WALLINGFORD, Conn. -
Kevin Chandler, the Connecticut league's CEO, said in a statement the lawsuit is one way of protecting credit union members, along with legislation working its way through the Connecticut State Assembly.
"This breach was a brazen violation of the network rules that require private member information be promptly destroyed by the retailer," Chandler said. "And yet, there is woefully little recourse to recover the costs associated with breaches like these."
Chandler said some of the costs of a data breach include mailings to notify members a breach has occurred, purchase of new blank cards, printing and mailing of replacement cards, and the negative impact on the reputation of the credit union.
"The vast majority of the membership automatically assumes the breach was the fault of the credit union," he said. "You simply can't get back the trust that credit unions have spent years earning when something like this happens."
The Connecticut league said legislation moving through the State Assembly seeks to address the issue by making retailers liable for the hard costs associated with a breach. The league said the bill, SB 1089, would make businesses liable to financial institutions for unauthorized use of members' personal information. Liability costs would include costs incurred with canceling or reissuing any credit card, debit card or other account access device, closing any account, opening or reopening an account, any refunds or credits made, and any assistance provided to members to mitigate or prevent loss or inconvenience. "Legal action is always the path of last resort," Chandler said. "But this case is so egregious, so negligent, that there just doesn't seem to be any other option to protect our members."
