Heartland Data Breach: Class Action Suit Filed on Behalf of Banking Institutions

Credit EligibleAs a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

One month after the Heartland Payment Systems (HPY) data breach was revealed, a Philadelphia law firm filed a class action lawsuit against the processor on behalf of two banks and three credit unions. The complaint was filed by Chimicles & Tikellis in U.S. District Court in Trenton, NJ on February 20.

The five institutions named in the complaint are Amalgamated Bank, New York, NY; Matadors Community Credit Union, Chatsworth, CA; GECU, El Paso, TX; MidFlorida Federal Credit Union, Lakeland, FL ;and Farmers State Bank, Marcus, IA. All the institutions say they have had to re-issue "substantial" numbers of credit and debit cards because of the Heartland breach.

Joseph Sauder, the attorney leading the case, says while only five institutions were named in the complaint, "We talked with numerous banks. These five were the ones we selected to present in the complaint."

Although no one has estimated officially how many institutions, cards and consumers might be affected by the breach, more than 500 institutions have stepped forward to tell Information Security Media Group that they have been impacted.

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

Chimicles & Tikellis also has a consumer class action lawsuit filed against Heartland, filed in the same U.S. District Court in Trenton on January 27.

Seeking to Recover Costs

In the new class action suit, Sauder says the institutions "seek to recover money for the cost of reissuing cards and also for the fraudulent activity that banks and credit unions are ultimately responsible for as a result of this breach, among other things."

Heartland announced on January 20 that its computer systems had been breached by outside hackers sometime in 2008. The processor handled on average 100 million transactions per month for about 175,000 merchants and retail establishments. Heartland only became aware of the breach after it was notified by Visa and MasterCard of "patterns of fraudulent credit card activity," the lawsuit states.

The breach compromised information including debit and credit card numbers, expiration dates and internal bank codes. Many of the institutions that had cards compromised in the breach were forced to re-issue new credit and debit cards to their customers. "Given the large size of the data breach, the expenses associated with doing so are substantial," the complain says, "and include costs for purchasing new plastic debit and credit cards, postage and other mailing expenses, time spent by employees address this issue and harm to reputation and goodwill."

Many institutions have also reported incidents of fraud, the complaint states. It says Heartland's actions "constitute violations of the consumer protection statute of New Jersey," and amounts to a breach of implied contract, negligence, negligent misrepresentation, and common law negligence.

Sauder says he cannot estimate how soon the case may begin or how long it may last. "It's hard to tell at this time, since the case was just filed, as to what Heartland's position is going to be," he says. He adds that more institutions are expected to join the class action suit.

Other Suits

There are at least three consumer class action lawsuits filed against Heartland and three other lawsuits filed in other courts by institutions seeking to recoup their losses and expenses related to the breach: