WASHINGTON—CUNA is joining a data breach lawsuit against Wendy's, CUNA’s board decided this week.
The fast-food chain has been accused of negligence in protecting customer credit card information and being liable for a massive breach of that information.
"The CUNA board has authorized us, as the national association for credit unions, to join a lawsuit against Wendy's," said CUNA President/CEO Jim Nussle in a released statement.
The financial costs caused by Wendy's "deficient data security approach" have been borne primarily by credit unions and other financial institutions that issued the payments cards that were compromised, CUNA said it will allege in its complaint. Those costs include, but are not limited to, canceling and reissuing compromised cards and reimbursing the cardholders for fraudulent charges associated with the breach.
Industry sources estimate the fraudulent charges have been even greater than in other recent data breaches, like Target and Home Depot. CUNA surveys found credit unions alone were hit with nearly $60 million in costs after Home Depot’s 2014 data breach and $30.6 million after Target’s 2013 data breach.
The first Wendy's suit was filed in the Western District of Pennsylvania by First Choice FCU, News Castle, Penn. The credit union seeks to recover the costs incurred related to the breach. Other credit unions followed suit with additional cases filed in the Western District of Pennsylvania.
The Wendy's breach occurred from October 2015 through March 2016--or, according to some reports, may have lasted into April.
League Quantifies Breach's Cost To One CU
At the same time CUNA is wading in to the Wendy’s matter, the Michigan Credit Union League is quantifying just what a breach such as that at Wendy's costs an individual credit union.
The MCUL developed the data as part of efforts by the league and its member CUs to advocate for stronger accountability for merchants and card network companies.
One of the Michigan credit unions impacted by the Wendy’s breach is Belle River Community CU, whose CEO, Vicki McIntosh, said her credit union paid $8,000 in fraudulent charges plus estimated costs of $1,000 in out-of-pocket costs to issue new cards to members, the league explained in a release. The costs equated to one month of the $20.2-million credit union’s net income.
Compounding the hit to the credit union’s bottom line, McIntosh said she was never contacted by the card company to tell her what members’ cards had been compromised, making it extremely difficult to know which cards need to be reissued, the league stated. In addition, a forensic investigation required to be conducted by the merchant after a breach has still not been completed, according to MCUL regulatory affairs staff.
McIntosh, Michigan credit union leaders, and the Michigan Credit Union League CEO Dave Adams have called on lawmakers to require retailers to be held to the same federal data breach standards of which credit unions are subject to, and to enforce the laws currently in place.
“The current system is broken—retailers big and small experience a breach and months go by without any notice to credit unions of which cards are compromised which results in a spike in fraud losses—and once again local credit unions are left holding the bag,” Adams said. “Again, we call on lawmakers and regulators to use their full authority to ensure both retailers and card network companies are doing their part to protect customer’s information instead of leaving credit unions to continually shoulder the burden.”
According to Wendy’s, malware has been discovered on some franchise restaurants' POS systems. The company is still investigating the total number of locations impacted.