Final Stats On Heartland Payment Systems Class Action: $1,925 To 11 People, $600k To Lawyers

from the class-action-system-is-broken dept

We've been discussing for years just how broken the "class action" lawsuit system is in the US. The idea behind it sounds like it makes sense: if a company wrongs a bunch of people, the ability to bundle them all into a class, and get recompense via a single lawsuit seems like a good idea. But, in practice, class action lawsuits have basically just become a feeding trough for lawyers to become rich, with very little done to help those wronged. In some cases, the end results of class action lawsuits are completely laughable. Years ago, for example, we highlighted how Netflix "settled" a class action lawsuit by giving everyone a free one-month "upgrade," but if you failed to downgrade by the end of the month, you were kept on the higher plan and charged for it. As I said at the time, that wasn't a "settlement" so much as a marketing program. And, oh yeah, the lawyers who brought the lawsuit against Netflix got $2.5 million.

Law professor Eric Goldman, who's spoken out about the broken class action system in the past, has another ridiculous example, this time involving Heartland Payment Systems. You may recall Heartland as being the company that had the largest security breach ever (at the time), losing data on over 100 million credit cards. A class action lawsuit (of course) followed, and Heartland agreed to pay up to anyone who could show that they were a victim of fraud from the loss. The company didn't have cardholder addresses, so it spent $1.5 million to advertise the settlement, and estimated that over 80% of the potential class saw an ad at least 2.5 times. Either way, not too many claims came in. A total of 290 claims were made, but only 11 were found to be valid.

Heartland had to pay a maximum of $175 to those individuals. Assuming it did pay the maximum, that means the "victims" of the breach got a grand total of $1925 (perhaps less). According to the settlement agreement, Heartland was supposed to pay out at least $1 million to victims (and up to $2.4 million). If less than $1 million worth of victims were found, the rest would go to non-profit organizations focused on protecting consumer privacy rights. That leaves $998,075 for those non-profits.

So, let's summarize:

• Actual victims got: $1925
• Heartland spent $1.5 million to find the people to give out that $1925.
• Somewhere around $998,075 goes to non-profits
• The lawyers who brought the lawsuit? They got $606,192.50. For helping 11 people get less than $200 each. Nice work if you can get it.

That $600k is actually a "discount." The court recognizes the absurdity of using the full $1 million in calculating the "settlement," so it knocks down the "value" (but not the payment) of the money going to the nonprofits, and then uses a bunch of random magic to award the attorneys that $600+k. And, of course, Heartland also ended up paying its own lawyers a ton. In the end, this system involved Heartland paying many millions of dollars... to benefit a "class" of 11 people and giving them less than $2,000.

As Goldman notes, the whole thing seems bizarre:

Thus, it appears they spent over $130,000 to generate each legitimate claim. Surprisingly, the court blithely treats the $1.5M expenditure as a cost of doing business, but I can't wrap my head around it. What an obscene waste of money! Add in the $270k spent on claims administration, and it appears that the parties spent $160k per legitimate claimant. The court isn't bothered by the $270k expenses either, even though that cost about $1k per tendered claim (remember, there were 290 total claims).

Something is broken with the system.

Filed Under: broken, class action, lawyers, settlement
Companies: heartland payment systems

Company That Had The Largest Ever Credit Card Data Breach... Apparently Breached Again [Update]

from the hits-you-in-the-heartland dept

Remember Heartland Payment Systems? It's the giant credit card clearinghouse that was involved in the largest ever security breach in terms of the number of credit card numbers exposed. They were successfully targeted by the same guys who had also set the previous record for largest credit card data breach, so you could question whether the issue was just a sophisticated group of hackers or poor security at Heartland (or, possibly, a combination of both). Either way, it looks like Heartland may still have some issues. Carlo sends over the news that a new security breach has been discovered at a restaurant in Austin, Texas that appears to involve someone hacking into the network between the restaurant and Heartland. It's not yet clear if this goes beyond that one restaurant, but this can't look good for Heartland.

Update: Heartland got in touch to let us know that this appears to be an issue outside of Heartland's system, and that Heartland is not the target of the investigation into the breach. Heartland's press release is basically pointing out that the weakness was with the restaurant's credit card security, not its own.

Filed Under: breach, credit cards, security
Companies: heartland payment systems

The Story Behind The Hackers Behind The Largest Credit Card Number Heist

from the soon-to-be-a-movie? dept

A few years ago, the story broke about how TJX, the corporate parent of a series of retail stores, including TJ Maxx and Marshalls, had suffered a huge data breach, after some hackers had accessed its computer network via an insecure wireless connection at one of the stores. A year and a half later, we wrote about the arrests of some of those involved. The following year, we wrote about another hack, at Heartland Payment Systems, that had the potential to surpass the TJX hack as "the largest ever" in terms of the number of records accessed. It later came to light that both hacks were actually done by the same guys, supposedly led by Albert Gonzalez, a hacker who was actually on the government payroll at the time (after turning informant upon being caught a few years earlier standing in front of an ATM with a handful of fake ATM cards).

Back in March, Gonzalez received a twenty year sentence for the crime -- the longest sentence for "hacking"-related crime in the US. Others involved in the deal have been sentenced to shorter terms recently as well. Now, Danielle Alvarez, from the Miami New Times, points us to an article written by the paper that details the story behind the hacking, and the folks involved -- including the news (which I hadn't seen elsewhere in following this story -- Update: a few people have pointed to this story that Wired had last year, which I had not seen before) that one suspect end up killing himself after hearing of Gonzalez's arrest. It's a long story, but reads like something that will get turned into a movie at some point. Of course, the study plays down the security flaws at the companies, like TJX, which sent unencrypted credit card data over its network (a point Gonzalez's legal team tried to make in properly calculating how much "damage" he did). Still, it's a fascinating story about a group of young hackers, who wanted to "get rich or die trying," and how at least one of them succeeded at the latter.

Filed Under: credit cards, hacking
Companies: heartland payment systems, tjx

Looks Like The Guy Who Set The Record For Largest Credit Card Breach Was Breaking His Own Record

from the raising-the-bar dept

Back in January, we noted that it looked like there might be a new winner in the battle to see who was responsible for the largest ever credit card breach. Until that time, the honor had gone to a series of department stores owned by TJX (TJ Maxx, Marshalls, etc.). That involved info on 94 million credit card holders. Not bad. But the newer deal, involving Heartland Payment Systems appeared to effect well over 100 million. Now, you may have seen the news reports this week that have upped that total to 130 million, as part of the announcement of indictments against three individuals for illegally accessing the data. But, what's fascinating is that the one guy in custody, Albert Gonzalez, was already in custody for his role in the TJX hack (along with some other retailers). Oh, and there's also the tidbit about how he was a government informant, handing over info on (you guessed it) the underworld involved in stolen credit card numbers.

Filed Under: albert gonzalez, breach, credit cards
Companies: heartland payment systems, tjx

May Have A New Winner In The Largest Security Breach Ever Department

from the and-it-will-get-larger,-I'm-sure dept

In the past, we've joked about how with pretty much every security breach, there's an initial estimate of the damage done, followed much later by a second report that admits the breach impacted many more people. It happened with the VA. It happened with Choicepoint. And, it happened with TJX, who raised the bar on being the worst security breach ever not once, but twice to impact nearly 94 million people. Who could top that?

Step up to bat, Heartland Payment Systems. Chris writes in to point out that Heartland appears to have picked a pretty good day to announce a security breach that may impact over 100 million people. Everyone's off paying attention to the inauguration, so they might miss the news as it comes out today -- but they're likely to hear about it soon enough. It appears that Heartland's own computers were infected with malware which passed on information about transactions to some scammers.

Heartland is now claiming that this really isn't that big a deal, because personal information wasn't included in the breach -- meaning the data was useful for creating new cards with bogus data, but not useful for "card not present" transactions such as internet transactions or creating fake cards of real people. Because of this, Heartland doesn't think that it should need to offer credit monitoring services to impacted users, which has become the somewhat standard penance for those caught leaking credit card info.

Of course, some are already questioning the timing of announcing the breach. Considering they figured out what happened a week ago, it does seem a bit of interesting timing to wait until the inauguration was underway to disclose this information.

Still, given the history of so many earlier breaches turning out to be much worse later on, what's the over-under on the next announcement about how much worse this breach actually was?

Filed Under: credit cards, security breach
Companies: heartland payment systems