First Circuit Rules that Stores Should Pay Shoppers' Mitigation Costs for Losing Payment Card Numbers

On October 20, the U.S. Court of Appeals for the First Circuit kept alive a case by holding that, in Maine, customers may bring negligence and implied contract claims against merchants that lose or fail to protect their payment card data and that those customers may recover their reasonably-incurred costs to mitigate the impact of the data loss. Anderson v. Hannaford Bros. Co., No. 10-2384, (1st Cir. Oct. 20, 2011). In Anderson, a class of consumer-plaintiffs sued the defendant-grocery store chain after the defendant admitted that hackers broke into its computer system and stole millions of its customers' credit and debit card numbers. The district court initially granted the defendant's motion to dismiss the case. The appeals court reversed the dismissal in part - disagreeing principally with one aspect of the district court's reasoning. Both courts agreed that a jury may reasonably find that the defendant impliedly agreed to protect consumers' payment card data and that the defendants may therefore be liable for negligence and for breach of an implied contract if they failed to do so. Nevertheless, the district court found that the plaintiffs' damages - costs to avoid liability for unauthorized charges - were unforeseeable and therefore not recoverable. The appeals court disagreed and held that, under Maine law, incidental costs expended in good faith to mitigate the harm caused by the data loss are recoverable, including costs to replace the cards and purchase fraud insurance.