Federal Judge Upheld Banks’ Target Data Breach Class Action

The consolidated Target data breach class action lawsuits filed against the retail giant by banks who were hit hard due to the massive data breach was mostly upheld by a Minnesota federal judge, which could be a bellwether for similar lawsuits.

In a much anticipated decision, Target’s motion for dismissal of the multidistrict litgation of class action lawsuits brought by banks, credit unions and other financial institutions was largely rejected by U.S. District Judge Paul Magnuson Tuesday.

This decision could affect how data breach class action lawsuits brought by financial institutions against other companies that have suffered from similar data breaches, such as Home Depot USA, will play out.

Judge Magnuson rejected Target’s argument that it shouldn’t be held responsible for damage caused to credit card and debit card issuers that occurs as the result of data breaches.

The financial institutions in the Target data breach MDL have charged Target with four main allegations: “that Target was negligent in failing to provide sufficient security to prevent hackers from accessing customer data. Count Two asserts that Target violated Minnesota’s Plastic Security Card Act . . . Count Three alleges that this violation constitutes negligence per se. Count Four claims that Target’s failure to inform Plaintiffs of its insufficient security constitutes a negligent misrepresentation by omission.”

Judge Magnuson rejected the fourth charge, but upheld the first three, giving the banks leave to amend the fourth claim over negligent misrepresentation by omission, which they have 30 days to file.

Target had argued that the banks’ data breach class action lawsuits should be dismissed because “there is no special relationship between plaintiffs and Target and, in any event, “‘a person has no duty under Minnesota law to protect another from the harmful conduct, including criminal conduct, of a third person.'”

But the financial institutions contend that this litigation isn’t about “third-party-harm . . . but rather is a straightforward negligence case.”

According to Judge Magnuson, “at this preliminary stage of the litigation, plaintiffs have plausibly pled a general negligence case. Although the third-party hackers’ activities caused harm, Target played a key role in allowing the harm to occur.

“Indeed, plaintiffs’ allegation that Target purposely disabled one of the security features that would have prevented the harm is itself sufficient to plead a direct negligence case: plaintiffs allege that Target’s ‘own conduct created a foreseeable risk of injury to a foreseeable plaintiff,'” the Minnesota federal judge wrote.

“Thus, the court must determine whether plaintiffs have sufficiently pled that Target owed plaintiffs a duty of care under general negligence principles,” he added.

Target announced in December 2013 that it had credit and debit card information of about 110 million customers stolen over about three weeks during the 2013 holiday shopping season from Nov. 27 through Dec. 15. The first Target data breach class action lawsuit was filed that month.

Customer names, credit or debit card numbers, expiration dates, and CVV security codes were all vulnerable to the attack.

Data breach class action lawsuits have been filed against Target by both customers and financial institutions, which have been consolidated into the two types of lawsuits by the Judicial Panel on Multidistrict Litigation.

The financial institutions are represented by Zimmerman Reed PLLP, Lockridge Grindal Nauen PLLP, Chestnut Cambronne PA, Reinhardt Wendorf & Blanchfield, Barrett Law Group PA and others.

Target is represented by Wendy J. Wildung and Michael A. Ponto of Faegre Baker Daniels, and Harold J. McElhinny, Jack W. Londen, Michael J. Agoglia, Rebekah Kaufman and David F. McDowell of Morrison & Foerster LLP.

The Target Data Breach MDL is In re: Target Corp. Customer Data Security Breach Litigation, Case No. 0:14-md-02522, in the U.S. District Court for the District of Minnesota.

UPDATE: A federal judge has preliminarily approved a $10 million class action settlement. Details on how to file a claim for the Target data breach settlement can be found here.

UPDATE 2: On Jan. 27, 2016, an objection to the $10 million Target data breach class action lawsuit settlement deal was dismissed by the 8th Circuit on appeal.

UPDATE 3: On Apr. 21, 2016, plaintiffs in the multidistrict litigation against Target Corp. over the infamous 2013 data breach are asking the Eighth Circuit Court to ignore claims made by an objector in the settlement.

UPDATE 4: On Aug. 22, 2019, Top Class Actions viewers started getting checks from the Target data breach class action settlementworth as much as $1,201.88.Congratulations to everyone who filed a claim and got PAID!