PHILADELPHIA - In a decision that could have broad ramifications, a federal appeals panel has overturned a lower court ruling that said Pennsylvania State Employees CU did not have standing to sue BJ’s Wholesale Club and Fifth Third Bank over a 2004 credit card breach at that cost credit unions tens of millions of dollars to plug.
The U.S. Court of Appeals for the Third Circuit sent the case back to the district court to hear the suit, which the lower court dismissed because it found that third parties, like the $3-billion credit union, had no standing to sue the two parties.
Broad Implications
The case could have broad implications for credit unions, which have spent millions of dollars in recent years to reissue cards in numerous breaches: at BJ’s; TJX (TJ Maxx); Hannaford Bros., 1st Source Bank and many other smaller incidents.
Gregory Smith, president of PSECU, said they intend to pursue their claims in the case, which cost them more than $100,000. The credit union only detected about $2,000 of fraud before shutting the cards down, but the vast majority of the costs went to cancel and reissue about 20,000 Visa cards. “We acted so quickly that our fraud losses were only a couple thousand dollars,” said Smith.
“Our members, my members, paid those costs and we did nothing wrong,” said Smith. “Since then I’ve had the TJ Maxx case, and several other situations. I want a precedent that I can rely on to get my costs back.”
The ruling also cleared the way for a separate suit filed in the case by Sovereign Bank. If allowed to stand, the ruling will open up the courts to other credit unions wanting to pursue similar claims in data breach cases.
In the BJ’s Wholesale case, one of the first large-scale credit card breaches, hackers broke into the big-box retailer’s database where BJ’s was retaining and storing Visa and MasterCard magnetic stripe information after authorized transactions.
The practice violates the credit card companies’ agreements with merchants, the so-called Payment Card Industry standards, and BJ’s was eventually fined by MasterCard and Visa.
The $10-Milllion Breach
As many as 200 credit unions were affected and paid an estimated $10 million to reissue cards, even though–as in most breaches–only a small amount of fraud was detected. In fact, Smith said his credit union only had a “few thousand dollars” worth of fraud.
Most of the affected credit unions were insured by CUNA Mutual Group, which has sued BJ’s in state court in Massachusetts on their behalf. PSECU was not insured by CUNA Mutual, so did not sign on to that suit.
In June the state court dismissed the credit unions’ suits. CUNA Mutual is appealing that ruling to the state appellate court.
Smith said he hopes his credit union cans set a precedent that the party responsible for data breaches like BJ’s and TJMaxx will pay the costs of its customers for resolving the incidents. “Until the merchants actually feel the financial motivation to secure the data than they will not do enough to protect it,” he said.
Officials with Fifth Third Bank could not be reached for comment. Representatives of BJ’s Wholesale did not return phone calls.(c) 2008 The Credit Union Journal and SourceMedia, Inc. All Rights Reserved.http://www.cujournal.com http://www.sourcemedia.com
