Reversing the decision of the lower court, the U.S. First Circuit Court of Appeals recently held in Anderson v. Hannaford Bros. Co. that under Maine law, claims for breach of contract and negligence can be premised on the cost of replacing credit/debit cards whose numbers had been breached and the cost of credit insurance where the card numbers had been intentionally stolen by sophisticated thieves who actually used that data for fraudulent purposes. In reaching this conclusion, the court’s novel opinion differentiated numerous cases in which courts have held that similar claims of damages were insufficient to allow cases to move forward. Although reaching a novel result, the First Circuit decision in Hannaford might have limited effect on future litigation because of the rather unique fact pattern on which the court of appeals’ opinion rests.
From December 2007 to March 2008, thieves allegedly stole 4.2 million individuals’ credit and debit card numbers from Hannaford Bros., a New England grocery store chain. Following public notification of the breach, a number of Hannaford customers allegedly discovered fraudulent charges on their credit and debit accounts. Affected customers — both those who claim to have suffered fraudulent charges and those who merely suspected that their data had been lost in the breach — then filed a series of class actions filed against Hannaford, which were consolidated in federal court in Maine for pretrial proceedings. As the litigation progressed, all of the plaintiffs were compensated for the unauthorized charges.
The federal district judge who initially reviewed the case held that the plaintiffs whose fraudulent charges had been paid did not suffer any reasonably foreseeable economic damages, and therefore could not possibly recover anything for their claims under Maine law. However, in a motion for reconsideration, the plaintiffs convinced the district judge that Maine law was ambiguous as to whether Maine law permitted recovery for the plaintiffs’ time, effort, and stress (as opposed to monetary loss) involved with the fraudulent charges. As a result, the district judge sought the opinion of the Supreme Judicial Court of Maine, the state’s highest court. The Maine high court answer that the plaintiffs had to show a “legal injury,” such as economic harm, rather than merely cost in terms of time or effort. The district court then dismissed the case because in its view recovery based on both economic loss and time/effort were foreclosed.
The plaintiffs then appealed to the First Circuit Court of Appeals, where the focal point returned to whether the plaintiffs had alleged any reasonably foreseeable economic losses. Disagreeing with the district court’s earlier decisions, the court of appeals held that the plaintiffs had alleged two forms of monetary loss sufficient to continue with their claims: (1) the cost of replacing their credit and debit cards, and (2) the cost of credit insurance obtained in response to the breach. The court of appeals differentiated Hannaford from many earlier cases from other jurisdictions in which courts have held that similar claims of damages were not foreseeable on the grounds that unlike those cases, this case involved intentional theft of and actual misuse of data by sophisticated thieves. In contrast, the court explained that many of the earlier cases involved loss or theft of a physical device where the person who obtained the device may or may not be aware that it contained confidential information. The court also stated that even in those prior cases that involved direct theft of data, there had not been any claim that the data actually had been used for identity theft.
The First Circuit’s decision occurred at the “motion to dismiss” stage, meaning that it analyzed what the plaintiffs allege that they can prove. Assuming that Hannaford does not ask for review by the “en banc” First Circuit (meaning review by all of the judges of the court) or by the U.S. Supreme Court, the case will return to the district court, where the plaintiffs will attempt to obtain and then provide evidence sufficient to support their claims.