After a two-hour emergency hearing Monday, U.S. District CourtJudge Paul Magnuson took under advisement arguments regardingwhether to stop a $19 million proposed settlement between Targetand MasterCard that could have far-reaching implications for card issuers.

The proposed settlement is in response to a data breach in late2013 that compromised approximately 110 million credit and debitcards, as well as personal information of Target customers.

The hearing came after attorneys Charles Zimmerman of ZimmermanReed and Karl Cambronne of Chestnut Cambronne asked for aninjunction (readthe plaintiffs' entire legal motion here) on behalf of UmpquaBank, Mutual Bank, Village Bank, CSE FCU and First Federal Savingsof Lorain. Douglas Meal of Ropes & Gray represented Target atthe hearing.

In or Out

According to a transcript of the hearing, much of theconversation revolved around whether issuers should have beeninvolved in the talks between MasterCard and Target, whetherissuers must forfeit their rights to sue if they accept the settlement and how tocalculate the damages.

“The financial institutions were excluded from the process, theywere not in the room, they were not being heard,” Zimmerman toldthe judge, according to the transcript. “We're supposed to havepeople whose interests are at stake in the room discussing theirinterest, but people that know most about the financialinstitutions' claims and damages were not there.”

Target and MasterCard were well within their rights to negotiatea settlement by themselves because thesuit doesn’t have class-action status, Meal explained. A hearing on class certification is set for September,according to the transcript.

“We negotiated with MasterCard, who is acting on behalf of theissuers, but ultimately MasterCard said, and we agreed, we're notgoing to try and cram anything down on our customers. We'll presentthe offer, and if they like it, great. Prior history shows thatissuers presented with these offers have found them to beexcellent,” he said, according to the transcript.

By accepting the settlement as it is currently worded, Zimmermantold the judge, issuers would have to forfeit their right to sueunder Minnesota’sPlastic Card Security Act, which entitles them to reimbursementfor the cost of cancelling cards, closing and reopening accounts,blocking transactions, issuing refunds or credits to cardholdersand notifying cardholders. Under the law, the reimbursable costsexclude amounts recovered from credit card companies, meaning thatthe issuers could still come to Target for the difference.

“They're being asked to sign a complete release of all of theirdamages, which is, in our view, completely inappropriate,”Zimmerman said.

“We think under the law we had every right and very good reasonto structure the settlement as we did and look for a completerelease from any issuer that chose to settle with us. Any issuerthat doesn't choose to settle with us, there's no release andthey're right where they were today, and that's perfectlyappropriate and fair to everyone,” Meal said.

Million Dollar Questions

According to Cambronne, MasterCard told issuers they would becompensated for 71.4% of operational and fraud-related losses onMasterCard-branded cards believed to be affected by the Target databreach. MasterCard also provided data showing fraud losses on theTarget breach of $79,319,427.74, according to the transcript.

“So you add one $80 million figure, another $80 million figurefor the reissuance, and all of a sudden we have $160 million ofcosts, of harm, of damages attributable to the losses here, and thechief integrity officer of MasterCard has the audacity to suggestyou're going to get with $19 million total 71.4% of your losses forfraud and your losses for reissuance of cards,” Cambronne said.

“Our experts tell us that card replacement is between $7 and$10, maybe $12 a card. They're looking at under this formula abouta buck and a half a card. That's not right. No one was thereadvocating for that,” Zimmerman added.

The real reimbursement rate is 11.8%, Cambronne and Zimmermanargued.

One hang-up is with language in the communication to issuerssaying losses will be calculated according to MasterCard AccountData Compromise standards, but Meal called that “manufacturedambiguity.”

The $79 million number is actually the sum of all fraud of anyvariety on cards at risk in the data breach, he told the judge,according to the transcript. It therefore includes, he said, fraudattributable to exposed cards that were later lost, stolen orcounterfeited. Backing out this “ordinary course fraud that wouldhave occurred anyway,” as Meal put it, significantly reducesMasterCard’s damages attributable to the Target intrusion, hesaid.

“Ultimately MasterCard is making estimates based in part oninformation they got from the issuers and based in part on justtheir judgment, making estimates as to what the losses are, andit's formulaic, it's absolutely formulaic. We on Target's sidehappen to think that they wildly overestimate what the issue orlosses are, not underestimate, overestimate,” Meal emphasized.

“There are some issuers, Your Honor, who incurred no costs here,who didn't reissue cards, who didn't incur any fraud. For thoseissuers this is a windfall,” he added.

What’s Next?

Magnuson did not rule on the motion during the hearing, but hedid express reservations that could indicate what will happennext.

“Can MasterCard and Target get into a deal? Absolutely. But canTarget force through MasterCard as a quasi agent, force these banksto accept it? That's my concern,” he said, according to thetranscript.

“I know, as well as you do, now that as soon as we get done hereand if I put my blessing on this, then you're going to come in andsee me about Visa and you're going to come in and see me withAmerican Express and Discover, and if there's anybody else left totalk about,” he told Meal.