Consumer Claims Survive Motion To Dismiss In Target Data Breach Class Action

A recent ruling by Federal District Judge Paul Magnuson will permit most of the consumer claims in the Target data breach litigation to survive Target's motion to dismiss. This most recent ruling follows on the heels of the court's December 2 decision partially denying Target's motion to dismiss consolidated complaint of the banks that issued the credit and debit cards that were subject to the breach. The late 2013 data theft that gave rise to the consumer and issuer bank claims was caused by malware placed by hackers on Target's point-of-sale ("POS") terminals. The malware allowed the hackers to record and steal payment card data as customers' credit or debit cards were swiped. In the consolidated consumer complaint, 117 named plaintiffs allege that Target wrongfully failed to prevent or timely disclose the data theft. Plaintiffs also contend that Target failed to disclose the purported insufficiency of Target's data security practices. The consumers assert claims under the laws of 49 states and the District of Columbia for negligence, breach of contract, breach of data notification statutes and violation of state unfair trade practice statutes. The consumer complaint also purports to assert those claims on behalf of a putative plaintiff class consisting of every Target customer whose credit or debit card information was stolen in the data breach.The court's latest ruling rejected arguments by Target as to standing and damages that would have required dismissal of the consumer claims in their entirety. The court did state, however, that Target can revisit the question of whether plaintiffs had sustained actionable injuries after discovery has concluded. And, even though most of the consumer Plaintiffs' claims survive, the court did rule that that certain of the claims alleged under particular states' laws should be dismissed. As is true of the court's denial of Target's motion to dismiss the issuer banks' consolidated complaint, the denial of the motion to dismiss does not resolve the merits of the surviving consumer claims. Like the surviving issuer bank claims, the consumer claims that were not dismissed will now be the subject of extensive discovery and further motion practice relating to class certification and summary judgment.

Court rejects Target's arguments on standing and injury: As is common in data breach cases, Target's primary ground for seeking dismissal of the consumer claims was lack of standing due to the absence of actionable consumer injury. In its motion to dismiss, Target argued that none of the plaintiffs had alleged a present injury sufficient to establish "case or controversy" standing under Article III of the United States Constitution. Specifically, Target contended that none of...