     Case: 12-20648   Document: 00512360374     Page: 1   Date Filed: 09/03/2013




        IN THE UNITED STATES COURT OF APPEALS
                 FOR THE FIFTH CIRCUIT  United States Court of Appeals
                                                 Fifth Circuit

                                                                  FILED
                                                             September 3, 2013

                                 No. 12-20648                   Lyle W. Cayce
                                                                     Clerk

LONE STAR NATIONAL BANK, N.A.; AMALGAMATED BANK; FIRST
BANKERS TRUST COMPANY, NATIONAL ASSOCIATION;
PENNSYLVANIA STATE EMPLOYEES CREDIT UNION; ELEVATIONS
CREDIT UNION; O BEE CREDIT UNION; SEABOARD FEDERAL CREDIT
UNION

                                           Plaintiffs – Appellants
v.

HEARTLAND PAYMENT SYSTEMS, INC.,

                                           Defendant – Appellee



                Appeal from the United States District Court
                     for the Southern District of Texas


Before SMITH, GARZA, and SOUTHWICK, Circuit Judges.
EMILIO M. GARZA, Circuit Judge:
      This case arises out of a group of hackers’ breach of Heartland Payment
Systems, Inc.’s (“Heartland’s”) data systems, compromising confidential
information belonging to customers of the plaintiff banks (together, the “Issuer
Banks”). The district court dismissed the Issuer Banks’ claims. The Issuer
Banks appeal only the dismissal of their negligence claim. We REVERSE and
REMAND for proceedings consistent with this opinion.
    Case: 12-20648     Document: 00512360374    Page: 2   Date Filed: 09/03/2013




                                 No. 12-20648

                                       I
      The Issuer Banks have contracts with Visa and MasterCard that allow
them to issue payment cards, including both credit and debit cards, to their
customers. When a customer uses one of these cards at a merchant, the card
information is first sent to a bank with whom the merchant contracts, known as
the “acquirer bank.”    The acquirer bank then sends the information to a
processor, such as Heartland, and the processor sends the information to the
issuer bank that issued the card. The approval or disapproval of use of the card
is then transmitted back to the merchant through this chain.
      Two acquirer banks, KeyBank and Heartland Bank (together, the
“Acquirer Banks”), are members of the Visa and MasterCard networks.
Heartland contracted with the Acquirer Banks to process their transactions.
These contracts required Heartland to comply with the Visa and MasterCard
regulations, which contain mechanisms for Visa and MasterCard network
members to recoup losses in the event of a data breach.
      Such a data breach occurred when hackers infiltrated Heartland’s data
systems and stole payment card information. As a result, the Issuer Banks
allege they incurred costs associated with replacing the compromised cards and
reimbursing customers for fraudulent charges. Lacking a written contract with
Heartland, the Issuer Banks asserted various claims, including negligence and
contract claims as third party beneficiaries of Heartland’s contracts with other
entities.
      As to the negligence claim, the parties disputed whether Texas or New
Jersey law governs. They agreed the economic loss doctrine under Texas law
would bar the Issuer Banks’ negligence claim, but disputed the applicability of


                                       2
    Case: 12-20648     Document: 00512360374      Page: 3   Date Filed: 09/03/2013




                                  No. 12-20648

the economic loss doctrine under New Jersey law. The district court dismissed
all the Issuer Banks’ claims, holding that even under New Jersey law, the
economic loss doctrine would bar the Issuer Banks’ negligence claim. The
district court reasoned that by entering into the web of contractual relationships
established by Visa and MasterCard, the Issuer Banks contracted for the specific
remedies afforded by the Visa and MasterCard regulations and thus could not
bring common law tort claims against another participant in the same web.
      The Issuer Banks timely appealed the district court’s dismissal of their
negligence claim against Heartland.
                                        II
      We review motions to dismiss under Federal Rule of Civil Procedure
12(b)(6) de novo, “accepting all well-pleaded facts as true and viewing those facts
in the light most favorable to the plaintiff.” Highland Capital Mgmt., L.P. v.
Bank of Am., Nat’l Ass’n, 698 F.3d 202, 205 (5th Cir. 2012) (quoting Bustos v.
Martini Club Inc., 599 F.3d 458, 461 (5th Cir. 2010)). The well-pleaded facts
must state a claim that is plausible on its face, and “[a] claim has facial
plausibility when the plaintiff pleads factual content that allows the court to
draw the reasonable inference that the defendant is liable for the misconduct
alleged.” Id. at 205 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)).
      The Issuer Banks assert that under New Jersey law, the economic loss
doctrine does not bar their negligence claim. We agree. The economic loss
doctrine generally limits a plaintiff seeking to recover purely economic losses,
such as lost profits, to contractual remedies. See generally Spring Motors
Distribs., Inc. v. Ford Motor Co., 489 A.2d 660, 671–72 (N.J. 1985). The New
Jersey Supreme Court explained:


                                        3
    Case: 12-20648      Document: 00512360374        Page: 4    Date Filed: 09/03/2013




                                    No. 12-20648

      Generally speaking, tort principles, such as negligence, are better
      suited for resolving claims involving unanticipated physical injury,
      particularly those arising out of an accident. Contract principles, on
      the other hand, are generally more appropriate for determining
      claims for consequential damage that the parties have, or could
      have, addressed in their agreement.
Id. at 672. The Court reasoned that “[a]s between commercial parties, . . . the
allocation of risks in accordance with their agreement better serves the public
interest than an allocation achieved as a matter of policy without reference to
that agreement.” Id. at 671.
      Nevertheless, the Court held the economic loss doctrine does not bar tort
recovery in every case where the plaintiff suffers economic harm without any
attendant physical harm in People Express Airlines, Inc. v. Consolidated Rail
Corp., 495 A.2d 107 (N.J. 1985). There, a fire at a railroad freight yard resulted
in the evacuation of an adjacent terminal at Newark International Airport. Id.
at 108. Employees of the plaintiff, an airline based in the evacuated terminal,
could not return to the terminal for twelve hours, causing the plaintiff to suffer
economic losses as a result of canceled flights and lost reservations. Id. The
plaintiff sued the railroad defendant for negligence, among other causes of
action.   Id. at 109.    After a survey of the economic loss doctrine and its
exceptions, the Court articulated how the doctrine operates in New Jersey:
             We hold therefore that a defendant owes a duty of care to take
      reasonable measures to avoid the risk of causing economic damages,
      aside from physical injury, to particular plaintiffs or plaintiffs
      comprising an identifiable class with respect to whom defendant
      knows or has reason to know are likely to suffer such damages from
      its conduct. . . .
             We stress that an identifiable class of plaintiffs is not simply
      a foreseeable class of plaintiffs. . . . An identifiable class of plaintiffs

                                           4
    Case: 12-20648       Document: 00512360374    Page: 5     Date Filed: 09/03/2013




                                   No. 12-20648

      must be particularly foreseeable in terms of the type of persons or
      entities comprising the class, the certainty or predictability of their
      presence, the approximate numbers of those in the class, as well as
      the type of economic expectations disrupted.
            We recognize that some cases will present circumstances that
      defy the categorization here devised to circumscribe a defendant’s
      orbit of duty, limit otherwise boundless liability and define an
      identifiable class of plaintiffs that may recover. In these cases, the
      courts will be required to draw upon notions of fairness, common
      sense and morality to fix the line limiting liability as a matter of
      public policy, rather than an uncritical application of the principle
      of particular foreseeability.
Id. at 116 (internal citations omitted). Accordingly, under New Jersey law, the
economic loss doctrine does not bar tort recovery where the defendant causes an
identifiable class of plaintiffs to which it owes a duty of care to suffer economic
loss that does not result in boundless liability. Id.
      The parties rely heavily on two federal cases interpreting the economic loss
doctrine under New Jersey law. In the first, Dynalectric Co. v. Westinghouse
Electric   Corp.,    a    contractor,   Westinghouse        Electric   Corporation
(“Westinghouse”), sub-contracted work to Dick Corporation (“Dick”) and Davy
McKee Corporation (“Davy”). 803 F. Supp. 985, 986–87 (D.N.J. 1992). Dick then
sub-subcontracted work to Dynalectric Corporation (“Dynalectric”). Id. at 987.
Westinghouse and Dick’s contract contained an arbitration clause and a
procedure for filing claims. Id. Dick and Dynalectric’s contract incorporated the
terms of Dick’s contract with Westinghouse, expressly giving Dynalectric all
remedies afforded to Dick by that contract and requiring Dick to submit to
Westinghouse any of Dynalectric’s claims. Id. Dynalectric suffered economic
loss due to actions of Westinghouse and Davy. Id. at 987. Dick filed a demand



                                         5
    Case: 12-20648     Document: 00512360374    Page: 6   Date Filed: 09/03/2013




                                 No. 12-20648

for arbitration, incorporating Dynalectric’s claims. Id. at 988. Separately,
Dynalectric sued Westinghouse and Davy for negligence. Id.
      The Dynalectric court interpreted People Express as allowing tort recovery
for economic losses only when the plaintiff lacks another remedy. Id. at 991
(“[W]hen a party has suffered economic loss because of the negligent actions of
another, and the party has another means of redress against the alleged
tortfeasor, that party may not assert the identical claims for identical damages
under tort theories.”). Dynalectric relied on the principle articulated in People
Express that “one objective of tort law is to ensure that innocent victims have
avenues of legal redress, absent a contrary, overriding public policy.” Id.
(quoting People Express, 495 A.2d at 111). Despite the lack of a contract between
Dynalectric and either of the defendants, the court found Dynalectric had
another means of redress by way of the arbitration proceedings. Id. at 992.
Accordingly, the court held the negligence claims were barred by the economic
loss doctrine. Id. at 993.
      In the other federal case the parties rely on, Consult Urban Renewal
Development Corp. v. T.R. Arnold & Associates, Inc., a developer contracted with
a manufacturer to buy housing units. 2009 WL 1969083, at *1 (D.N.J. July 1,
2009). The manufacturer had a contract with an inspection company to abide
by New Jersey law requiring inspection and certification. Id. The housing units
were defective, and the developer brought a negligence claim against the
inspector. Id. The court held the economic loss doctrine was inapplicable
“because the rule typically applies to the sale of goods, not the provision of
services.” Id. at *4. The court further reasoned that the policy rationale behind
the doctrine is that contract law is better suited for certain claims because


                                       6
      Case: 12-20648    Document: 00512360374      Page: 7   Date Filed: 09/03/2013




                                   No. 12-20648

parties can negotiate the allocation of risk, but the builder was at most a third-
party beneficiary to the contract between the manufacturer and the inspector,
so it did not have an opportunity to negotiate the terms of that agreement. Id.
The court held the inspector owed a duty to the builder under New Jersey law
governing the liability of professionals to third parties who rely on their services.
Id.
       Lastly, we note the Third Circuit, predicting how the New Jersey Supreme
Court would address the case before it, held the economic loss doctrine prevented
a commercial buyer from bringing a products liability claim against a
commercial seller. Travelers Indem. Co. v. Dammann & Co., 594 F.3d 238, 248
(3d Cir. 2010). The Third Circuit applied the economic loss doctrine even though
New Jersey statutory law allows product liability claims where the product
causes physical damage to property other than the product itself, and the
product in that case caused such damage. Id. at 247–48. The Third Circuit
explained that “New Jersey courts have consistently held that contract law is
better suited to resolve disputes between parties where a plaintiff alleges direct
and consequential losses that were within the contemplation of sophisticated
business entities with equal bargaining power and that could have been the
subject of their negotiations.” Id. at 248. Because the commercial parties had
equal bargaining power in conducting the sale, the court held the economic loss
doctrine applied. Id.
       Turning to the case sub judice, we hold the economic loss doctrine under
New Jersey law does not preclude the Issuer Banks’ negligence claim against
Heartland at the motion to dismiss stage. First, the Issuer Banks constitute an
“identifiable class” as contemplated by People Express.          495 A.2d at 116.


                                         7
    Case: 12-20648     Document: 00512360374     Page: 8   Date Filed: 09/03/2013




                                  No. 12-20648

Heartland had reason to foresee the Issuer Banks would be the entities to suffer
economic losses were Heartland negligent. See id. The identities, nature, and
number of the victims are easily foreseeable, as the Issuer Banks are the very
entities to which Heartland sends payment card information.               See id.
Furthermore, Heartland would not be exposed to “boundless liability,” but rather
to the reasonable amount of loss from a limited number of entities.            Id.
Accordingly, even absent physical harm, Heartland may owe the Issuer Banks
a duty of care and may be liable for their purely economic losses. See id.; Carter
Lincoln-Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 638 A.2d 1288, 1294
(N.J. 1994) (holding economic loss doctrine no bar to tort claim regardless of
physical harm “if the plaintiff was a member of an identifiable class that the
defendant should have reasonably foreseen was likely to be injured by the
defendant’s conduct” (citing People Express, 495 A.2d at 116)).
      Second, viewing the pleadings in the light most favorable to the Issuer
Banks, in the absence of a tort remedy, the Issuer Banks would be left with no
remedy for Heartland’s alleged negligence, defying “notions of fairness, common
sense and morality.” People Express, 495 A.2d at 116; see Carter Lincoln-
Mercury, 638 A.2d at 1294 (“Once the foreseeability of an injured party is
established, we must decide whether considerations of fairness and policy
warrant the imposition of a duty.”). Unlike the contracts in Dynalectric, 803 F.
Supp. at 987, it is not clear whether Heartland’s contracts with the Acquirer
Banks, which require Heartland to comply with Visa and MasterCard rules and
regulations, provide the Issuer Banks with compensation mechanisms for losses
that may be caused by Heartland’s negligence. Though Visa and MasterCard
investigated Heartland’s data breach and directed its members to avoid using


                                        8
    Case: 12-20648      Document: 00512360374       Page: 9    Date Filed: 09/03/2013




                                    No. 12-20648

Heartland’s services for a period of time, it is not clear that Heartland can take
part in the dispute-resolution mechanisms solely by virtue of agreeing with the
Acquirer Banks to be bound by the regulations.
      Further, it is unclear whether Heartland has contracts with Visa and
MasterCard, let alone what the contents of such contracts may be. Though the
district court permitted some discovery on the existence of these contracts at the
motion to dismiss stage, the results were inconclusive and thus do not aid our
inquiry. This uncertainty in the record leaves open the issue of the Issuer
Banks’ bargaining power with respect to Heartland’s participation in the Visa
and MasterCard networks. See Consult Urban, 2009 WL 1969083 at *4. While
it seems the Issuer Banks’ remedies vis-à-vis the Acquiring Banks under the
regulations are clear because both the Issuer Banks and the Acquirer Banks are
members of the Visa and MasterCard networks, any contractual remedies the
Issuer Banks have to recoup losses caused by Heartland are not evident. As
such, it is not clear that the allocation of risk “could have been the subject of . . .
negotiations” between the Issuer Banks and Heartland by way of contracts with
Visa and MasterCard. Travelers Indem., 594 F.3d at 248.
      Mindful that “[t]he New Jersey Supreme Court has long been a leader in
expanding tort liability,” Hakimoglu v. Trump Taj Mahal Assocs., 70 F.3d 291,
295 (3d Cir. 1995) (Becker, J., dissenting), and in light of the lack of a developed
record illuminating any contractual remedies available to the Issuer Banks, we
hold, under the alleged facts of this case, the economic loss doctrine does not bar
the Issuer Banks’ negligence claim at this stage of the litigation.




                                          9
    Case: 12-20648    Document: 00512360374       Page: 10   Date Filed: 09/03/2013




                                  No. 12-20648

                                        III
      Heartland asserts that even if it owes the Issuer Banks a duty of care
under People Express and the economic loss doctrine does not bar the Issuer
Banks’ negligence claim at this stage of the litigation, we should affirm the
district court on any of four grounds: (1) the Issuer Banks are bound by the
allegation in their complaint that Heartland has contracts with Visa and
MasterCard, so they should be limited to the contractual remedies available
through the Visa and MasterCard networks; (2) Texas law, not New Jersey law,
is controlling; (3) the Issuer Banks fail to state a claim under Federal Rule of
Civil Procedure 8(a); and (4) some of the Issuer Banks are collaterally estopped
from pursuing this negligence claim because the district court’s disposition of
their separate claim against the Acquirer Banks involved the same issue.
Though “[w]e are free to uphold the district court’s judgment on any basis that
is supported by the record,” Zuspann v. Brown, 60 F.3d 1156, 1160 (5th Cir.
1995), we decline to decide these complex issues as they are better addressed by
the district court in the first instance. See U.S. ex rel. Branch Consultants v.
Allstate Ins. Co., 560 F.3d 371, 381 (5th Cir. 2009) (remanding so district court
can consider issues in first instance) (citing Breaux v. Dilsaver, 254 F.3d 533, 538
(5th Cir. 2001) (“Although this court may decide a case on any ground that was
presented to the trial court, we are not required to do so.”)).
                                        IV
      For these reasons, we REVERSE and REMAND for proceedings consistent
with this opinion.




                                        10
