Pennsylvania State Employees CU Sues BJ's Wholesale Club and Fifth Third Bank Over Card Breach

HARRISBURG P.A. – The $2.1 billion Pennsylvania State Employees Credit Union has filed suit against BJ’S Wholesale Club and Fifth Third Bank over losses the credit union suffered in the wake of a card data compromise at the big box retailer. “The Visa cards from which BJ’s retained magnetic stripe information included over 20,000 Visa cards issued by PSECU to its members. A substantial number of those PSECU members used their Visa cards at BJ’s stores located in Pennsylvania, and those transactions enabled BJ’s to obtain and retain those Visa cardholders’ magnetic stripe information,” the credit union charged. “Upon information and belief, as a result of the acts and omissions, unauthorized third parties were able to obtain, from BJ’s electronic records, the Visa card magnetic stripe information retained by BJ’s between at least July 1, 2003 and February 29, 2004,” the lawsuit states. According to the court papers filed with the U.S. District Court for the Middle District of Pennsylvania, the credit union valued the loss at $98,000 for the cost of the breach. The credit union lost roughly $5,000 to fraud because of the compromise and then additional money reissuing plastics. The credit union reissued 20,029 cards because of the data compromise, which the credit union argued was made worse because BJ’s stored all the card data. In normal circumstances, a limited card data breach does not mean that compromised cards would be in too much danger of fraud. Processors of later transactions can still check the data contained in the magnetic stripe as an additional security measure. But in compromises like the one that PSECU alleged, so much of the card data was compromised that the credit union had no choice but to reissue the cards. PSECU is alleging breach of contract since it was the third party beneficiary of the contract between the bank and the merchant that should have directed the merchant not to hold as much card data as it had. Judge J. Andrew Smyser will hear motions on the case scheduling on September 17. -