In re Waste Management Data Breach Litigation

The Court authorized the Notice to inform you about a proposed Settlement with USA Waste-Management Resources, LLC (“WM” or “Defendant”). You have legal rights and options that you may act on before the Court decides whether to approve the proposed Settlement. You may be eligible to receive a cash payment and other benefits as part of the Settlement. The Notice explains the lawsuit, the Settlement, and your legal rights.

Judge Denise L. Cote of the United States District Court for the Southern District of New York is overseeing this class action. The case is called In re Waste Management Data Breach Litigation, Case No. 1:21-cv-06199-DLC (S.D.N.Y.).

A class action is a lawsuit in which one or more plaintiffs—in this case, Plaintiffs and Class Representatives Janie Marcaurel, Gabriel Fierro, Shelby Ingram, Mark Krenzer, Mary J. Fusilier, Clifford Harris, Nolan Brodie, Miguel Montelongo, Gerald Davis, Steven Dudley, Edward Couture, Rafael Moran, and Mary Chubbuck—sue on behalf of a group of people who have similar claims. Together, this group is called a “Class” and consists of “Class Members.” In a class action, a court resolves the issues for all Class Members, except those who exclude themselves from the Class.

Plaintiffs claim that Defendant failed to implement and maintain reasonable security measures to adequately prevent the Data Security Incident from occurring.

Defendant denies that it is liable for the claims made in the lawsuit. More information about the complaint in the lawsuit can be found here.

The Plaintiffs filed the first of four consolidated cases on July 19, 2021. On February 24, 2022, the District Court granted Defendant’s motion to dismiss the consolidated lawsuit. The Plaintiffs appealed that decision, and that appeal was pending in the Court of Appeals for the Second Circuit. On August 21, 2023, both sides agreed to this Settlement. That way, they can avoid the uncertainty, risks, and expense of ongoing litigation, and Settlement Class Members will be eligible to get compensation now rather than years later—if ever. The Class Representatives and attorneys for the Settlement Class Members, called Class Counsel, agree the Settlement is in the best interests of the Settlement Class Members. The Settlement is not an admission of wrongdoing by the Defendant.

You are part of the Settlement as a Settlement Class Member if you received notice of the January 2021 Data Security Incident from WM. Settlement Class Members were also sent notice of this Settlement via U.S. Mail.

If you are not sure whether you are included, you can contact the Settlement Administrator by calling 1-877-793-4157.

This Settlement Class does not include:

1. all Settlement Class Members who timely and validly request exclusion from and opt out of the Settlement Class;
2. the Judge(s) or Magistrate Judge(s) to whom the Action is assigned and any member of those Judges’ staffs or immediate family members; and
3. any members or employees of defense counsel.

Reimbursement for Ordinary Expenses, Extraordinary Expenses and Time Spent: If you suffered documented financial losses that are fairly traceable to the Data Security Incident, you may be eligible to receive compensation for these Ordinary Expenses. If you spent time responding to the Data Security Incident, you may be eligible to receive compensation for Time Spent. If you suffered identity theft reasonably traceable to the Data Security Incident, you may be eligible to receive reimbursement for Extraordinary Expenses.

1. Ordinary Expenses or Losses: You may make a Claim for reimbursement for documented Ordinary Expenses incurred after the Data Security Incident that are reasonably traceable to the Data Security Incident. Examples of ordinary expenses include costs incurred accessing or freezing/unfreezing credit reports with any credit reporting agency; purchasing credit monitoring; other miscellaneous expenses incurred related to any out-of-pocket loss such as notary, fax, postage, copying, mileage, and long-distance telephone charges; and unpaid time off work to address issues fairly traceable to the Data Security Incident at your actual hourly rate of pay. To present your Claim, you must attest that you made reasonable efforts to avoid losses and seek reimbursement for the losses, and you exhausted any existing credit monitoring and identity theft insurance. The maximum payment for any Claim for Ordinary Expenses is $750.00.
2. Time Spent: You may make a Claim for reimbursement for up to three (3) hours of time spent remedying or preventing identity theft or other fraud, misuse of your personal information attributable to the Data Security Incident, and/or dealing with the Notice of the Data Security Incident. Time Spent will be compensated at $20.00/hour and requires a brief description of (1) the action taken in response to the Data Security Incident; (2) the time associated with each action; and (3) an attestation that the time was spent responding to or addressing issues relating to the Data Security Incident, including receipt of the Notice of Data Security Incident. Claims for Time Spent are included within the $750.00 maximum for Ordinary Expenses.
3. Extraordinary Expenses: If your identity was stolen, and the identity theft is reasonably traceable to the Data Security Incident, you may be eligible for a payment of Extraordinary Expenses up to $3,000.00. However, your payment may not be more than the documented loss, provided that the loss is not already covered by one or more of the other settlement benefits. Further, you must attest that you made reasonable efforts to avoid losses and seek reimbursement for the losses, and you exhausted any existing credit monitoring and identity theft insurance. Examples of extraordinary expenses or losses include unreimbursed costs, expenses, losses, or charges incurred as a result of identity theft, identity fraud, or falsified tax returns.

Identity Theft and Credit Monitoring: Upon timely submission of a Claim Form, all Settlement Class Members are eligible to receive, free of charge, two (2) years of three-bureau credit monitoring services, including identity restoration services and up to $1,000,000.00 of identity theft insurance coverage for certain out-of-pocket expenses resulting from identity theft.

Remedial Measures: Defendant has also agreed to implement and/or maintain enhanced data security measures as part of the Settlement, including maintaining a policy to encrypt employee and third party personally identifiable information in transit and at rest and engaging a third party to conduct a cybersecurity penetration test annually, all for a period of at least five (5) years, to help keep information secure. For complete details, please see the Settlement Agreement.

The March 14, 2024 Claims Filing Deadline has passed. It is now too late to file a claim to receive a Settlement benefit.

The Court granted Final Approval to the Settlement on March 15, 2024. The Settlement Administrator is currently reviewing claims. Eligible Settlement Class Members whose Claims are approved by the Settlement Administrator will be given an opportunity to enroll in the Identity Theft Protection and Credit Monitoring Package and/or be sent payment after these reviews are complete. It is anticipated Settlement benefits will be distributed in Late Summer 2024.

Yes, the Court has appointed Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP as “Class Counsel” to represent the Settlement Class Members. You will not be charged for these lawyers. You can ask your own lawyer to appear in Court for you at your own expense if you want to be represented separately.

The Court approved attorneys’ fees, costs, and expenses in the amount of $440,000. This amount will be paid separately by WM and will not reduce the amount paid to Settlement Class Members who submit valid Claims.

If you do not exclude yourself from the Settlement, you will not be able to sue Defendant about the Data Security Incident, and you will be bound by all decisions made by the Court in this case, the Settlement, and its included Release. This is true even if you do not submit a Claim Form. However, you may exclude yourself from the Settlement (see FAQ 14). If you exclude yourself from the Settlement, you will not be bound by any of the Released Claims, which are described in the Settlement Agreement.

If you do nothing, you will receive no payment for any losses incurred from the Data Security Incident or benefits under the Settlement. You will be in the Settlement Class, and if the Court approves the Settlement, you will be bound by all orders and judgments of the Court, the Settlement, and its included Release. You will be deemed to have participated in the Settlement and will be subject to the provisions of FAQ 11.

If you exclude yourself from the Settlement, you will receive no benefits or payment under the Settlement. However, you will not be in the Settlement Class and will not be legally bound by the Court’s judgments related to the Settlement Class and Defendant in this class action.

The January 29, 2024 deadline to request exclusion from the Settlement has passed. It is now too late to request exclusion from the Settlement.

No. Unless you exclude yourself, you give up any right to sue Defendant for the claims or legal issues released in this Settlement, even if you do nothing.

No. If you exclude yourself, do not submit a Claim Form to ask for a payment.

The January 29, 2024 deadline to object to the Settlement has passed and the Court has approved the Settlement. It is now too late to object to the Settlement.

Objecting simply means telling the Court that you don’t like something about the Settlement. You can object only if you stay in the Settlement Class. Excluding yourself from the Settlement Class is telling the Court that you don’t want to be part of the Settlement Class. If you exclude yourself, you have no basis to object because the case no longer affects you. If you object, you are still part of the Settlement Class and will be bound by all orders and judgments of the Court, the Settlement, and its included Release if the Court approves the Settlement.

The Court held the Final Approval Hearing on March 15, 2024. At this hearing, the Court approved the Settlement as fair, reasonable, adequate, and in the best interests of the Settlement Class.

You can review submit a Claim Form online, call 1-877-793-4157 or write to:

In re Waste Management Data Breach Litigation
Settlement Administrator
P.O. Box 2078
Portland, OR 97208-2078

Please do not call the Court, the Clerk of the Court, the Judge, or the Defendant with questions about the Settlement or claims process.