Who pays for data breaches? Banks' lawsuit against Target may clear murky waters
When stores are hit by cyberthieves who is victimized?
Customers, retailers, and banks might all raise their hands to that.
Which leads to another question: who should pay the cost of issuing new credit cards and covering fraudulent purchases?
Not so many volunteers on that one.
The answer will likely come out of a courtroom. Eventually.
Major data breaches at big-name retailers have lost their novelty since Target was hacked a year ago. But courts are only beginning to wade into the murky waters of liability regarding those breaches.
The Hill reports this week's decision allowing banks to proceed with their lawsuit against Target sheds a little more light on the issue.
Reacting to the decision by U.S. District Court Judge Paul Magnuson in St. Paul, one lawyer who specializes in data security tells The Hill: "This ruling is one of the first decisions that clarifies the legal muddle between merchants and banks."
The Minneapolis-based retailer had urged Magnuson to dismiss the banks' lawsuit, arguing it was the hackers who caused the mess and Target has no obligation to the banks. Magnuson disagreed, writing “Although third-party hackers' activity caused harm, Target played a key role in allowing the harm to occur,” The Hill says.
The Star Tribune reports Magnuson dismissed one of the four claims against Target, but allowed the bulk of the case to proceed because he found the banks made a plausible argument that the company failed to provide enough security against the hackers.
For now, Target is being sued by five banks including one Minnesota institution, Village Bank of St. Francis. But as Reuters reports, those five have asked the court to certify their case as a class action lawsuit on behalf of all the banks whose customers used credit or debit cards at Target between Nov. 1 and Dec. 19, 2013.
Target estimates the financial information of 40 million customers was compromised during that time by malicious software hackers installed.
The banks' lawsuit is separate from one consumers have filed, which is also being heard by Judge Magnuson, Reuters says.
