• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to secondary sidebar

Alston & Bird Privacy Blog

  • Home
  • Services
  • Events
  • Contacts

Fifth Circuit Revives Banks’ Heartland Data Breach Claims

September 13, 2013 By Privacy & Data Security Team

In Lone Star Nat’l Bank, N.A., et al. v. Heartland Payment Sys., Inc., No. 12-20648 (5th Cir. Sept. 3, 2013) (hereinafter “Heartland”), arising from the now-infamous 2008 data breach, the Fifth Circuit recently reversed a motion to dismiss, finding that the economic loss doctrine did not apply and that various credit card issuers could state a claim for negligence, despite the fact that the banks lacked a written contract with Heartland.

In Heartland, the issuer banks alleged that they incurred costs associated with replacing compromised cards and reimbursing customers for fraudulent charges after a data breach where hackers accessed payment processor Heartland’s network and compromised approximately 130 million credit card numbers. The issuer banks had contracts directly with Visa and MasterCard, which in turn had two member banks in their network that had contracted with Heartland to process their transactions. The issuer banks alleged various claims, including negligence and contract claims, as third party beneficiaries of Heartland’s contracts with other entities.

The District Court dismissed the issuer bank’s claims, holding that the economic loss doctrine barred the negligence claims. The District Court reasoned that because the issuer banks had contracts with Visa and MasterCard, they were limited to the specific remedies in those contracts and could not bring tort claims against a defendant involved in the same web of transactions. In reversing the District Court, the Fifth Circuit determined that, under New Jersey law, a tort claim for economic loss is allowed if an identifiable class of plaintiffs was owed a duty of care and if the tortfeasor was not exposed to limitless liability. The Court noted that “Heartland had reason to foresee the Issuer Banks would be entities to suffer economic losses were Heartland negligent.” The Court appeared to be persuaded by a possible lack of remedy, reasoning, that the issuer banks would be denied any redress for Heartland’s alleged negligence if the economic loss rule applied.

This decision is notable because the Fifth Circuit has taken the position that a tort claim for economic loss as a result of a data breach may be alleged where there is an identifiable class of plaintiffs owed a duty of care and the tortfeasor was not exposed to limitless liability. The holding’s applicability to future cases may be limited, however, because of the Court’s reliance on the specific factual record surrounding the specific contracts at issue and the application of New Jersey law.

Written by Stephanie Driggers, Senior Associate, Litigation & Trial Practice and Kacy McCaffrey, Associate, Litigation & Trial Practice | Alston & Bird LLP

Filed Under: Data Breach, Security Breach Tagged With: Identity Theft, Litigation

Primary Sidebar

This blog is a service of Alston & Bird’s Privacy & Data Security team and focuses on key data privacy and data security issues.


Receive email notifications when new posts are added.

Receive email notifications when new posts are added.


THE DIGITAL DOWNLOAD
Click here to see the editions

PRIVACY & CYBER EVENTS
Click here to see upcoming and past events

PRIVACY & CYBER MAILINGS
Click here to sign up

@ALSTONPRIVACY
Click here to follow us on Twitter

Secondary Sidebar

Categories

Recent Posts

  • Federal Court Rules Cyber Forensic Report Is Not Protected Under Attorney-Client Privilege Or Work Product Doctrine
  • Financial Regulatory Agencies Announce Proposed Rule Requiring Notice of Computer Security Incidents
  • Brexit Trade Agreement Provides a Temporary Solution for Companies Transferring Personal Data from the EEA to the UK
  • UK ICO Publishes New Data Sharing Code
  • SolarWinds Hack: Unparalleled Supply Chain Attack Results in Potential Compromise of Private and Public Sector Organizations
Copyright © 2021 · Alston & Bird · All Rights Reserved. Privacy.
This website uses cookies to improve functionality and performance. By continuing to browse this site, you are consenting to the use of cookies on this website. OkCookie policy