Class action settlement reached in Sonic data breach case

Posted: Jan 21, 2019 / 01:18 PM CST

Updated: Jan 21, 2019 / 01:18 PM CST

This is an archived article and the information in the article may be outdated. Please look at the time stamp on the story to see when it was last updated.

OKLAHOMA CITY – Less than two years after a data breach affected customers of a local fast-food chain, a settlement has been reached and some customers might be eligible for a cash payment.

In 2017, officials with Sonic Drive-In said that they were notified of “unusual activity” regarding credit and debit cards used at Sonic.

“The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in shadowy underground cybercrime stores,” according to KrebsOnSecurity, which first reported the possible breach.

“Our credit card processor informed us last week of unusual activity regarding credit cards used at SONIC. The security of our guests’ information is very important to SONIC. We are working to understand the nature and scope of this issue, as we know how important this is to our guests. We immediately engaged third-party forensic experts and law enforcement when we heard from our processor. While law enforcement limits the information we can share, we will communicate additional information as we are able,” a statement from Sonic read.

Less than a week after the announcement, a lawsuit was filed.

Now, it appears that a class action settlement was reached and customers may be eligible for a cash payment.

“The Settlement includes all residents of the United States of America who made a purchase at any one of the 325 impacted Sonic Drive-In locations and paid using a credit or debit card from April 7, 2017 through October 28, 2017,” the notice read.

Customers who visited one of the following Oklahoma locations during that time period must submit a claim in order to be eligible for payment: