“They also lost interest and transaction fees due to reduced card usage,” the credit union added. “Furthermore, debit and credit cards belonging to class members and plaintiff – as well as the account numbers on the face of the cards – were devalued.”

The suit also claims that, among other things, Wendy's failed to delete cardholder information from its systems after authorizing transactions, failed to protect against malware and viruses, didn't have an adequate firewall, didn't limit or track access to the card data, failed to disclose the breach in a timely manner and didn't convert to EMV. First Choice also alleged the POS systems at Wendy's were out of date.

The credit union said the hackers specifically targeted and drained debit accounts with large amounts of money in them, concentrating the damages and causing individual financial institutions to suffer losses greater than what was experienced after the Home Depot or Target data breaches.

In March, Home Depot agreed to a $28 million settlement with a class of up to 53 million consumers whose payment card or email data was stolen during that retailer's 2014 data breach. In that suit, hackers allegedly used a third-party vendor's credentials to install malware that stole names, card numbers, expiration dates and three-digit security codes. A card issuer suit against the company is still working its way through the court system.

Last December, Target Corporation agreed to pay financial institutions almost $40 million to settle a class-action suit related to its 2013 data breach. The point of access allegedly was a phishing email opened by an employee at Target's refrigeration vendor, which had direct access to the retailer's system via its construction management software.

At press time, Wendy's had not yet responded to a request for comment.