MADISON, Wis. – CUNA Mutual Group officials expressed regret yesterday at this week’s setback in the BJ Wholesale Club Breach but said they hope the losing suit in the case helps bring awareness to shortcomings in the system for compensating credit unions and other financial institution victims of card frauds.
“It's disappointing the Massachusetts Supreme Court concluded that the card associations' compliance process provided an adequate remedy for credit unions that suffered huge losses in the BJ's Wholesale Club breach,” said Chuck Cashman, plastic card product executive for CUNA Mutual. “This is an unfortunate ruling and one which we, and likely our credit union partners in this litigation, do not agree with.”
He was referring to this week’s ruling by that state’s High Court affirming a lower court ruling dismissing the multi-million dollar lawsuit by CUNA Mutual’s CUMIS Insurance Society affiliate on behalf of 130 credit unions whose credit cards were breached in the 2005 hacking of BJ’s Wholesale Club.
The credit union insurer had sued BJ’s for breach of a third-party contract, based on BJ's agreement with merchant acquirer Fifth Third Bancorp not to store customers' magnetic-stripe data. The lower court sided with BJ's, and the state high court affirmed, saying the contract was exclusively between BJ's and Fifth Third.
The credit union wanted BJ’s to pay compensation for the millions of dollars it cost to replace credit cards that were breached by the hackers.
CUNA Mutual’s Cashman said he hoped the case will help continue the progress in pushing for data breach legislation. “By pursuing this litigation, CUNA Mutual helped expose the limitations of existing law in providing recourse which, in turn, helped spur the passage of legislation in some states. We're hopeful our efforts provided some motivation to the card associations to increase their efforts to require compliance with their rules, thereby helping reduce the chances for these types of occurrences in the future,” he said.
Meantime, Pennsylvania State Employees CU, which spent almost $100,000 to replace cards breached in the BJ’s case, said it has ended its legal pursuit of claims against Fifth Third Bancorp. Greg Smith, president of the $3.5 billion credit union, told The Credit Union Journal yesterday they agreed to settle the case out of court but could not discuss the terms under the settlement.
A group of hackers has confessed to the 2005 BJ’s breach, as well as breaches at TJX Cos., Barnes & Nobles, Sports Authority, Hannaford Bros. supermarkets and Heartland Payment Systems, among others.
In the BJ’s case, the trial court sided with BJ's, and the Massachusetts Supreme Court affirmed, saying the contract was exclusively between BJ's and Fifth Third.
The contract stated: "This agreement is for the benefit of, and may be enforced only by, (Fifth Third) and (BJ's) ... and is not for the benefit of, and may not be enforced by, any third party."
The court also tossed fraud and negligence claims against BJ's and Fifth Third Bank, saying they never misled the credit unions and CUMIS about their compliance with Visa and MasterCard regulations.
