No harm, no foul, a federal judge in Maine ruled in tossing millions of shoppers out of a class-action suit seeking damages for a sweeping credit and debit card data breach at Sweetbay/Hannaford Bros. supermarkets a year ago.
That leaves only one of the named plaintiffs covered by the case, a Vermont woman never reimbursed for bogus charges when her credit card number was among 4.2 million that hackers swiped from two U.S. units of Belgian supermarket giant Delhaize Group: Sweetbay in Florida and Hannaford Bros. in New England.
While 1,800 cases of data fraud have been traced to the breach, banks and card issuers ate virtually all the counterfeit charges and changed account numbers for the overwhelming majority of the stolen card numbers. The only victims who can claim money damages are the few who actually lost money when the chain's card data network was compromised between Dec. 7, 2007, and March 10, 2008.
While U.S. District Judge Brock Hornby was not ruling on the merits of the case, his 39-page decision means the hopes of 1.6 million affected Sweetbay shoppers in Florida shifts to a Hillsborough County Circuit Court case that was revived last week. That case applies only to Florida residents. A federal appeals court peeled it off from 24 suits consolidated as one heard by Hornby in Portland, Maine.
"We think Florida law offers more remedies than Maine law," said David Metcalf, a Tallahassee attorney who filed the Tampa case. Some of his clients — including one issued a new card number — are still getting billed for fraudulent charges from the breach a year later.
Hornby called it a data fraud case because there were no allegations of identity theft, as hackers sold the card numbers to others who tried to use them to make bogus charges. Identity theft occurs when hackers gather enough personal information to open new credit card accounts in someone else's name.
Hornby's decision riled victims and privacy advocates hoping for some new legal clarity in a murky area of the fast-changing world of wireless commerce amid rising wariness over data theft. Hornby found Maine law protects only those who actually lost money because of Sweetbay or Hannaford Bros.' negligence.
Fraud and negligence laws protect purchases, but not against privacy invasions, lack of access to accounts, payment card data theft or the hassles and anxiety of card theft.
"There is no way to value and (pay for) the time and effort that consumers spent in reconstituting their bill-paying arrangements or talking to banks to explain what charges were fraudulent," the judge wrote. "Those are the ordinary frustrations and inconveniences that everyone confronts in daily life with or without fraud or negligence."
That outraged Ken Arnold, a retired St. Petersburg banker whose Discover Card number was stolen from a Sweetbay in February 2008. Discover noticed someone trying to put $312 on it in Miami a short time after Arnold used the card 225 miles away in St. Petersburg. Discover canceled the card number and told Arnold.
"How can an invasion of privacy like that just be part of everyday life?" he said. "This isn't about the money. It's time somebody tells these huge corporations the customer still means something. The judge didn't sanction Sweetbay, require they hand out coupons, apologize, compensate or even notify us well after they discovered the breach."
Mark Albright can be reached at firstname.lastname@example.org or (727) 893-8252.