropriate data security controls to prevent another breach from injuring financial institutions.

7. Has the Court decided who is right?

No. The Court has not decided whether the Plaintiffs or Sonic is right. By certifying the Class and ordering that this Notice be provided, the Court has not decided whether the Plaintiffs will win or lose this case. The Plaintiffs must still prove their case.

Who Is In The Class?

8. Does my financial institution qualify as a Class Member?

Your financial institution is a Class Member if your financial institution received an alert from a card brand (such as Visa, MasterCard, or Discover) in connection with the 2017 Sonic Data Breach and took action to reissue credit or debit cards or reimbursed fraud on an alerted account involved in the 2017 Sonic Data Breach.

9. I’m still not sure whether my financial institution is included.

If you are still not sure whether your financial institution is included, you can ask for free help. You can call 1-844-486-0855 or email info@SonicFiClass.com for more information.

Your Financial Institution’s Rights And Options

If your financial institution is a Class Member, it has to decide whether to stay in the Class or whether to exclude itself, and your financial institution has to decide this no later than July 19, 2021.

10. What happens if my financial institution does nothing at all?

By doing nothing, your financial institution will stay in the Class and will be legally bound by all of the decisions that the Court makes. If the Plaintiffs obtain money or benefits — either as a result of the trial or a settlement — your financial institution will be able to apply for a share.  However, whether the Plaintiffs win or lose, your financial institution will not be able to sue, or continue to sue, Sonic about the legal claims in this case, ever again.

11. What happens if my financial institution excludes itself?

If your financial institution excludes itself from the Class, and the Class gets any money or benefits, it will not be able to get any of that money or those benefits. However, if your financial institution excludes itself, it will not be legally bound by the Court’s judgments. Your financial institution will be able to sue Sonic on its own about the same legal claims that are involved in this case, now or in the future.

If your financial institution does pursue its own lawsuit after it excludes itself, it will have to hire its own lawyer for that case at its own expense, and your financial institution will have to prove its claims without the benefit of the work performed by the lawyers in this class action.

12. How does my financial institution request to be excluded?

To exclude itself, your financial institution may do so in writing by sending an exclusion letter. The exclusion letter must include: (1) the name of your financial institution, (2) the address of your financial institution, and (3) the name and signature of the person submitting the request on the financial institution’s behalf, along with the phrase “Exclusion Request.” You must send the Exclusion Request postmarked or emailed by July 19, 2021, to:

In Re: Sonic Corp. Customer Data Breach Litigation – Exclusions
P.O. Box 3336
Baton Rouge, LA 70821
or
info@SonicFiClass.com

The Lawyers Representing Your Financial Institution

13. Do Class Members have lawyers?

Yes. The Court appointed the law firms of Berman Fink Van Horn P.C. and Zimmerman Reed LLP to represent the members of the Class as “Class Counsel.” Your financial institution does not have to pay Class Counsel. If your financial institution is a Class Member and wants to be represented by its own lawyer and have that lawyer appear in court for it in this case, your financial institution may hire one at its own expense. Contact information for Class Counsel is listed below.

Charles H. Van Horn
BERMAN FINK VAN HORN P.C.
3475 Piedmont Road, NE, Suite 1100
Atlanta, GA 30305
Telephone: (404) 261-7711
Facsimile: (404) 233-1943
cvanhorn@bfvlaw.com

Brian C. Gudmundson
ZIMMERMAN REED LLP
1100 IDS Center, 80 South 8th Street
Minneapolis, MN 55402
Telephone: (612) 341-0400
Facsimile: (612) 341-0844
brian.gudmundson@zimmreed.com

More information about Class Counsel is available on their websites.

14. How will the lawyers be paid?

If Class Counsel obtains money or benefits for the Class, they will ask the Court for fees and expenses. If the Court grants their request, the fees and expenses may be deducted from any money obtained for the Class or it may be paid separately by Sonic.

15. Does my financial institution have to have its own lawyer?

If your financial institution is a member of the Class, it does not need to hire its own lawyer because Class Counsel is working on its behalf. But, if your financial institution wants its own lawyer, it will have to hire that lawyer at its own expense. For example, your financial institution can ask him or her to appear in court on its behalf if your financial institution wants someone other than Class Counsel to speak on its behalf.

16. How and when will the Court decide who is right?

If the case is not dismissed or settled, the Plaintiffs will have to prove their claims at a trial. The trial is currently set for October 11, 2021. During the trial, the evidence will be heard so that a decision can be reached about whether the Plaintiffs or Sonic are right about the claims and defenses in the lawsuit. There is no guarantee that the Plaintiffs will win or that any money or benefits will be awarded to the Class.

17. Does my financial institution have to come to trial?

Your financial institution will not need to attend unless it chooses to do so or it is asked to attend by the Court. Class Counsel will present the case for the Plaintiffs and Class Members, and the lawyers for Sonic will present its defenses. Your financial institution and/or its own lawyer are welcome to come, at its own expense.

18. Will my financial institution get money after the trial?

If the Plaintiffs obtain money or benefits as a result of the trial or a settlement, your financial institution will be notified about how to participate. The trial is currently scheduled for October 11, 2021. There is no way to know how long this litigation will take. Information will be posted on the website www.SonicFiClass.com, as it becomes available. You can access the website whether your financial institution stays in the lawsuit or excludes itself.

Additional Information

19. Are more details available?

View the Case Documents page, where you will find Plaintiffs’ Amended Class Action Complaint, Sonic’s answer and affirmative defenses, the Court’s Amended Opinion and Order granting class certification and other documents filed with the Court in this case. If you have any questions about this Notice, you may contact Class Counsel listed above. You may also contact your financial institution’s own attorney to seek advice with respect to your financial institution’s legal rights.

Please do not contact the Court, the Clerk of the Court, or Sonic for additional information. They cannot answer any questions about the lawsuit.