Schnucks removes suit over security breach to federal court

A St. Clair County class action lawsuit over a security breach to Schnuck Markets’ electronic payment systems has been removed to federal court.

Schnucks late last week filed a notice to remove the suit that Laverne Rippy brought April 25 in St. Clair County Circuit Court to the U.S. District Court for the Southern District of Illinois.

The grocery store chain asserts that the federal court has jurisdiction over the suit because diversity of citizenship between the parties exists, the amount in controversy is more than $5 million and the proposed class exceeds 100 members.

Rippy’s lawsuit stems from a well-publicized security breach that may have compromised the credit and debit card information of millions of Schnucks’ customers between December 2012 and March 2013.

In a timeline previously released to the media, Schnucks said it found out about the issue on March 15, formed a response team on March 19, contacted police on March 20, and began to identify the problem on March 28. It communicated its concerns to the public on March 30.

The grocery store chain has said that only card numbers and expiration dates were stolen, not cardholders’ names, addresses or anything else.

Rippy claims in her suit that the breach not only compromised her information, but also forced her and other members of the proposed class to spend hours canceling their compromised cards, activating replacement cards and re-establishing automatic withdrawal payment authorizations.

The suit, which seeks damages under the Illinois Consumer Fraud and Deceptive Business Practices Act, alleges that Schnucks failed to timely disclose the security breach to its customers, a violation of the Illinois Personal Information Protection Act.

Rippy’s suit proposed a class that would include Illinois plaintiffs who shopped at Schnucks’ Illinois locations five years preceding the data breach.

In the removal notice it filed last week, Schnucks asserts that the federal court has jurisdiction over the suit because diversity of citizenship exists between the parties as it is a Missouri corporation and Rippy is an Illinois resident.

Schnucks also states in its notice that the suit meets the other requirements for removal under the Class Action Fairness Act in that the size of the proposed class is more than 100 members and the amount in controversy exceeds $5 million.

“Schnucks has determined that criminals hacked into its electronic payment systems at 23 stores located in Illinois,” the removal notice states. “Schnucks has further determined that approximately 1,600,000 credit or debit card transactions took place at these Illinois stores during the relevant period.”

An analysis of these transactions, the notice states, showed that about 500,000 unique credit and debit cards were used during the relevant time period and as such, “based on plaintiff’s allegations, the proposed putative class has at least 500,000 members.”

In regards to the amount in controversy, Schnucks asserts that the “Plaintiff and the putative class member’s potential ‘time and effort’ damages alone satisfy the $5 million amount in controversy requirement.”

Belleville attorney Russell K. Scott represents Schnucks and submitted the removal notice on its behalf.

St. Louis attorney Jeffrey A. Millar represents Rippy and the proposed class. Millar on Monday filed a motion for leave to file a first amended complaint and a request for admissions.