7th Circuit: Economic Loss Rule Barred Tort Claims in Data Breach Case

The Seventh Circuit recently rejected tort claims by banks against a grocery store chain whose credit card terminals had been breached, holding that the economic loss rule limited the banks to their contractual remedies under the network of contracts governing the card payment systems.  The court of appeals therefore affirmed the district court’s dismissal of the banks’ complaint for failure to state a claim.

In the case, a grocery store chain with stores in Illinois and Missouri had suffered a significant data breach when hackers stole the data of about 2.4 million credit and debit cards.  A web of contractual relationships governs the card payment process.  All of the parties in the card payment system agree to take on certain responsibilities, including data security measures, and to subject themselves to specified contractual remedies.  Because card-issuing institutions are required by federal law to indemnify consumers for losses from fraudulent activity, the plaintiff-appellant banks bore those costs following the data breach, as well as other associated costs, such as employee time to investigate and resolve fraud claims.

While the banks emphasized that they had no direct contractual relationship with the grocery store company, both were participants in a network of contracts that connected them together in the card payment system.  The court held that, as a result, neither Illinois nor Missouri law would permit additional recovery to supplement the banks’ contractual remedies for losses they suffered as a result of the data breach.

The First and Third Circuits have also applied the economic loss rule to bar similar tort claims, and the Fifth Circuit reached a different conclusion in a case that the Seventh Circuit distinguished.

The case is Community Bank of Trenton v. Schnuck Markets, Inc.