More than five years after a massive 2008 data breach, HeartlandPayment Systems asked a federal judge to dismiss a lawsuit filed bya group of credit unions and banks, according to court documentsobtained by CU Times.

In a motion filed Oct. 15 in U.S. District Court's HoustonDivision, Heartland's legal team argued that the negligence claimsare barred by state laws in New Jersey, where Heartland isheadquartered, and Texas, where the breach occurred.

In the motion and accompanying 1500-page memorandum, thePrinceton, N.J.-based processing giant contended that Texaseconomic loss doctrine should apply to the case because the core ofthe negligence claim – accusations that the company's inadequate ITsecurity measures permitted the breach – occurred at a Heartlanddata center in Texas, the documents said.

New Jersey's economic loss doctrine also bars the claims,according to Heartland's motion.

Plaintiff credit unions include the $155 million MatadorsCommunity Credit Union of Chatsworth, Calif., $2 billion GECU of ElPaso, Texas, $2 billion MidFlorida Credit Union of Lakeland, Fla.,and the $4.2 billion Pennsylvania State Employees Credit Union ofHarrisburg, Pa.

Legal experts have said the Heartlands case may be impacted by aU.S. Supreme Court decision in late 2013.

Known as the “Clapper decision,” the case of Clapper v. AmnestyInternational USA raised the barriers to commencement of asuccessful class action for a breach of data security, according toa Lexology post submitted by the law firm of King & WoodMallesons.

Since the Clapper decision was handed down, courts havedismissed the vast majority of data breach class actions, the postsaid.

In the Heartland case, U.S. District Judge Lee Rosenthal, who iscurrently presiding over the litigation in Southern Texas,dismissed most of the complaints filed by the financialinstitutions in late 2011.

In that case, Rosenthal ruled that the plaintiffs were notspecifically protected in contracts between Heartland PaymentSystems and its acquiring banks, Heartland Bank and KeyBank, andthat the financial institutions were not covered in contractsbetween Heartland and the major card brands. The credit unions andbanks appealed, targeting the negligence and responsibility forlosses.

A panel of the Fifth Circuit Court of Appeals in New Orleansruled last fall that the credit unions and banks could state aclaim for negligence because the economic loss doctrine did notapply, despite the fact that the card issuers lacked a writtencontract with Heartland. Litigation was then consolidated into onecomplaint to be heard by Rosenthal.

While the legal war wages on, Heartland Payments has beenworking to restore its image and launch new products. The companyrecently unveiled a new service called Heartland Secure, whichutilizes encryption, tokenization and a proprietary EMV-compliantpoint-of-sale terminals, according to Heartland's website.Heartland Secure will be offered free of charge to Heartlandmerchants, the company said.

In addition, Robert O. Carr, CEO of Heartland, delivered akeynote presentation at the 7th Annual Mobile Payments ConferenceOct. 8 in Chicago, according to national media.

“We created Heartland Secure to provide customers with a securesolution for POS and other card processing methods, which can helpprevent data breaches and other potential liabilities, includingastronomical fines and damage to brand reputation,” Carr said inthe MarketWatch article.

He added, “The number of security breaches in the retailindustry has reinforced the need for merchants to incorporate morethan one technology solution to payment transaction security.”