Community Bank of Trenton v. Schnuck Markets, Inc.

Dist. Ct. did not err in dismissing action by plaintiffs-credit card-holders’ banks against defendant-retail merchant who suffered data breach, where plaintiffs that made good on customer claims for fraudulent use of their credit cards stemming from said breach sought damages above and beyond remedies provided to plaintiffs by network of contracts that linked defendant, card-processors, plaintiffs and card brands that enabled electronic card payments. While plaintiffs alleged that they were entitled to assert common law negligence claims, as well as Illinois consumer protection statutes to recover losses not covered by instant contract network, Ct. of Appeals found that plaintiffs were limited to recoveries set forth in instant network of contracts. Fact that plaintiffs had no direct contractual relationship with defendant did not require different result, where plaintiffs and defendant were part of same network of contracts that tied all participants in same card payment system, and where plaintiffs’ participation in network meant that they would incur some risk of not being fully reimbursed for costs associated with another party’s mistake. Also, Ct. found that: (1) Illinois Supreme Ct. would not either impose common law data security duty that plaintiffs would require in instant lawsuit or apply any exception to economic loss rule that would otherwise bar instant recovery; and (2) plaintiffs could not recover under either unjust enrichment, implied contract or third-party beneficiary theories.