Target Lawsuit Consolidation Sought Over Stolen Credit Card Data

As number of lawsuits continues to mount over the recent Target data breach, which resulted in tens of millions of credit card numbers being stolen from the retailers computer network, a request has been filed to centralize the pretrial management of the Target litigation in the federal court system.

The Target lawsuits currently includes at least 32 complaints filed in 18 U.S. District Courts, which all involve similar allegations that Target failed to protect customer data from hackers, putting them at risk of credit card fraud and identity theft.

At least four of the plaintiffs have called for the creation of a Target Data Breach Lawsuit MDL, or Multidistrict Litigation, which would centralize the cases before one judge for coordinated handling during pretrial proceedings.

A Motion (PDF) to establish an MDL for the Target credit card litigation was first filed on December 24. Several different proposals have been submitted for where the lawsuits should be centralized, with requests including Louisiana, Utah, Illinois and Minnesota.

Plaintiffs argue that centralizing the cases as part of an MDL would serve the convenience of the parties, prevent duplicative discovery and avoid conflicting pretrial rulings. Target has not yet responded on whether it supports consolidation or not. The company has until January 23 to file a response, and the company estimates the number of lawsuits in state and federal court to be as high as 48.

On December 19 Target Corp. announced that it had suffered a security breach that could affect 40 million customers who shopped at the store between November 27 and December 15. However, on January 10 the company announced that the data breaches were more extensive than originally thought and warned that hackers stole names, addresses, e-mails, and phone numbers of as many as 70 million customers over several years.

The U.S. Secret Service and Target are continuing to investigate the data breach, and the full extent of the incident may not be known for some time. Target is offering customers free credit monitoring services.

Some plaintiffs say that Target should face penalties under the Stored Communications Act, which would require Target pay fines of $1,000 for each violation, which could cost the company tens of millions or hundreds of millions of dollars.

Last week, Neiman Marcus reported suffering a similar cyber intrusion on January 1. It is unknown how many customers were affected.

The U.S. Judicial Panel of Multidistrict Litigation (JPML), which will decide whether the Target credit card cases should be consolidated, is expected to hear oral arguments on the motion during an upcoming hearing in San Diego on March 27, 2014.