District Court Grants Final Approval to Data Breach Class Action Settlement Reached with Hy-Vee, Inc.

On July 21, 2021, the United States District Court for the Central District of Illinois issued an order and opinion granting final approval to a class action settlement reached with Iowa-based supermarket chain Hy-Vee, Inc. This lawsuit was brought by consumers who made purchases at affected Hy-Vee locations and whose credit/debit card information was potentially accessed by unauthorized users as part of a data breach which occurred from approximately November 2018 until August 2019 (“the Security Incident”). The plaintiffs alleged that Hy-Vee failed to take adequate measures to safeguard this sensitive customer payment card information. In agreeing to the settlement, Hy-Vee denied these allegations.

The settlement class is comprised of all persons who made purchases from affected Hy-Vee locations using their credit or debit card during the Security Incident. The proposed settlement provides benefits for the Class including: 1) reimbursement of up to $225 for out-of-pocket expenses resulting from the security incident; 2) reimbursement of up to three hours of documented lost time (at $20/hour) spent dealing with replacement card issues or in reversing fraudulent activity; 3) an additional $20 payment for each credit or debit card on which documented fraudulent charges were incurred that were later reimbursed.  The settlement also provided for Hy-Vee to undertake significant data security enhancements that the parties valued at approximately $20 million. The deadline for class members to submit claims for cash reimbursement has now expired. In granting final approval, the Court appointed Chimicles Schwartz attorneys Benjamin F. Johns and Alex M. Kashurba as Class Counsel for the settlement class, along with their co-counsel.