Most claims dismissed in Hannaford data breach suit

Without actual damages, there's no case, judge rules

All but one of the legal claims filed against Hannaford Bros. -- the Maine-based retailer that suffered a security breach exposing some four million credit and debit cards -- has been dismissed.

U.S. District Court Judge Brock Hornby threw out the civil claims against the grocer for its alleged failure to protect card holder data and to notify customers of the breach in a timely fashion. In dismissing the claims, Hornby ruled that without any actual and substantial loss of money or property, consumers could not seek damages.

The only complaint he allowed to stand was from a woman who said she had not been reimbursed by her bank for fraudulent charges on her bank account following the Hannaford breach.

In a 39-page opinion, Hornby wrote that consumers with no fraudulent charges posted to their accounts could not seek damages under Maine law; neither could those who might have had fraudulent charges on their accounts that were later reversed.

The breach at Scarborough, Maine-based Hannaford affected customers at the company's supermarkets in New England and New York, at its Sweetbay stores in Florida and at some independently owned retail stores in the Northeast that carry Hannaford products. The intrusion began in late 2007 but was not discovered until March 2008 when it was publicly disclosed.

The company was hit with class-action lawsuits from multiple states that were consolidated into one suit last summer. The complaints included breach of implied contract, breach of implied warranty, negligence and violation of Maine's Unfair Trade Practices Act.

Hornby said three of the claims against Hannaford were valid under current Maine law. When a person uses a debit or a credit card in a grocery transaction, Hannaford should use reasonable care in protecting the card data, he wrote in the decision. Similarly, Hannaford's apparent delay in disclosing the data breach constituted an unfair trade practice under Maine law, he said.

"A jury could find that, if Hannaford had disclosed the security breach immediately upon learning of it from Visa, customers would not have purchased groceries at its stores with plastic," till the problem was fixed, he said.

Peter Murray, lead counsel for the plaintiffs and a partner at Murray, Plumb & Murray, in Portland, Maine, said no decision has been made on how to proceed. One option would be to pursue the lawsuit on behalf of individuals whose fraudulent charges may not have been reversed he said. Another would be to appeal the decision.

From a legal standpoint, it shouldn't matter whether the fraudulent charges were reversed, or whether it cost money for someone to reinstate previously authorized credit or account numbers, Murray said. "We believe that they have all suffered actual damage," he said. "We don't believe there is any legal distinction between the ways fraudulent charges impacted the consumer."

The Hannaford opinion is similar to several others involving data breaches in recent years. In August 2007, the U.S. Court of Appeals for the Seventh Circuit threw out a a proposed class-action lawsuit against Evansville, Ind.-based Old National Bancorp (ONB) involving a 2005 data-breach incident.

In June 2007, a U.S. District Court judge in Ohio dismissed class-action claims against Litton Loan Servicing LP over a breach involving personal data. In that case, the judge said that without actual identity theft occurring, the plaintiffs suffered only anticipated injury and therefore did not need to be compensated.

In 2005, a federal judge threw out a lawsuit against TriWest Healthcare Alliance in Phoenix saying it was unclear whether any of the 500,000 records that were stolen had actually been accessed or used by thieves.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags legaldata losslawsuitsHannaford

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?