On January 7, 2016, the U.S. District Court for the District of Minnesota dismissed for lack of standing the consolidated data breach complaint filed by consumers against SuperValu, Inc., AB Acquisition, LLC, and New Albertson’s Inc. regarding two security incidents in 2014.  Those incidents related to payment card information collected in transactions at SuperValu, AB Acquisition, and Albertson’s stores.  In the first of the two incidents, hackers used malicious software installed on SuperValu’s network for processing payment card transactions to steal information embedded in the magnetic strip of payment cards for sales in 209 SuperValu and 836 AB Acquisition stores.  The information embedded in the strip included cardholder names, account numbers, expiration dates, and PINs.  The second incident, later that year, used different malware and affected information regarding transactions at some retail stores owned or operated by AB Acquisition and Albertson’s.  In all, more than 1,000 retail grocery stores were affected.

In its decision, the district court held that the single unauthorized payment card charge alleged does not provide the named plaintiffs with Article III standing, a prerequisite to subject matter jurisdiction.  The only concrete harm alleged was a single fraudulent charge on the card of one of the sixteen named plaintiffs.  That plaintiff did not allege that the charge was unreimbursed or that other fees or monetary losses related to the charge were incurred.  In addition; upon discovery of the charge, the plaintiff cancelled the compromised card.  The court held that the plaintiffs did not have standing because “[d]espite the large number of Affected Stores and the significant amount of time that has elapsed, the only facts asserted that any of Plaintiffs’ [personally identifiable information] has been misused is the single incident alleged by Plaintiff Holmes.”  That, the court held, was insufficient to establish the “injury-in-fact” component of Article III standing. 

A copy of the decision can be found here.

Reporter, Katie Bates, Atlanta, +1 404 572 4752, kbates@kslaw.com.