Banks Cannot Skirt Contract Remedies in Data Breach Suit Against Retail Merchant
Attempting to advance a novel theory of law, several banks filed a class action in Illinois federal court against a grocery store chain arising out of a data breach that resulted in the theft of 2.4 million credit and debit cards, reports Jackson Lewis PC.
After the breach, the banks were required to issue new cards and reimburse its customers as required by federal law for financial losses due to unauthorized purchases, estimated by the plaintiffs to be in the tens of millions of dollars. With the litigation, the financial institutions sought to recover some of their costs from the grocery store chain that was allegedly responsible for the loss of the data.
Jeffrey M. Schlossberg explains the outcome: “Despite seemingly compelling arguments, the Seventh Circuit ultimately upheld the lower court’s dismissal of the banks’ claims finding that they were bound by the contractual provisions of their agreements. Essentially, the court ruled, by joining the credit card system, the banks accepted some risk of not being fully reimbursed for the costs of another party’s mistakes.”
