In Lone Star Nat’l Bank, N.A., et al. v. Heartland Payment Sys., Inc., No. 12-20648 (5th Cir. Sept. 3, 2013) (hereinafter “Heartland”), arising from the now-infamous 2008 data breach, the Fifth Circuit recently reversed a motion to dismiss, finding that the economic loss doctrine did not apply and that various credit card issuers could state a claim for negligence, despite the fact that the banks lacked a written contract with Heartland.
In Heartland, the issuer banks alleged that they incurred costs associated with replacing compromised cards and reimbursing customers for fraudulent charges after a data breach where hackers accessed payment processor Heartland’s network and compromised approximately 130 million credit card numbers. The issuer banks had contracts directly with Visa and MasterCard, which in turn had two member banks in their network that had contracted with Heartland to process their transactions. The issuer banks alleged various claims, including negligence and contract claims, as third party beneficiaries of Heartland’s contracts with other entities.
The District Court dismissed the issuer bank’s claims, holding that the economic loss doctrine barred the negligence claims. The District Court reasoned that because the issuer banks had contracts with Visa and MasterCard, they were limited to the specific remedies in those contracts and could not bring tort claims against a defendant involved in the same web of transactions. In reversing the District Court, the Fifth Circuit determined that, under New Jersey law, a tort claim for economic loss is allowed if an identifiable class of plaintiffs was owed a duty of care and if the tortfeasor was not exposed to limitless liability. The Court noted that “Heartland had reason to foresee the Issuer Banks would be entities to suffer economic losses were Heartland negligent.” The Court appeared to be persuaded by a possible lack of remedy, reasoning, that the issuer banks would be denied any redress for Heartland’s alleged negligence if the economic loss rule applied.
This decision is notable because the Fifth Circuit has taken the position that a tort claim for economic loss as a result of a data breach may be alleged where there is an identifiable class of plaintiffs owed a duty of care and the tortfeasor was not exposed to limitless liability. The holding’s applicability to future cases may be limited, however, because of the Court’s reliance on the specific factual record surrounding the specific contracts at issue and the application of New Jersey law.