HOUSTON – Lawyers representing more than 50 financial institutions – including some two dozen credit unions – are urging their clients to reject a $60 million settlement offer in the Heartland Payments System cards breach, saying the pro rata share amounts to pennies on the dollar of costs.
"If you look at the deal, it’s three, four, five cents on the dollar in most cases," said Michael Caddell, a Houston lawyer representing dozens of Heartland customers who are plaintiffs in a class action suit in the case. It was the biggest cards breach ever, exposing 130 million accounts.
Under the terms of the settlement, Heartland will pay Visa $60 million, which the card company will disperse to its banks and credit unions that incurred costs to stem the breach. According to Caddell, the $60 million amounts to just a small portion of what was incurred by thousands of institutions because of the breach at Heartland.
Under the terms, which were mailed to Visa card issuers last Thursday, the institutions have until Jan. 29 to agree to be part of the settlement.
Heartland agreed earlier to pay American Express $3.6 million to settle claims with its card issuers and currently is in negotiations with MasterCard, which is watching the reaction to the Visa offer closely.
Representatives at Visa and MasterCard did not respond to requests for comment.
The terms of the deal are similar to settlements Visa and MasterCard entered into in the TJX Cos. Breach. In that case, most credit unions agreed to payments, averaging around five cents on the dollar, in order to avoid the expense of suing. Some larger card issuers refused to sign on to the settlements and came to separate deal with Visa and MasterCard.
In both cases, Visa and MasterCard maintained a tight veil of secrecy. In the TJX case, Visa and MasterCard said the deal was contingent on a super majority vote by the issuers, but never explained exactly what that meant. Did it mean by total assets or number of cards issued, for example? The card companies set a strict deadline for acceptance of the offer by credit unions, but many credit unions rejecting the offer got better deals negotiating separate settlements later on.
The two cases are closely related because they were among as many as a dozen major breaches at large retailers perpetrated by a young hacker named Albert Gonzalez, a one-time U.S. government enforcement agent. Gonzalez and his accomplices also hacked into computer networks at Barnes & Nobles, Sports Authority, Hannaford Bros., OfficeMax, Boston Market, DSW, BJ Wholesale Club, as well as Heartland and TJX. The group sold credit card information over the Internet to individuals all over the world, who used it to create their own counterfeit cards, which were used to buy merchandise and withdraw cash from the hacked accounts.
Caddell, the Houston lawyer, said he can understand some credit unions will want accept the Visa offer if their costs were minimal in the case. But he said it is too soon in the legal process to determine a better deal. "We’re at the very beginning, we’ve had no discovery, the judge hasn’t even scheduled discovery in the case," he told The Credit Union Journal yesterday. "In the TJX case they were near the end."
The credit union plaintiffs in the case include: Pennsylvania State Employees CU, Alabama Rural Electric FCU, GECU, Matadors Community CU, Community West CU, First Castle FCU, Gulf Winds FCU, MIDFLORIDA FCU, and PBC CU.
