HOUSTON, Texas (3/23/12)--A federal judge in Houston has dismissed a lawsuit filed by five credit unions and a bank against key parties in the Heartland Payment Systems' data breach.
The ruling was filed March 14 by U.S. District Judge Lee H. Rosenthal in the U.S. District Court for the Southern District of Texas, Houston division. The financial institutions involved are Lone Star National Bank, Sea Board FCU in Bucksport, Maine; O Bee CU in Tumwater, Wash.; PBC CU, West Palm Beach, Fla.; and Pennsylvania State Employees CU, Harrisburg.
In an earlier decision the judge had ruled that the financial institutions were not protected as "third-party beneficiaries" in contracts between Heartland and its two acquiring banks, KeyBank and Heartland Bank, but allowed the financial institutions to amend their complaint, which had stemmed from the exposure of their cardholders' information when cyberthieves hacked Heartland's system in 2008. The breach was announced in early 2009.
The amended complaint, against KeyBank, alleged breach of contract, breach of fiduciary duty and negligence. Rosenthal granted the bank's motion to dismiss the case "with prejudice," noting that the financial institutions' negligence and related vicarious liability, and breach of contract claims are the same as previously dismissed.
In dismissing the breach of contract claim, the judge wrote that the contract between Heartland and KeyBank did not state an intent to benefit anyone other than the contracting parties. "The contract is clearly intended to benefit only the contracting parties…The financial institution plaintiffs may indirectly benefit from the contract between KeyBank and Heartland, but that benefit is incidental," Rosenthal said.
On the breach of fiduciary duty claim, the credit union plaintiffs had asserted that they and KeyBank were joint venturers through their common membership in the Visa and MasterCard networks, and should share losses. However, the judge found that "nowhere do they allege that issuers and acquirers generally have agreed to share all losses suffered by the networks as a whole." He said joint ventureship means sharing both profits and losses, which the plaintiffs had not alleged.
More than 560 financial institutions, including at least 178 credit unions, had to reissue credit and debit cards as a result of the breach at Heartland. Consumers and financial institutions sued Heartland to recoup their losses, and the suits were so many that they were split into two camps: a consumer track and the financial institutions track. Heartland reached several settlements last year with Visa and MasterCard and Discover, which also had sued on behalf of their financial institution clients.
In addition to the decision dismissing the financial institutions track case, the judge ruled Monday on the consumer track case. In it, he approved settlement in the case, with the exception of providing incentive awards to plaintiffs. The settlement awarded more than $606,192 in attorneys' fees, and awarded costs in the amount of $35,000, according to court documents.