The Oregonian | By Mike Rogoway | November 12, 2019
Burgerville has a preliminary agreement to settle a class-action lawsuit brought against the restaurant chain over a hack that potentially exposed thousands of customers’ credit and debit card information.
The Vancouver-based restaurant chain was one of more than 100 businesses attacked by an international gang of cyberthieves last year. Most of the victims were in the restaurant or hospitality markets – others included Chipotle Mexican Grill, Chili’s, Arby’s and Red Robin.
Banks and financial institutions said afterwards they did not see widespread financial fraud as a result of the hack. Some individual customers, though, did report fraud they believe was related to the Burgerville incident.
In most cases federal law enables customers to be reimbursed by banks or merchants for such fraud reported within 60 days. And last year Burgerville had offered customers a free, one-year credit monitoring service to guard against intrusions.
Portland attorney Michael Fuller, who brought the suit on behalf of customers, said it will compensate customers for losses they experienced due to fraud or inconvenience due to the hack. He said it covers actual financial losses, costs associated with changing credit or debit cards, and the cost of credit monitoring services.
There is no hard ceiling on what Burgerville must pay out through the settlement, but if claims exceed $50,000 the Vancouver company can pay subsequent obligations in $15,000 monthly installments. Additionally, Burgerville is responsible for up to $203,000 in attorneys’ fees.
Specific provisions of the settlement include:
· Up to $3,000 per customer for expenses incurred because of a hack.
· Up to $250 for customers who did not experience fraud but had other expenses related to the incident.
· A second year of free credit monitoring – or two years of monitoring for customers who didn’t sign up last year.
· Burgerville promised to implement specific security protections, which will include separating credit and debit card information from the rest of the company’s internal network.
“This settlement ensures any affected customers are fairly compensated, while eliminating the risks and costs to all parties of continuing to engage in litigation,” Jill Taylor, Burgerville’s CEO, said in a written statement.
The preliminary settlement awaits court approval next month. Afterwards, it requires Burgerville to solicit claims on its website and through online ads in digital and print media.
https://www.oregonlive.com/business/2019/11/burgerville-settles-lawsuit-over-credit-card-hack.html
