Issuer Banks’ Claims In Target Data Breach Litigation Survive Motion To Dismiss

Federal District Judge Paul Magnuson has ruled that banks that issued credit and debit cards to customers whose data was stolen in the December 2013 Target data breach could continue to litigate claims against Target for negligence and violation of Minnesota's Plastic Security Card Act ("MPCSA"), Minn. Stat. § 325E.64. The claims of the issuer banks originated in multiple lawsuits that were among the 71 separate actions filed nationwide that the federal Judicial Panel on Multidistrict Litigation consolidated for pretrial proceedings in the District of Minnesota. The December 2 ruling is significant both for its conclusion that Target owed a duty of care to issuer banks with respect to data security and for its rejection of Target's argument that the MPSCA should not apply to all Target transactions nationwide, but instead should be limited to transactions that occurred in Minnesota stores. The decision does not, however, eliminate challenges that the issuer banks are likely to face both with respect to proving their allegations and obtaining certification of a plaintiff class.

The claims of the issuer banks arise from their particular role in the credit and debit card payment system. Issuer banks provide payment cards to customers for use in making purchases, and ultimately pay retailers for any purchases made with those cards. In the ordinary course, the issuer banks then recoup the cost of such purchases from their customers, either by billing the customers monthly for their purchases (for credit cards) or immediately debiting the customers' bank accounts (for debit cards). Card issuers, however, generally do not require card holders to pay for fraudulent charges made with their credit or debit cards. As a result, the issuer banks bore losses arising from fraudulent charges that were made using payment card information stolen from Target. Their lawsuit seeks to recover those losses from Target.

The Target data breach was caused by malware that hackers placed on Target's point-of-sale ("POS") terminals. The hackers infiltrated the Target POS system by compromising password protected access that a Target heating and air conditioning vendor had to Target's online billing and payment system, which then allowed the hackers to access Target's broader information system network. Using the malware on the POS terminals, the hackers were able to record card information as each card was swiped, then store the stolen data elsewhere on Target's...