But in his ruling, Magnuson noted the plaintiffs have alleged injury such as unlawful charges, restricted or blocked access to bank accounts, inability to pay other bills and last payment charges or new card fees.

“Plaintiffs' allegations plausibly allege that they suffered injuries that are fairly traceable to Target's conduct,” Magnuson wrote. “This is sufficient at this stage to plead standing.”

The judge also allowed the class action suit to seek injunctive relief, a court order that would require Target to encrypt all customer data from the point of sale and throughout the retailer's payment system. The court order also would require the retailer to comply with federal and Minnesota law regarding data security and the retention of data, adopt EMV chip technology for Target-issued credit and debit cards and require the retailer to pay extended credit monitoring services for all of plaintiffs in the class action suit.

Target's argument that the plaintiffs lacked standing to seek injunctive relief was premature, Magnuson wrote.

However, Magnuson dismissed the plaintiffs' claim of Target's alleged breach of contract. In addition, the judge dismissed the plaintiff's negligence claims under Alaska, California, Iowa and Massachusetts law.

He also ordered that the plaintiffs may not maintain a class action suit in Alabama, Georgia, Kentucky, Louisiana, Mississippi, Montana, South Carolina, Tennessee and Utah.

According to court documents, the plaintiffs withdrew their data-breach notice statutory claims under Florida, Oklahoma and Utah. In addition, their data breach statutory claims under Arkansas, Connecticut, Idaho, Massachusetts, Minnesota, Nebraska, Nevada, Rhode Island and Texas law were dismissed.