Intellectual Property Law

Court Rules Breach Victims Not Entitled to Restitution

By Kim Zetter

A federal judge has ruled that victims whose bank card numbers were stolen in a data breach are not entitled to sue if their losses were already reimbursed. Only customers who weren’t reimbursed for fraudulent charges may sue.

The case involves the 2007-2008 breach of the Hannaford Bros. supermarket chain that involved 4.2 million credit and debit card numbers being exposed to hackers. Of these, about 1,800 account numbers are known to have been used for fraudulent purchases.

Consumers filed civil suits against the supermarket chain in several states for failing to properly secure their data. The cases were consolidated into a single case in Maine, where U.S. District Judge D. Brock Hornby tossed out all of the complaints except one, according to the Associated Press. The latter involves a Vermont woman who was never reimbursed for her losses.

A Maine law covering breaches allows consumers to recover damages if the merchant’s negligence caused a direct loss to the consumer’s account.

But Judge Hornby noted in his decision that, per the law, the merchant is liable for the loss only when its negligence “causes an unreimbursed fraudulent charge or debit against a customer’s account.” He added that “collateral consequences” are not covered under the state law.

Full post as published by Threat Level on May 13, 2009 (boomark / email).