Fourteen credit unions still have a chance to recoup some of themoney they lost in the 2008 Heartland Payment Systems databreach.

The Fifth District Court of Appeals has sided with the creditunions and banks which lost their initial case against Heartland.The Court agreed that the financial institution plaintiffs, whichinclude both banks and credit unions, have a negligence claimagainst the firm for the losses they incurred from the cardcompromise.

The breach has been recognized as one of the largest ever, compromising information frommore than 100 million U.S. consumers. Litigation was brought bybanks and credit unions and then consolidated into one complaintheard by U.S. District Judge Lee Rosenthal in the U.S. DistrictCourt for the Southern District of Texas.

The credit unions that brought original actions included the11,000-member, $130 million Matadors Community Credit Union,headquartered in Chatsworth, Calif.; the $1.8 billion,303,000-member GECU headquartered in El Paso, Texas; the $1.6million, 151,000-member MidFlorida Credit Union, headquartered inLakeland, Fla, as well as the 406,000 member, $4.2 billionPennsylvania State Employees Credit Union headquartered inHarrisburg, Penn.

The credit unions and banks that brought suit were ones thatdeclined to participate in a previous settlement agreement that the card brand Visa negotiatedand sponsored.

Judge Rosenthal decided against the financial institutions in late 2011and the card issuers appealed the decision, in particular thecomplaint about Heartland Payment Systems negligence andresponsibility for their losses.

In a ten page opinion, a three judge panel from the FifthCircuit Court of Appeals, based in New Orleans, Louisiana, agreedwith the card issuers.

“[W|e hold the economic loss doctrine under New Jersey law doesnot preclude the Issuer Banks' negligence claim against Heartlandat the motion to dismiss stage,” the panel wrote in its opinion.“Heartland had reason to foresee the Issuer Banks would be theentities to suffer economic losses were Heartland negligent… Theidentities, nature, and number of the victims are easilyforeseeable, as the Issuer Banks are the very entities to whichHeartland sends payment card information…. Furthermore, Heartlandwould not be exposed to 'boundless liability,' but rather to thereasonable amount of loss from a limited number of entities.Accordingly, even absent physical harm, Heartland may owe theIssuer Banks a duty of care and may be liable for their purelyeconomic losses.”

The panel also observed that absent a remedy in Court, theIssuers have no other method to seek redress for their losses.

“Second, viewing the pleadings in the light most favorable tothe Issuer Banks, in the absence of a tort remedy, the Issuer Bankswould be left with no remedy for Heartland's alleged negligence,defying 'notions of fairness, common sense and morality,'” thepanel wrote, quoting a previous case.

The court then ordered the lower court to reexamine parts of thecase and it decision in light of the appeal and cited Heartland forthe costs of the appeal.

None of the 14 credit unions nor Heartland Payment Systems hasyet commented on the decision.