Greater Chautauqua Federal Credit Union v. KMart Corporation et al

Filing 148

MOTION by Plaintiffs First Choice Federal Credit Union, Governmental Employees Credit Union, Greater Chautauqua Federal Credit Union, Gulf Coast Bank & Trust Company, Oteen V.A. Federal Credit Union for judgment (Plaintiffs' Unopposed Motion to Approve the Allocation Plan and to Enter an Expedited Order Granting Final Approval) (Attachments: # 1 Exhibit A)(Carroll, Katrina)

EXHIBIT A

KMART FI DATA BREACH SETTLEMENT
Claims Processing Analysis Narrative

Claim Requirements
In the process of submitting claims, Financial Institutions were required to elect which Tier(s) their claims would
apply to:
For Tier 1: Non GCAR Eligible Tier Claims, the Financial Institutions (FIs) were required to provide the total
number of Non GCAR Eligible Compromised Payment Cards for which the FI received an Alert related to the
Kmart Data Breach. Additionally, FIs were required to upload supporting documentation consisting of copies of
the Data Breach Alerts that were received for the claimed Non GCAR Eligible Compromised Payment Cards.
If these documents were unavailable, FIs were asked to provide as much information as possible.
For Tier 2: All Class Tier Claims, the FIs were required to provide the total amount of fraud damages incurred
related to the Kmart Data Breach and the total amount of card reissuance damages incurred related to the
Kmart Data Breach. Additionally, FIs were required to upload supporting documentation consisting of proof of
all fraud expenses incurred within the Fraud Window on Compromised Payment Cards, and/or supporting
documentation of proof of actual costs of replacing physical payment cards on Compromised Payment Cards.

Matching to Original Records
Epiq’s processing of submitted Claims consisted of both programmatic and manual aspects. First, Epiq
programmatically matched FIs to Original Records 1, wherever possible. If a programmatic match could not be
found, a manual review of the submission and the existing database would occur, in an attempt to match the
submission with an Original Record. As seen in lines 7 and 21, of the Claims Processing Analysis PDF, Epiq
matched 140 Tier 1 Claims to Original Records, and 73 Tier 2 Claims to Original Records.
The primary benefit of matching submissions to Original Records was to compare the claimed number of Non
GCAR Eligible Compromised Payment Cards against the total number of cards provided in the Visa and
MasterCard data files.

Official vs. Unofficial Documents
The most significant undertaking of Epiq’s Claims Processing was the review of submitted supporting
documents. As no two FIs keep identically formatted records, Epiq devised a protocol for determining
documentation type and validity.
Tier 1 Claim’s request for Data Breach Alerts resulted in a low variance on the format type of submitted
documents. Tier 1 Official Documents are defined as files containing full lists of affected cards, and/or
containing the proper alert codes, and/or clearly stating Non GCAR Eligible Compromised Payment Cards. If
the number of Non GCAR Eligible Compromised Payment Cards was not clearly stated in the supporting
documentation, analysts were instructed to subtract the number of alerted accounts from the number of GCAR
eligible accounts. Moreover, screen shots of official documentation were also considered Official Documents.
Tier 1 Unofficial Documents are defined as any document that was created by the FI containing only a
summary of the affected cards (rather than a list of the affected cards).

1

Original Records are those records provided in the Visa and MasterCard data files.

KMART FI DATA BREACH SETTLEMENT
Claims Processing Analysis Narrative
Tier 2 Claims did not contain a specific requirement for type or format of supporting documentation; therefore,
the variance among the submissions was high. In order to delineate the submission from one another, Epiq
defined Tier 2 Official Documents as invoices, bank statements, or fraud reports which contained items or
dates that directly corresponded to the data breach and/or Fraud Window. Tier 2 Unofficial Documents are
defined as any documents created by the FI, themselves. Examples of Tier 2 Unofficial Documents include FI
generated spreadsheets, balance reports, or personal records.

Results
As seen in the green highlighted cells of the Claims Processing Analysis PDF, Epiq recommends paying
Claims which provided Official or Unofficial Documents, but not paying Claims that provided no documents,
whatsoever, with the exception of Tier 1 Claims that were matched to an Original Record but did not submit
any documentation. The reason to include Tier 1 Claims that were matched to an Original Record but did not
submit any documentation as eligible for payment, is that Epiq could, at the least, verify those claimed counts
against the data provided by Visa and MasterCard. For all other Claims that did not submit any documentation
(“deficient” claims), Epiq has no avenue to verify or confirm their claimed counts or amounts. 2

Settlement Benefits
Tier 1:
• If the Epiq recommendations are approved, then at least 251 financial institutions will receive the
maximum payout of $2.38 per claimed card, and the minimum total payout for Tier 1 Claims will be
$740,515.58. 3
Tier 2:
• If the Epiq recommendations are approved, a minimum of 166 financial institutions will receive
payments for Tier 2 Claims. The maximum total payout for Tier 2 Claims will be $4,331,576.42, which
will be distributed on a pro rata basis.

2

Epiq is in the process of contacting the representatives for these deficient Claims and has allowed 10
business days for each FI to provide supporting documentation related to its Claim. Any submitted supporting
documentation will be evaluated using the same criteria outlined in the above narrative, and previously
“deficient” Claims may be re-categorized as valid and eligible. This process may result in an increase to the
number of valid and eligible Claims, but the number of paid claims shall not be reduced from what is currently
contemplated in the Claims Processing Analysis PDF. Only 21 claims were deemed deficient out of the 438
total claims submitted in Tier 1 and Tier 2.
3
This number may increase if any deficient claims are cured. Assuming that all of the deficient Tier 1 Claims
are cured, the maximum total payout for Tier 1 Claims will be $777,484.12.

Updated: May 18, 2017

Kmart FI Data Breach Settlement
Claims Processing Analysis

1 Total Number of Submissions (Claims)
2 Total Number of Claimants (Records)
Total Number of Claimants who filed ONLY Tier 1
3
4
Total Number of Claimants who filed ONLY Tier 2
5
Total Number of Claimant who filed both Tier 1 and Tier 2

350
337
159
77
101

6 Total Number of Tier 1 Claimants
Tier 1 Claimants Matched to Original Records
7
8
Number of Cards stated in Original Data
9
Number of Cards Claimed through Portal (will not equal the below three)
10
Number of Cards Claimed according to provided Official Documents
11
Number of Cards Claimed according to provided Unofficial Documents
12
Number of Cards Claimed w/ No Documents (from claimed count)
13
Tier 1 Claimants NOT Matched to Original Records
14
Number of Cards stated in Original Data
15
Number of Cards Claimed through Portal (will not equal the below three)
16
Number of Cards Claimed according to provided Official Documents
17
Number of Cards Claimed according to provided Unofficial Documents
18
Number of Cards Claimed w/ No Documents (from claimed counts)

260
140
217,072
114,370
107,528
25,329
20,838
120
110,120
91,333
66,113
15,533

19 Total Number of Tier 1 Cards Epiq Recommends Including In Calculations

311,141

20 Total Number of Tier 2 Claimants
Tier 2 Claimants Matched to Original Records
21
22
Damages Claimed through Portal (will not equal the below three)
23
Damages Claimed according to provided Official Documents
24
Damages Claimed according to provided Unofficial Documents
25
Damages Claimed w/ No Documents (from claimed amounts)
26
Tier 2 Claimants NOT Matched to Original Records
27
Damages Claimed through Portal (will not equal the below three)
28
Damages Claimed according to provided Official Documents
29
Damages Claimed according to provided Unofficial Documents
30
Damages Claimed w/ No Documents (from claimed amounts)

178
73
1,114,649.16
454,486.55
840,414.60
9,414.79
105
7,284,364.36
585,511.11
5,414,879.60
64,826.69

31 Total Number of Tier 2 Damages Epiq Recommends Including In Calculations

$
$
$
$
$
$
$
$

$ 7,295,291.86