CUNA Mutual Group expects to file suit against BJ's Wholesale Club and Fifth-Third Bank on behalf of some 300 of CMG's policyholder CUs who sustained losses when credit card information was stolen from the retailer's data banks.
"We have 300 credit unions (with CUNA Mutual policies) and counting telling us they have incurred losses as a result of the BJ's incident," said CUNA Mutual SVP-CU Protection Division Mark Krasnick. "Total losses from this are already at about $5 million, and we expect to hear from more credit unions with more losses."
In addition to losses due to fraudulent credit card activity, credit unions have also sustained losses related to blocking and reissuing cards to their members, he explained.
In a recent letter to its client credit unions, CUNA Mutual identified the specific alert numbers believed to be related to the BJ's compromise, which should allow credit unions to more accurately and definitively identify any accounts that may have been effected.
"Litigation is extremely expensive, so this is something we are doing as a value-added part of being a CUNA Mutual policyholder," Krasnick offered. "We are pulling together the resources to file the lawsuit to recover our losses and on behalf of our credit union policyholders to recover their losses, as well."
In theory, the data that was stolen from BJ's shouldn't have been retained by the retailer to begin with, he observed, noting that while merchants have every right to the initial "capture" of mag stripe data on a credit card at the time of purchase, retaining that information after the purchase violates card associations' rules.
BJ's has gone on the record acknowledging that its data files were compromised, but it has also publicly denied any liability related to the incident. In light of these public statements, CUNA Mutual said it has not attempted to contact the merchant about the situation and continues to gather its resources for a future lawsuit.
Going forward, CUNA Mutual is working with the card associations to prevent such compromises. "We believe the practice of using software systems that capture and store full magnetic stripe information is fairly prevalent," Krasnick said.
