Welcome to Reuters Legal News beta. Please enjoy and provide us with your feedback as we continue to improve the Reuters Legal News experience.

Skip to main content

Hudson's Bay Co inks data breach deals with financial institutions, consumers

4 minute read

A man exits a Hudson's Bay department store in Toronto, Ontario, Canada June 6, 2016. REUTERS/Chris Helgren

Register now for FREE unlimited access to reuters.com
  • Morgan, Lewis & Bockius LLP
  • Faruqi & Faruqi, LLP
  • Law Offices of Steven Calcaterra & Associates, PC

The company and law firm names shown above are generated automatically based on the text of the article. We are improving this feature as we continue to test and develop in beta. We welcome feedback, which you can provide using the feedback tab on the right of the page.

(Reuters) - Retailer Hudson's Bay Co ULC has agreed to pay up to $4 million to a class of financial institutions and up to $2 million to a consumer class in separate deals over a breach that compromised data on payment cards used at Saks and Lord & Taylor stores, according to filings on the proposed settlements in Manhattan federal court.

Lawyers for the classes filed motions for preliminary approval of the proposed deals on Thursday, seeking to resolve years-long litigation over a security incident that affected payment cards used at Saks, Saks OFF 5th and Lord & Taylor North American stores from about May 2017 through the end of March 2018.

The cases generally allege a failure by Canada-based Hudson's Bay, Saks and Lord & Taylor to secure personal financial data and prevent the breach, in which hackers compromised the company's point-of-sale systems, installed malware at the stores and exfiltrated payment card data, according to court filings.

Register now for FREE unlimited access to reuters.com

Hudson's Bay and its lawyers from Morgan, Lewis & Bockius didn't immediately respond to requests for comment Friday on the proposed settlements. The companies don't admit any wrongdoing or liability.

The financial institution plaintiffs claim they experienced financial losses, such as costs related to canceling and reissuing payment cards and to reimbursing customers for fraudulent activity on the cards. The deal in that case provides for $4 million and injunctive relief, as well as costs and attorneys' fees up to $1.1 million, according to a brief filed in support of the settlement.

Joseph Guglielmo of the law firm Scott + Scott, who represents plaintiffs Arkansas Federal Credit Union and The Summit Federal Credit Union, did not immediately respond to a request for comment.

In the proposed agreement with consumers, members of the settlement class who have "sufficient proof" of using a payment card at one of the stores between May 1, 2017, to April 1, 2018, and took steps to address the breach can get a $30 payment. The full proposed settlement amount is about $3.67 million, including up to $1.4 million in attorneys' fees and costs, according to the plaintiffs' brief.

Timothy Peter of Faruqi & Faruqi and Janine Pollack of Calcaterra Pollack, who represent the consumers, didn't immediately respond to a request for comment.

The cases are assigned to U.S. District Judge P. Kevin Castel in the Southern District of New York.

The cases are: In re Hudson's Bay Company Data Security Incident Consumer Litigation, U.S. District Court for the Southern District of New York, No. 1:18-cv-08472-PKC and Arkansas Federal Credit Union et al v. Hudson's Bay Company et al, U.S. District Court for the Southern District of New York, No. 1:19-cv-04492-PKC.

For Hudson's Bay, Saks and Lord & Taylor: Gregory Parks of Morgan, Lewis & Bockius

For the financial institutions: Joseph Guglielmo of Scott + Scott

For the consumers: Timothy Peter of Faruqi & Faruqi and Janine Pollack of Calcaterra Pollack

Read More:

Saks, Lord & Taylor hit by payment card data breach

Register now for FREE unlimited access to reuters.com

Sara Merken reports on privacy and data security, as well as the business of law, including legal innovation and key players in the legal services industry. Reach her at sara.merken@thomsonreuters.com

More from Reuters