In the wake of Heartland Payment Systems' data breach settlement with Visa, lawyers representing five financial institutions have filed a class action lawsuit against two acquiring banks, claiming they share responsibility for damages caused by the intrusion.
Last month Heartland agreed a settlement with Visa to pay up to $60 million to issuers of Visa-branded credit and debit cards affected by the data breach suffered at the New Jersey-based payments processor in 2008.
The deal has prompted Lone Star National Bank, PBC Credit Union, O Bee Credit Union, Seaboard Federal Credit Union and Pennsylvania State Employees Credit Union to file a complaint in the US Southern District Court in Houston against Heartland Bank and Key Bank.
In a statement, slamming the settlement, three law firms representing the complainants say it could see affected issuers receive "pennies on the dollar".
Interim co-lead counsel Richard Coffman says: "Perhaps the most egregious aspect of the proposed settlement is that Heartland's acquiring banks - KeyBank and Heartland Bank - which also are potentially liable for the data breach damages, will receive a complete release of any liability even though they are contributing little, if anything, to the settlement."
Coffman continues: "It certainly makes one wonder why Visa would secretly negotiate a settlement on behalf of its issuers that lets the two richest potentially culpable parties off the hook with little, if any, financial investment and then force its issuers to decide within two weeks whether to accept the deal."