Tuesday, October 3, 2023 | Back issues
Courthouse News Service Courthouse News Service

P.F. Chang’s Clears Security-Breach Suits

CHICAGO (CN) - Attempts by hackers to use credit card information stolen from P.F. Chang's does not demonstrate actual financial injury, a federal judge ruled.

Two class actions filed earlier this year had claimed that lax security at P.F. Chang's China Bistro allowed hackers to steal the credit and debit card numbers of up to 7 million customers.

Since the restaurant allegedly waited nine months to tell customers about the security breach, the class said they failed to take timely measures to protect their financial information, enabling hackers to make unauthorized purchases on their credit cards.

U.S. District Judge John Darrah dismissed the complaints last week, however, based on the failure to connect the security breach to actual injury.

"Plaintiffs claim they overpaid for the products and services purchased from defendant," Darrah wrote. "Plaintiffs argue that the cost of the food they purchased implicitly contained the cost of sufficient protection of PII [personal identity information]. As this court has held before, this argument is unpersuasive."

Indeed, lead plaintiff John Lewert did not show that the credit card he used at P.F. Chang's incurred any fraudulent charges.

Though four unauthorized charges totaling $61.89 were attempted using his card number, Lewert's bank, Chase, declined the charges and notified Lewert of the fraudulent activity, the court found.

Lewert's fellow lead plaintiff, Lucas Kosner, similarly did not have any money taken out of his account after the theft of his debit card number, and did not pay any fees resulting from the attempted fraud, according to the ruling.

"In order to have suffered an actual injury, plaintiffs must have had an unreimbursed charge on their credit or debit cards," Darrah said. "Plaintiffs do not allege any successful charges, let alone reimbursed charges."

Kosner claimed that the breach deprived him of the ability to use his affected debit card for two to three days, but Darrah said that neither the status of "simply being without a debit card," nor the inability to accrue rewards points on the card, qualifies as an injury.

While the theft of financial information from P.F. Chang's may expose customers to identity theft in the future, they cannot sue for a speculative future injury, according to the ruling.

Categories / Uncategorized

Read the Top 8

Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.