PHILADELPHIA – In a decision that could have broad ramifications, a federal appeals panel this week overturned a lower court ruling that said Pennsylvania State Employees CU did not have standing to sue BJ’s Wholesale Club and Fifth Third Bank over a 2004 credit card breach that cost credit unions tens of millions of dollars to plug.
The U.S. Court of Appeals for the Third Circuit sent the case back to the district court to hear the suit, which the lower court dismissed because it found third parties, such as the $3 billion credit union, had no standing to sue the two parties.
Gregory Smith, president of PSECU, yesterday said it intends to pursue its claims in the case, which cost it more than $100,000. The credit union only detected about $2,000 of fraud before shutting down the cards, but the vast majority of the costs went to canceling and reissuing about 20,000 Visa cards. “We acted so quickly that our fraud losses were only a couple thousand dollars,” said Smith.
“Our members, my members, paid those costs and we did nothing wring,” Smith told The Credit Union Journal.
“Since then I’ve had the TJ Maxx case, and several other situations,” said Smith. “I want a precedent that I can rely on to get my costs back.”
The ruling also cleared the way for a separate suit filed in the case by Sovereign Bank.
The ruling, if allowed to stand, will open up the courts to other credit unions wanting to pursue similar claims in data breach cases.
In the BJ’s Wholesale case, one of the first large-scale credit card breaches, hackers broke into the big-box retailer’s database where BJ's was retaining and storing Visa and MasterCard magnetic stripe information after authorized transactions. The practice violates the credit card companies' agreements with merchants, the so-called Payment Card Industry standards, and BJ’s eventually was fined by MasterCard and Visa.
As many as 200 credit unions were affected and paid an estimated $10 million to reissue cards, even though – as in most breaches – only a small amount of fraud was detected.
Most of the affected credit unions were insured by CUNA Mutual Group, which has sued BJ’s in state court in Massachusetts on their behalf. PSECU was not insured by CUNA Mutual, so it did not sign on to that suit.
In June, the state court dismissed the credit unions’ suits. CUNA Mutual is appealing that ruling to the state appellate court.
Smith said he hopes his credit union can set a precedent that the party responsible for data breaches, such as BJ’s and TJ Maxx, will pay the costs of its customers for resolving the incidents. “Until the merchants actually feel the financial motivation to secure the data, then they will not do enough to protect it,” he said.
Officials with Fifth Third Bank could not be reached for comment. Representatives of BJ’s Wholesale did not return phone calls.
