Sonic Faces Class Action Lawsuit in Data Breach

Sonic fast-food chain must be tried after data breach forces major financial institutions to issue new credit cards for customers and reimburse hackers’ funds.

After Sonic had sought an early judgment in a class-action lawsuit brought by the banks, U.S. District Judge James S. Gwin ruled in Sonic’s favor.

The drive-in restaurant claimed that banks didn’t have sufficient proof that Sonic was responsible for the hack. Judge Gwin however ruled that Sonic’s affirmative acts created a danger of harm and that Sonic knew or should have known about the unreasonably high risk of hacking.

Banks File Class Action for Sonic Drive-In Data Breach

After the 2017 data breach, American Airlines Federal Credit Union and Redstone Federal Credit Union settled a class action with Sonic, Arkansas Federal Credit Union filed a lawsuit against Sonic.

Hackers accessed the unencrypted credit cards data of Sonic’s cash register software provider Infor. For six months, the breach went unreported.

These three credit card companies hope to represent thousands more people.

Federal Judge agreed with financial institutions that Sonic had done multiple things to expose credit unions to a “high level of risk”. This included leaving Infor’s remote accessibility permanently enabled without blocking foreign IP addresses and creating a weak password for the VPN that did not require multi-factor authentication.

Judge Gwin stated that the chain also committed two “affirmative actions” by using software that didn’t require encryption or operating out-of-date data software systems in more than 700 franchises.

Brian C. Gudmundson and Michael J. Laird from Zimmerman Reed LLP represent financial institutions.

Sonic Corp. is the Sonic Data Breach MDL. Customer Data Breach Litigation, Case No. 1:17-md02807, U.S. District Court Northern District of Ohio

from lawyers.buzz https://lawyers.buzz/sonic-faces-class-action-lawsuit-in-data-breach/
via IFTTT