Now that a U.S. District Court has granted class action status to a suit brought by five financialinstitutions against Target for damages related to theretailer's massive 2013 data breach, as many as 9,000 credit unionsand other institutions should soon receive paperwork aboutparticipating in the suit, according to one of the attorneys in thecase.

Charles Zimmerman of Zimmerman Reed PLLP (pictured), which isnow the co-lead counsel for the class, told CU Times acourt-approved notice should begin arriving in financialinstitutions' mailboxes in a few weeks. Financial institutionsdon't need to opt into the class, Zimmerman said; those thatreceive the notice are already deemed part of the class action.

“The only thing you need to do if you're a financial institutionis calculate your reissuance costs, calculate your fraud losses,and calculate your other losses from personnel or back office workthat you had to conduct,” he said. “If the case proceeds to trialand we win, then there'll be a claim form for you to file with yourlosses.”

If financial institutions want to pursue Target individually,they'll need to opt out of the class action and will probably haveabout a month or six weeks after receiving the notice to make thatdecision, he said.

For financial institutions that accepted Target's Visa settlement in recent weeks, it may not be toolate to be part of the class action, Zimmerman noted. Thatagreement required financial institutions that took the fullsettlement to forfeit their right to sue Target over the breach, butZimmerman said financial institutions can still rescind theirdecision if they haven't cashed their checks.

“Credit unions incurred at least $30 million in card reissuancecosts related to the Target breach and I'm encouraged this case wasawarded class action status,” CUNA President/CEO Jim Nussle saidafter the decision was announced.

Nussle and NAFCU Senior Vice President of Government Affairs andGeneral Counsel Carrie Hunt both said in separate statements thatthey urge Congress to enact national data security standards for retailers.

Zimmerman said the case is currently set to go to trial in themiddle of the third quarter of 2016.

“I think whether it's a data breach from Target or The HomeDepot or whatever, the [financial institutions] just shouldn't bebearing that loss,” he said. “It's really the person who'sresponsible for holding the data that should be responsible.”