PORTLAND, Maine (11/21/11)--A federal appeals court Friday, in a reversal of a lower court ruling, ruled that people impacted by the Hannaford Bros. supermarkets credit and debit card data breach in 2008 can sue the company to recover out-of-pocket expenses made to reduce the impact of the breach.
The unanimous decision includes costs to get new cards from financial institutions and the purchase of identity theft insurance, said local media (wmtw.com Nov. 18). Details were not available at News Now's press time.
It is estimated that the card numbers of more than four million people were stolen in the security breach, which occurred between Dec. 7, 2007 and March 10, 2008, when cyber criminals hacked into Hannaford's system and accessed card numbers used at 165 Hannaford supermarkets in the Northeast and 106 Sweetbay stories in Florida.
At least 1,800 numbers were used for unauthorized fraud. Hannaford discovered the breach in February 2008 and made it public March 17, 2008. Many credit unions were among the financial institutions that reissued new cards to consumers.
The Maine Supreme Judicial Court had ruled in September 2010 that the victims of the massive data breach could not sue for damages if they didn't suffer financial losses, physical harm or identity theft. It had said that time and effort alone do not constitute an injury for which damages may be recovered under Maine law (News Now Sept. 23).