Barger v. First Data Corporation et al

On December 14, 2018, plaintiff Jamey Barger, on behalf of a class of merchants, filed a lawsuit against First Data Corporation in the U.S. District Court for the Eastern District of New York. The complaint alleged that First Data failed to secure its payment processing systems against a cyberattack, resulting in the theft of customers' credit and debit card data. Merchants who used First Data's services suffered financial losses from chargebacks, card reissuance costs, and lost business. The lawsuit claimed negligence, breach of contract, and violation of state consumer protection laws. After years of litigation, the parties reached a settlement, with First Data agreeing to establish a $35 million fund to compensate affected merchants.

The case was settled in 2021. First Data agreed to pay $35 million into a settlement fund for class members without admitting liability, and the court granted final approval of the settlement.

The central dispute was whether First Data breached its contractual and common law duties to implement reasonable data security measures and adequately warn merchants about the intrusion, causing them direct financial harm.

The settlement underscored the legal responsibilities of payment processors to safeguard sensitive financial data. It prompted many companies to strengthen cybersecurity protocols and review third-party vendor contracts, influencing industry standards for data breach notification and merchant protection.