(CN) – Credit unions and their insurer can’t collect damages after thieves racked up millions of dollars in fraudulent purchases using credit-card information stolen from BJ’s Wholesale Club, the Massachusetts Supreme Court ruled.
Thieves gained access to the credit-card accounts of 9.2 million BJ’s customers and used the information to make unauthorized purchases.
Cumis Insurance Society and the credit unions who issued the cards sued BJ’s Wholesale Club for breach of a third-party contract, based on BJ’s agreement with Fifth Third Bank not to store customers’ magnetic-stripe data.
The credit unions wanted to be compensated for having to issue millions of new credit cards to replace the ones that were compromised.
The trial court sided with BJ’s, and the state high court affirmed, saying the contract was exclusively between BJ’s and Fifth Third.
The contract stated: “This agreement is for the benefit of, and may be enforced only by, (Fifth Third) and (BJ’s) … and is not for the benefit of, and may not be enforced by, any third party.”
The court also tossed fraud and negligence claims against BJ’s and Fifth Third Bank, saying they never misled the credit unions and Cumis about their compliance with Visa and MasterCard regulations.