In Lone Star Nat. Bank, N.A. v. Heartland Payment Sys., Inc., 5th Cir. No. 12-20648, 2013 WL 4728445 (Sept. 3, 2013), a recent decision stemming from a well-documented 2008 data breach (http://www.informationweek.com/security/attacks/heartland-payment-systems-hit-by-data-se/212901505), the Fifth Circuit reversed the district court’s decision that granted Heartland Payment System’s (“Heartland”) motion to dismiss.
Plaintiffs are banks that issued credit cards to their customers through Visa and MasterCard. When a customer uses one of these credit cards, the card information is first sent to a bank with which the merchant contracts, known as the “acquirer bank.” The acquirer bank then sends the information to a processor, like Heartland. The processor then sends the information to the bank that issued the card, like plaintiffs. The approval or disapproval of the card is then transmitted back upstream.
In 2008, hackers infiltrated Heartland’s data systems and stole payment card information. Plaintiffs allege that this resulted in costs associated with replacing the compromised cards and reimbursing customers for fraudulent charges. Plaintiffs’ complaint alleged breach of contract, negligence, misrepresentation, and violations of multiple state consumer protection laws. Heartland filed a motion to dismiss plaintiffs’ negligence claim.
The district court, applying New Jersey law, held that the economic loss doctrine bars plaintiffs’ negligence claim. By entering into a numerous contracts with Visa and MasterCard, plaintiffs contracted for the specific remedies afforded by the Visa and MasterCard regulations and thus could not bring common law tort claims against a different party, Heartland, which was also involved in the subject contracts.
The Fifth Circuit reversed the district court by finding that the economic loss doctrine does not bar tort recovery in every case. Specifically, the court held that the economic loss rule did not bar recover because plaintiffs constituted an identifiable class, Heartland had reason to foresee that plaintiffs would be entitled to suffer economic losses if it were negligent, and Heartland would not be exposed to boundless liability. Additionally, the court found significant that in the absence of a tort remedy, plaintiffs would be left with no remedy for Heartland’s alleged negligence, defying notions of fairness, common sense and morality.