## Facts

- Issuer banks participated in the Visa and MasterCard payment networks by issuing payment cards to consumers.
- Heartland Payment Systems, Inc. acted as a network processor for merchants through acquirer banks and was contractually required (via those relationships) to comply with Visa and MasterCard regulations, including data-security standards and loss-recoupment mechanisms.
- Hackers infiltrated Heartland’s systems and compromised cardholder data associated with customers of the issuer banks.
- The issuer banks alleged they incurred costs for reimbursing fraudulent transactions and reissuing compromised cards.
- The issuer banks had no direct written contract with Heartland but sued Heartland for negligence and asserted contract-based theories as alleged third-party beneficiaries of Heartland’s contracts with others in the network.

## Issues

1. Under New Jersey law, does the economic loss doctrine bar issuer banks’ negligence claim seeking purely economic damages from a payment processor for a data breach when the parties lack a direct contract but are connected through network contracts and rules?

## Decision

- The Fifth Circuit reversed the Rule 12(b)(6) dismissal of the negligence claim and remanded.
- The court held that New Jersey’s economic loss doctrine did not require dismissal at the pleading stage.
- The court emphasized the absence of a direct contract between the issuer banks and Heartland, weakening the rationale that tort recovery would circumvent negotiated contractual risk allocation.
- The court concluded it was premature to treat Visa/MasterCard network rules as conclusively providing the issuer banks’ exclusive remedies against Heartland on a motion to dismiss.
- The court limited its ruling to whether the claim was barred by the economic loss doctrine and did not decide whether Heartland in fact owed or breached a duty.

## Legal Principles

- New Jersey’s economic loss doctrine generally bars tort recovery for purely economic loss when the alleged duty arises solely from a contract and tort claims would evade the contract’s allocation of risk and remedies.
- The doctrine is not a categorical bar to all negligence claims for economic loss; tort claims may proceed when the plaintiff plausibly alleges breach of a duty of reasonable care imposed by law independent of any contract.
- When no direct contract exists between plaintiff and defendant, courts are less likely to apply the doctrine to foreclose tort claims at the pleading stage, because there is no clear bilateral bargaining over risk and liability.
- On a Rule 12(b)(6) motion, the court accepts well-pleaded allegations as true and draws reasonable inferences in the plaintiff’s favor; dismissal is improper where the complaint plausibly alleges an independent duty and foreseeable harm.

## Conclusion

The Fifth Circuit held that, under New Jersey law and on the pleadings, issuer banks’ negligence claim for card-reissuance and fraud-reimbursement costs caused by a processor’s data breach was not barred by the economic loss doctrine where the parties lacked a direct contract and the complaint plausibly alleged an independent duty of reasonable care in safeguarding payment-card data.


Lone Star Nat'l Bank, N.A. v. Heartland Payment Sys., Inc., 729 F.3d 421 (5th Cir. 2013)