Greenstate Credit Union v. Hy-Vee, Inc.

Background

This putative class action arose from malware that hackers installed on Hy-Vee’s point-of-sale systems between November 2018 and August 2019. The malware accessed customers’ payment-card information, including names, card numbers, and expiration dates. Greenstate Credit Union alleged that its members used cards at Hy-Vee stores in Minnesota and that at least one Greenstate-issued card was compromised there.

Greenstate alleged that Hy-Vee failed to use adequate security measures, update critical systems, respond to warnings, monitor its network, and comply with applicable data-security standards. Greenstate claimed that it had to cancel and replace compromised cards, reimburse members for fraudulent charges, and absorb losses from reduced card use, including lost interest and transaction fees.

Greenstate asserted claims under the Minnesota Plastic Card Security Act, common-law negligence, negligence per se, and for declaratory and injunctive relief. Hy-Vee moved to dismiss for failure to state a claim. The court had previously denied Hy-Vee’s motion based on personal jurisdiction or, alternatively, venue; the present order addressed the separate pleading challenge.

Choice of Law

The court determined that it had enough information to decide the choice-of-law question at the motion-to-dismiss stage because the record described where the relevant conduct occurred. Applying Minnesota’s conflict-of-laws rules, the court found an outcome-determinative conflict between Minnesota and Iowa law. Minnesota had a Plastic Card Security Act, while Iowa did not have an analogous statute. The court also found a conflict regarding negligence because Iowa’s economic-loss rule would bar Greenstate’s negligence claims.

The court held that Iowa law applied. Both parties were Iowa residents, Greenstate’s branches were in Iowa, Greenstate incurred its alleged financial costs in Iowa, and Hy-Vee’s relevant information-security decisions and personnel were in Iowa. Although Hy-Vee operated stores and processed payment-card transactions in Minnesota, the court concluded that Minnesota’s contacts and governmental interests did not outweigh Iowa’s. The court also stated that Iowa law was a predictable choice because Hy-Vee’s relevant security decisions occurred there.

Economic-Loss Rule

Iowa’s economic-loss rule bars negligence recovery when the plaintiff suffers only economic loss without physical or direct harm to property or persons. The court rejected Greenstate’s argument that compromised payment-card data constituted damaged property. It relied on Iowa authority holding that losses from unauthorized payment-card use were indirect economic losses, and it noted that the Iowa Supreme Court had favorably described a similar case involving credit unions and a retailer’s inadequate protection of card data.

The court concluded that Greenstate’s claimed costs—canceling compromised cards, issuing replacements, reimbursing fraudulent charges, and losing interest and transaction fees—were indirect economic losses rather than damage to the members’ payment cards. The court also rejected Greenstate’s argument that the economic-loss rule did not apply because the parties lacked a direct contract. It held that the parties’ relationship was too remote and fit within Iowa’s “stranger economic loss” rule, which limits claims for purely economic losses against remote third parties.

Disposition

The court applied Iowa law and held that Greenstate’s Minnesota Plastic Card Security Act and negligence claims must be dismissed. It also dismissed the request for declaratory and injunctive relief because those remedies depended on the dismissed substantive claims. The court ordered that Hy-Vee’s motion to dismiss was granted and that the action was dismissed with prejudice. Judge David S. Doty signed the order.