Mass. Supreme Court dismisses CUs' breach case

BOSTON and MADISON, Wis. (12/16/09)--The Massachusetts Supreme Court has dismissed a multi-million dollar lawsuit by CUMIS Insurance Society, filed on behalf of credit unions whose members' credit cards were compromised in a data breach of BJ's Wholesale Club in 2004-2005.

The suit, filed in April of 2005, had sought recovery of millions of dollars lost by CUNA Mutual and 163 CUMIS Bond policy holders. In 2005, CUNA Mutual had estimated the costs suffered by credit unions would likely exceed $5 million and that at least 300 credit unions suffered losses due to the breach (News Now Jan. 27, 2005, and April 6, 2005).

"It's disappointing the Massachusetts Supreme Court concluded that the card associations' compliance process provided an adequate remedy for credit unions that suffered huge losses in the BJ's Wholesale Club breach," said Chuck Cashman, Plastic Card product executive with CUNA Mutual. "This is an unfortunate ruling and one which we, and likely our credit union partners in this litigation, do not agree with," he said in an e-mail to News Now. "Data breaches will continue to be a front-burner issue for all parties involved-- merchants, card issuers and consumers. But because of our action, we've created awareness to empower others to stand up and say, 'Enough is enough' on data breach losses," Cashman said.

BJ's Wholesale's breach was the one of the first huge breaches that hit a widespread area and involved millions of cardholders. It brought to light that a large number of merchants use point-of-sale software systems that capture and store full magnetic stripe information off plastic cards--a violation of the card association operating rules and regulations.

CUMIS' complaint alleged a breach of a third-party contract, based on BJ's agreement with Fifth Third Bank not to store customers' magnetic stripe data (Courthouse News Service Dec. 15).

The credit unions sought compensation for having to reissue millions of new credit cards to replace ones compromised in the breach. The Massachusetts State Court in Boston, the trial court sided with BJ's and the state high court affirmed, saying the contract was exclusively between BJ's and Fifth Third. The court also dismissed fraud and negligence claims against BJ's and the bank, saying they never misled the credit unions and CUMIS about their compliance with Visa and Mastercard regulations.

"By pursuing this litigation, CUNA Mutual helped expose the limitations of existing law in providing recourse which, in turn, helped spur the passage of legislation in some states," Cashman said. "We're hopeful our efforts provided some motivation to the card associations to increase their efforts to require compliance with their rules, thereby helping reduce the chances for these types of occurrences in the future," he added.

print this story email this story
Resource Links
CUNA Identity Theft Resources
CUNA CPF Fraud and Security materials


More CU/System

Copyright © 2012 Credit Union National Association