Carmack v. Snap-on Incorporated

This lawsuit arose out of a March 2022 attempt by cyber criminals to access Snap-on’s network (the “Security Incident”). As a result, the personal information of current and former Snap-on associates and franchisees may have been accessed. People whose data was compromised will be affected by the Settlement. Specifically, members of the Settlement Class, defined below, will be affected.

The Plaintiff and Defendant will ask the Court to certify a Settlement Class defined as “all individuals residing in the United States whose Personal Information was compromised in the Security Incident that is the subject of the data security incident notice that Snap-on sent to the Settlement Class Representative and others in substantially the same form on or after April 7, 2022.” The Settlement Class specifically excludes: (i) Snap-on or any related entities, and their officers and directors; (ii) all Settlement Class Members who timely and validly request exclusions from the Settlement Class; (iii) any members of the judiciary who are or have presided over the instant Action and members of their families and staffs; and (iv) any other person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity occurrence of the Security Incident or who pleads nolo contendere to any such charge.

If the Settlement does not become effective (for example, because it is not finally approved, or the approval is reversed on appeal), then the Parties will first try to revise the Settlement to remedy any deficiencies through good faith negotiations. If that fails, litigation will continue.

In March 2022, cyber criminals attempted to illegally access information stored on Snap-on’s IT network. As a result, the Personal Information of current and former Snap-on associates and franchisees may have been accessed. This event is referred to as the Security Incident.

The Lawsuit, brought in June 2022 by Plaintiff Carmack against Defendant Snap-on, contends that Defendant stored its current and former associates’ and franchisees’ personal information without proper data security. Because of this, the Lawsuit alleges, the cybercriminals were able to steal the personal information of Snap-on associates and franchisees. Snap-on denies all allegations that it lacked reasonable data security practices, or that its actions in any way led to the Security Incident. The Court has not determined whether Plaintiff or Defendant is correct.

Plaintiff contends that Defendant was negligent when creating its data security protocols, and that this negligence allowed cybercriminals to access the personal information of current and former Snap-on employees. Plaintiff also contends that Defendant had an implied contract to provide security for the data it collected, and that, once Defendant collected the data, it had a fiduciary duty to its associates and franchisees to protect the data. The Lawsuit seeks to recover, on behalf of all Settlement Class Members, monetary damages as a result of the alleged negligence, as well as certain enhancements to Snap-on’s data security practices moving forward. Defendant denies all of the allegations in the Lawsuit and contends that it has always provided proper and reasonable data security.

Plaintiff filed the original lawsuit on June 12, 2022 in the United States District Court for the Eastern District of Wisconsin.

Plaintiff’s Counsel conducted a thorough examination and investigation of the facts and law relating to the matters in the Lawsuit, which included extensive informal discovery, requesting and receiving documents from Defendant, examining Defendant’s documents, and questioning Defendant regarding its documents.

On October 10, 2022, the Parties participated in an all-day mediation conducted by Bruce Friedman, a mediator well versed in data breach and privacy litigation.

Counsel for both Plaintiff and Defendant have determined that there is significant risk in continuing the litigation. Among the risks of continued litigation for Plaintiff are the risks of failing to prove liability or restitution and damages on a class-wide or individual basis. In particular, there may be difficulties establishing: (1) Defendant’s cybersecurity measures were inadequate to prevent the Security Incident, (2) that Defendant had a duty to Plaintiff and the Class to provide such a high level of data security, (3) the amount of damages or restitution due to the Class or to any Class member, and (4) that common questions predominate over individual issues such that a Class may be certified. After considering the risks and costs of further litigation, the Parties have concluded that it is desirable that Plaintiff’s claims be settled and dismissed on the terms of the Settlement Agreement.

Plaintiff and his counsel believe that the terms of the Settlement are fair, reasonable, adequate, and equitable, and that the Settlement is in the best interest of the Settlement Class Members.

All Settlement Class Members are eligible to receive a cash payment and an additional year of free credit monitoring services. In most circumstances, to receive benefits from the Settlement, you must complete and return the Claim Form and activate the personalized credit monitoring code included on the mailed notice. You can file a claim online on the Submit Claim page. You may also view and download a copy of the Claim Form by visiting the Important Documents page. To look up your personalized credit monitoring code visit the Credit Code Lookup page and enter your Claim ID and Confirmation Code. Snap-on has already given you an activation code for twenty-four (24) months of free credit monitoring services in the Security Incident notice that Snap-on sent you on or after April 7, 2022. To receive the additional year of credit monitoring benefit, you do not need to file a Claim Form. If you previously activated credit monitoring services when Snap-on offered them to you, your services will automatically be extended for an extra year, unless you decline the extension by visiting the Credit Code Lookup page. If you did not previously activate the credit monitoring services Snap-on offered to you, you may do so now with the activation code provided with the notice mailing.

There are two kinds of cash payments available:

1. Class Members who have not suffered any instance of identity theft or fraud may submit a claim to be reimbursed for verified lost time they have spent dealing with the Security Incident, and for any documented out-of-pocket expenses they have incurred in response to the Security Incident, up to $750. To receive reimbursement for out-of-pocket expenses (such as bank fees, long distance phone charges, cell phone charges (only if charged by the minute), data charges (only if charged based on the amount of data used), postage, or gasoline for local travel), you must submit documentation of such expenses, as well as an attestation under penalty of perjury that such expenses are the result of the Security Incident and have not been previously reimbursed by an institution, such as through the IDX insurance previously offered to Settlement Class Members by Snap-on, other insurance coverage, or a financial institution. To receive reimbursement for the lost time you spent dealing with the impact of the Snap-on Security Incident, you must simply submit an attestation, under penalty of perjury, to the time you have spent dealing with the Security Incident. You will be reimbursed for your time at your actual hourly wage, but in no case less than $15/hour or more than $25/hour.
2. Class Members who have suffered an instance of identity theft or fraud may also be reimbursed up to $2,500. To receive this money, you must submit documentation, under penalty of perjury, demonstrating (a) the unreimbursed out-of-pocket expenses and losses you incurred as a result of the fraud or identity theft, and (b) that you first sought reimbursement of such expenses through the IDX insurance offered by Snap-on and such claim was denied and has not been previously reimbursed by any other insurance coverage or a financial institution.

Cash payments will be paid by check sent via first-class mail to the mailing address you provide on the Claim Form or by direct deposit into your bank account, or another form of electronic transfer (such as PayPal, Venmo, Zelle, Google Wallet, CashApp, or Square Cash). Instructions are provided on the Claim Form, available on the Important Documents page.

As described on the Claim Form, to participate in the Settlement, you can submit a Claim under Group A or Group B (or both). Those who submit under Group B are eligible for a greater amount of cash from the Settlement but are required to submit, in addition to the Claim Form, documentation demonstrating the losses they have suffered from identity theft or fraud, such as receipts for cybersecurity services, unnecessary credit card fees, or proof of unreimbursed fraudulent bank transfers. Those who submit under Group A are not required to provide documentation but must still fill out and submit a valid, signed Claim Form, and must attest under penalty of perjury that the information contained therein is accurate.

Claims for cash payment will be paid only if deemed valid and only 60 days after the Effective Date of the Settlement. The earliest that claims can be paid is July 27, 2023. You may activate your codes for credit monitoring services now, without waiting for the Effective Date.

To make a Claim for a cash payment, you must fill out the Claim Form sent to you. You may also download a Claim Form on the Important Documents page; and then complete and return it (with supporting documentation, if any) either electronically on the Submit Claim page or by mailing hard copies to the Settlement Administrator at Snap-on Security Incident Settlement, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103 by 11:59 p.m. Pacific Time on May 28, 2023.

To claim the free credit monitoring being offered, simply enroll with the personalized activation code(s) you receive and activate the service as set forth in FAQs #5 above.

The Court will decide whether to approve the Settlement at a Final Approval Hearing. That hearing is currently scheduled for May 22, 2023.

If the Court approves the Settlement and there are no appeals, then cash payments will be distributed by approximately July 27, 2023. Your additional year of free credit monitoring benefit is available upon activation of the personalized code(s) you receive, as set forth in FAQs #5 above.

Yes. Migliaccio & Rathod, LLP is serving as Settlement Class Counsel. “Settlement Class Counsel” means lawyers appointed by the court to represent the group of people harmed in the case. Here, since you are a member of the Class, your interests are represented by Migliaccio & Rathod. Class Counsel is representing you only as a member of this class—nothing in the notice should be construed as establishing an attorney-client relationship in any other matter.

You do not need to hire your own lawyer to get the benefits of this Settlement. You may, however, hire your own lawyer, if you wish to object to the Settlement. See FAQs #11 & FAQs #12, below.

If you are interested in contacting Class Counsel, you may do so by emailing info@classlawdc.com or by calling (202) 470-3520.

To date, Class Counsel has not been compensated for any of their work on this case. As part of the Settlement, Class Counsel may apply to the Court for an award of up to $225,000 to pay their Attorneys’ Fees and Expenses.

In addition, the Plaintiff in this case may apply to the Court for a Service Award up to $3,000. This payment is designed to compensate Plaintiff for the time, effort, and risks he undertook in pursuing this litigation.

The Court will ultimately determine and approve the amount of Attorneys’ Fees and Expenses, as well as the amount of the Service Award, to be awarded to Plaintiff and his counsel.

If you are a Settlement Class Member and you do not opt out of the Settlement, you will be legally bound by all orders and judgments of the Court, and you will also be legally bound to the Releases of the claims in the Settlement. This means that in exchange for being a Settlement Class Member and being eligible for the benefits of the Settlement, you will not be able to sue, continue to sue, or be part of any other lawsuit against Snap-on and/or any of the Released Parties that involves the same legal allegations as those resolved through this Settlement.

You will not be responsible for directly paying any out-of-pocket costs or attorneys’ fees concerning this case if you stay in the Settlement Class. Rather, attorneys’ fees and costs, if approved by the Court, will be paid by Defendant. Staying in the Settlement Class means that you give up the following legal claims, as spelled out in the terms of the Release in the Settlement Agreement:

As of the Effective Date of the Settlement Agreement, the Releasing Parties, each on behalf of themselves individually and on behalf of their respective heirs, assigns, beneficiaries, and successors, shall automatically be deemed to have fully and irrevocably released and forever discharged Snap-on and each of its present and former parents, subsidiaries, successors, assigns, insurers, and subrogees, and the present and former directors, officers, employees, agents, members, managers, attorneys, successors, assigns, insurers, and subrogees of each of them (collectively the “Released Parties”), of and from any claim, liability, right, demand, suit, matter, obligation, damage, including consequential damages, losses or costs, liquidated damages, statutory damages, punitive damages, attorneys’ fees and costs, actions or causes of action of every kind and description, whether known or unknown, and whether in law, in equity, for administrative relief, or otherwise, that the Releasing Persons had, have, or may have against Defendant and/or the Released Persons that were or could have been alleged in Carmack v. Snap-on Incorporated, Case No. 2:22-cv-00695-WED (E.D. Wis.), based upon the facts alleged in Plaintiff’s Complaint including, without limitation, any claims, actions, causes of action, demands, damages, penalties, losses, or remedies relating to, based upon, resulting from, or arising out of (1) the alleged unauthorized access to, theft, exposure, or disclosure of Settlement Class Members’ Personal Information; (2) the maintenance and storage of Settlement Class Members’ Personal Information; (3) Defendant’s information security policies and practices; (4) Defendant’s notice of the security incident to any Settlement Class Member; and (5) policies and procedures otherwise related to the Security Incident (the “Released Claims”). As part of the release, Plaintiff and Settlement Class Members agree to waive (i) the provisions of California Civil Code § 1542, which provides that a general release does not extend to claims that the creditor does not know or suspect to exist in his or her favor at the time of executing the release, which if known by him or her must have materially affected his or her settlement with the debtor, and (ii) any law of any state or territory of the United States that is similar, comparable, or equivalent to California Civil Code § 1542.

For the avoidance of doubt, and without in any way limiting the preceding paragraph, the Released Claims include any claims that a Releasing Party may have under the law of any jurisdiction, including, without limitation, those arising under state or federal law of the United States; causes of action under the common or civil laws of any state in the United States, including but not limited to: unjust enrichment, negligence, breach of contract, breach of implied contract, breach of fiduciary duty, breach of implied covenant of good faith and fair dealing, misrepresentation (whether fraudulent, negligent, or innocent), fraudulent concealment or nondisclosure, invasion of privacy, public disclosure of private facts, and misappropriation of likeness and identity; any causes of action based on privacy rights provided for under the constitutions of the United States or of any states in the United States; and also including, but not limited to, any and all claims in any state or federal court of the United States, for damages, injunctive relief, restitution, disgorgement, declaratory relief, equitable relief, attorneys’ fees and expenses, pre-judgment interest, credit or financial account monitoring services, identity theft insurance, the creation of a fund for future damages, statutory penalties, restitution, the appointment of a receiver, and any other form of relief. The Released Claims do not include any claims arising from or relating to any conduct by Snap-on after the date the Agreement is executed.

As of the Effective Date of the Settlement Agreement, the Releasing Parties will be deemed to have completely released and forever discharged the Released Parties and Class Counsel from and for any and all liabilities, claims, cross-claims, causes of action, rights, actions, suits, debts, liens, contracts, agreements, damages, costs, attorneys’ fees, losses, expenses, obligations, or demands, of any kind whatsoever, whether known or unknown, existing or potential, or suspected or unsuspected, whether raised by claim, counterclaim, setoff, or otherwise, including any known or unknown claims, which they have or may claim now or in the future to have, relating to the institution, prosecution, or settlement of the Action.

The Settlement Agreement shall be the sole and exclusive remedy for any and all Released Claims of the Settlement Class Members. Upon entry of the Final Judgment, the Releasing Parties shall be enjoined from prosecuting any claim they have released in the preceding paragraphs in any proceeding against any of the Released Parties or based on any actions taken by any of the Released Parties that are authorized or required by this Agreement or by the Final Judgment. It is further agreed that the Settlement may be pleaded as a complete defense to any proceeding subject to this section.

You can opt out of the Settlement Class if you wish to retain the right to sue Defendant separately for the Released Claims. If you opt out, you cannot file a Claim or Objection to the Settlement.

To opt out, you must complete the online form available on the Opt-Out Request page or mail an opt-out request to the Settlement Administrator at Snap-on Security Incident Settlement Attn: Opt Out P.O. Box 58220, Philadelphia, PA 19102, copies of which will be sent to Class Counsel and counsel for Defendant by the Settlement Administrator. A copy of the opt out request form is available for down on the Important Documents page. If mailed, the opt-out request must include the individual’s name and address; a statement that he or she wants to be excluded from the Action; and the individual’s signature. The opt-out request must be submitted online or mailed to, and received by, the Settlement Administrator by the opt-out Deadline set forth above.

The Court will hold a hearing on May 22, 2023, to consider whether to approve the Settlement. The hearing will be held in the United States District Court of the Eastern District of Wisconsin, before Magistrate Judge William E. Duffin at United States Federal Building and Courthouse, 517 E. Wisconsin Ave, Milwaukee, WI 53202, and may be held virtually.

The hearing is open to the public. This hearing date and location may change without further notice to you. Consult this Settlement Website or the Court docket in this case available through Public Access to Court Electronic Records PACER (http://www.pacer.gov), for updated information on the hearing date and time.

You can inspect many of the court documents connected with this case on the Important Documents page. Other papers filed in this lawsuit are available by accessing the Court docket in this case available through PACER (http://www.pacer.gov).

You can contact the Settlement Administrator at Info@SnapOnSecurityIncident.com or by telephone at 1-866-516-6668.

PLEASE DO NOT CONTACT THE ATTORNEYS FOR THE DEFENDANT.