The number of credit unions suing Wendy's over its recent data breach has soared in recent weeks, and other members of the industry are also piling into the class action suit against the fast food chain.

The case against the burger chain now includes 19 credit unions, three banks, four credit union leagues and CUNA. In July, a Pennsylvania District Court Judge consolidated the suits.

The complaint alleged that, among other things, Wendy's failed to delete cardholder information from its systems after authorizing transactions, failed to protect against malware and viruses, didn't have an adequate firewall, didn't limit or track access to the card data, failed to disclose the breach in a timely manner and didn't covert to EMV. It also alleged that that the point-of-sale systems at Wendy's were out of date.

The three bank plaintiffs include Centrue Bank, First NBC Bank and The Seymour Bank. Georgia Credit Union Affiliates, the Indiana Credit Union League, the Michigan Credit Union League and the Ohio Credit Union League are also plaintiffs.

In July, Wendy's, which is based in Dublin, Ohio, confirmed hackers obtained customer payment card data at 1,025 of its restaurants nationwide.

“Industry sources estimate the fraudulent charges have been even greater than in other recent data breaches, like Target and Home Depot. CUNA surveys found credit unions alone were hit with nearly $60 million in costs after Home Depot's 2014 data breach and $30.6 million after Target's 2013 data breach,” CUNA said in a statement regarding its decision to join the suit.

For some, joining the suit is also a way to push for new laws that make retailers responsible for damages associated with data breaches.

“Until retailers are forced to invest in robust data security measures, credit unions will continue to pay the price for retailer data breaches,” Michigan Credit Union League EVP/COO Ken Ross said. “Adding our name to this class action is one way we are going to bat for Michigan credit unions until a legislative solution is achieved.”

The original complaint alleged that the breach was caused by malware on the company's point-of-sale systems that stole Track 1 and Track 2 data. That data normally includes cardholder names, primary account numbers, card expiration dates and sometimes PIN numbers, the complaint said. According to a Visa CAMS alert cited in the filing, the exposure window for the data breach ran from Oct. 26, 2015 through March 10, 2016.

The breach resulted in the credit union and thousands of other card issuers having to cancel and reissue compromised cards, change or close accounts, notify cardholders their cards were compromised, investigate claims of fraudulent activity, increase fraud monitoring activities, as well as reimburse cardholders for fraudulent charges, according to the complaint.

The 19 credit unions include:

Alcoa Community Federal Credit Union (Benton, Ark., $40.9 million, 6,500 members)
Align Credit Union (Lowell, Mass., $555 million, 27,700 members)
AOD Federal Credit Union (Oxford, Ala., $280 million, 32,400 members)
Associated Credit Union (Norcross, Ga., $1.4 billion, 162,900 members)
Envista Credit Union (Topeka, Kan., $314 million, 38,300 members)
Financial Horizons Credit Union (Hawthorne, Nev., $165 million, 11,000 members)
First Choice Federal Credit Union (New Castle, Penn., $44 million, 6,400 members)
Greater Cincinnati Credit Union (Cincinnati, Ohio, no member/asset size available)
Greenville Heritage Federal Credit Union (Greenville, S.C., $88 million, 13,000 members)
Kemba Federal Credit Union (Gahanna, Ohio, $1 billion, 87,200 members)
Members Choice Credit Union (Houston, $519 million, 39,800 members)
Navigator Credit Union (Pascagoula, Miss., $326 million, 47,700 members)
North Jersey Federal Credit Union (Totowa, N.J., $226 million, 26,200 members)
Nusenda Credit Union (Albuquerque, N.M., $1.8 billion, 164,000 members)
Preferred Credit Union (Grand Rapids, Mich., $162 million, 24,900 members)
South Florida Educational Federal Credit Union (Miami, $1 billion, 75,000 members)
Tech Credit Union (Crown Point, Ind., $335 million, 38,000 members)
Veridian Credit Union (Waterloo, Iowa, $3 billion, 200,000 members)
Wright-Patt Credit Union (Beavercreek, Ohio, $3.3 billion, 324,000 members)

Can your cybersecurity strategy handle an attack? Do you have the latest tools and techniques to prevent fraud and data breaches? Get them and more at our FREE Second Annual Data Breach Defense Virtual Conference on September 7. Plus, you'll also learn the latest trends in cybersecurity including incident responses and be able to immediately download white papers, and so much more. Register FREE Now!

Instant Insights /

Credit Unions Pile Into Wendy&rsquo;s Breach Suit

Related Stories

Recommended For You

Credit Unions Pile Into Wendy’s Breach Suit