“What Target suggests is that, because there was no requirement to act, financial institutions should have done nothing in the face of dire alerts regarding the data breach issued by the card-issuing companies and by Target itself and the known potential consequences for the institutions' customers,” Magnuson wrote. “The absurdity of this suggestion is evident from the fact that Target itself reissued all of its RedCards, both debit and credit, in the weeks after the breach. Whether a specific action was legally mandated is not required to establish injury or causation.”

Magnuson was careful to point out that the decision to award class action status to the case does not mean the plaintiffs have won their case against Target. Rather, it allows other financial institutions to join the case rather than pursue individual action against Target.

The five plaintiffs – Umpqua Bank, Mutual Bank, Village Bank, CSE Federal Credit Union and First Federal Savings of Lorain – previously told the court that a combined total of nearly 25,000 of their issued debit and credit cards were affected by the data breach.

Earlier this year, Target and MasterCard negotiated a $19 million settlement for card issuers affected by the breach, but the five financial institutions fought it, telling the Minnesota District Court that, among other things, card issuers should have been included in the negotiations and that $19 million didn't cover their costs of dealing with the breach. In May, the settlement derailed when fewer than the requisite 90% of issuers accepted the offer by Target's May 20 deadline.

Target has since negotiated a settlement with Visa issuers, though financial institutions that accepted that settlement may be precluded from joining what now looks to be a significant class action suit against the retailer.

“Target was disappointed by the decision today,” a Target spokesperson told CU Times in a statement. “Once we have had the opportunity to review the judge's written ruling, we will evaluate next steps.”