Banks' Class Certification Motion Trumpets Target Data Security Failings, Ignores Impact Of Card Association Settlements

Card-issuing banks are forging ahead with their lawsuit against Target arising from the 2013 holiday shopping season data breach.  Their July 1 motion for class certification has just been unsealed, allowing a glimpse at plaintiffs' version of the events during November and December 2013 that resulted in theft of payment card data for 40 million Target customers.

The Target data breach occurred after hackers were able to compromise the security of a Target refrigeration vendor.  The vendor's log-in credentials to the Target computer system provided a portal to infiltrate Target and install malware on point-of-sale ("POS") terminals that was used to record and steal customers' card data.  In their class certification motion, the banks focus heavily on Target's alleged data security failings.  They claim that Target retained unencrypted card data, disregarded warnings about malware targeting POS terminals, disabled security features that purportedly would have