In a much-anticipated court ruling, a Minnesota federal judge said Dec. 2 that Target Corp. had a duty to protect debit and credit card information from cyberthieves.

U.S. District Judge Paul Magnuson rejected Target's attempt to dismiss claims filed by a group of financial institutions seeking damages related to the retailer's data breach in late 2013, court documents said.

The judge ruled that the plaintiffs, which included the $282 million CSE Federal Credit Union in Lake Charles, La., had a plausible case for negligence because Target played a key role in allowing cyberthieves to hack into computer systems and obtain card data and possibly personal information of card holders, the documents said.