Lone Star National Bank v. Heartland Payment Systems

Visa and MasterCard used a network of entities for their credit-card and debit-card transactions. If a consumer charged something with a merchant, the charge information was sent through the network to a processing company. The processing companies sent the charge information to the issuer banks, i.e., the banks that had issued the cards to the consumers. The issuer banks sent payment to the processing companies, which then passed the payment back down the chain to the merchants. Visa and MasterCard had master agreements governing all the entities in their networks. These master agreements set out what and how a network member could recover for losses caused by data breaches within the network. Heartland Payment Systems, Inc. (Heartland) (defendant) was a processing company in the Visa and MasterCard network. Heartland was hacked, and numerous consumers suffered fraudulent charges as a result. Lone Star National Bank, N.A. and other issuer banks (the issuer banks) (plaintiffs) sued Heartland for negligence, alleging that Heartland’s negligence had caused them financial losses in the form of having to (1) compensate consumers for fraudulent charges and (2) issue a large number of replacement cards. The complaint did not state whether the issuer banks could recover from Heartland under the master network agreements. The district court dismissed the lawsuit, finding that the issuer banks could not pursue a negligence claim for their purely economic losses and that their only recourse against Heartland, if any, was under the master agreements. The issuer banks appealed.