NEW ORLEANS A federal appeals court this week overturned a lower court ruling and remanded an appeal by four credit unions and three banks who sued Heartland Payments System for a massive 2008 data breach that exposed millions of credit union and bank cardholders to fraudulent transactions.
The U.S. Court of Appeals for the Fifth Circuit rejected the lower court’s finding that the card issuers’ beef was with Visa and MasterCard, with whom they had contracted, and not with them. It also rejected Heartland Payments’ claim, supported by the U.S. District Court in Texas that law in New Jersey, where the payments processor is incorporated, bars their negligence claims.
The plaintiffs in the case are: Pennsylvania State Employees CU, Elevations CU, O Bee CU, Seaboard FCU, Lone Star National Bank, Amalgamated Bank and First Bankers Trust.
The credit unions and banks have lost numerous suits related to dozens of major breaches over the last few years, including separate suits in this case filed against Heartland Payment’s merchant acquiring banks, Heartland Bank and KeyBank.
In its defense Heartland Payments argued the card issuers’ contract with the card networks and not with them, so they had not contractual responsibility to the credit unions and banks. In fact, Visa and MasterCard eventually compensated card issuers for the breach but the suing issuers opted out because the compensation was negligible, they said. The card issuers argued that Heartland Payment owed them what amounts to contractual duty because they are in a joint venture with Heartland through their common business relationship in the Visa and MasterCard networks.
The Heartland breach turned out to be one of more than a dozen major cards thefts engineered by the same suspect, Albert Gonzalez, a former government informant who was sentenced for 20 years in prison for hacking into data networks at BJ Wholesale, TJX Cos., Hannaford Bros., Barnes & Noble, 7-Eleven, Dave & Buster’s, OfficeMax, Boston Market, Forever 21 and DSW shoes.
