Fourteen credit unions still have a chance to recoup some of the money they lost in the 2008 Heartland Payment Systems data breach.

The Fifth District Court of Appeals has sided with the credit unions and banks which lost their initial case against Heartland. The Court agreed that the financial institution plaintiffs, which include both banks and credit unions, have a negligence claim against the firm for the losses they incurred from the card compromise.

The breach has been recognized as one of the largest ever, compromising information from more than 100 million U.S. consumers. Litigation was brought by banks and credit unions and then consolidated into one complaint heard by U.S. District Judge Lee Rosenthal in the U.S. District Court for the Southern District of Texas.

The credit unions that brought original actions included the 11,000-member, $130 million Matadors Community Credit Union, headquartered in Chatsworth, Calif.; the $1.8 billion, 303,000-member GECU headquartered in El Paso, Texas; the $1.6 million, 151,000-member MidFlorida Credit Union, headquartered in Lakeland, Fla, as well as the 406,000 member, $4.2 billion Pennsylvania State Employees Credit Union headquartered in Harrisburg, Penn.

The credit unions and banks that brought suit were ones that declined to participate in a previous settlement agreement that the card brand Visa negotiated and sponsored.

Judge Rosenthal decided against the financial institutions in late 2011 and the card issuers appealed the decision, in particular the complaint about Heartland Payment Systems negligence and responsibility for their losses.

In a ten page opinion, a three judge panel from the Fifth Circuit Court of Appeals, based in New Orleans, Louisiana, agreed with the card issuers.

“[W|e hold the economic loss doctrine under New Jersey law does not preclude the Issuer Banks' negligence claim against Heartland at the motion to dismiss stage,” the panel wrote in its opinion. “Heartland had reason to foresee the Issuer Banks would be the entities to suffer economic losses were Heartland negligent… The identities, nature, and number of the victims are easily foreseeable, as the Issuer Banks are the very entities to which Heartland sends payment card information…. Furthermore, Heartland would not be exposed to 'boundless liability,' but rather to the reasonable amount of loss from a limited number of entities. Accordingly, even absent physical harm, Heartland may owe the Issuer Banks a duty of care and may be liable for their purely economic losses.”

The panel also observed that absent a remedy in Court, the Issuers have no other method to seek redress for their losses.

“Second, viewing the pleadings in the light most favorable to the Issuer Banks, in the absence of a tort remedy, the Issuer Banks would be left with no remedy for Heartland's alleged negligence, defying 'notions of fairness, common sense and morality,'” the panel wrote, quoting a previous case.

The court then ordered the lower court to reexamine parts of the case and it decision in light of the appeal and cited Heartland for the costs of the appeal.

None of the 14 credit unions nor Heartland Payment Systems has yet commented on the decision.