Banks Saddled with Costs to Replace Cards Compromised by Security Breach

The multi-million dollar tab for replacing credit and debit cards that were compromised by the security breach at the Hannaford Bros. Co. will likely be borne by banks and credit unions that issued the cards.

The Scarborough, Maine-based supermarket chain said it has fulfilled its responsibility by identifying and fixing the breach and notifying customers, credit card companies and the financial institutions.

“The banks and the credit card companies are the ones that manage the card usage,” Hannaford spokeswoman Carol Eleazer said. “We work with them cooperatively but we don’t make any calls or participate in any other way” in deciding how to deal with compromised cards.

The data breach affected up to 4.2 million cards used at Hannaford stores in the Northeast and the company’s Sweetbay stores in Florida. Most financial institutions are reissuing cards with new numbers to the affected customers.

“The cost of reissuing cards, both debit and credit, are at the expense of the financial institution,” said Chris Daudelin, president of South Portland-based Town & Country Federal Credit Union.

Town & Country expects to issue about 14,000 new cards at a cost of at lease $140,000. That amounts to roughly $10 to $12 per card, which includes administrative time, mailings to customers and the cards themselves.

Most financial institutions have insurance to cover such costs, Daudelin said, but the deductibles are so high that it rarely kicks in except for a major incident. He said he’s not sure whether insurance will cover any of Town & Country’s costs from the Hannaford breach.

Consumers recognize that they will not be held responsible for fraudulent charges on their cards and are generally calm about the situation, said Joseph Murphy, president of Bar Harbor Bank & Trust and chairman of the Maine Bankers Association.

Bar Harbor Bank estimates that 5,000 to 6,000 card numbers held by its customers might have been stolen, Murphy said, but only about a dozen asked for the cards to be canceled immediately, instead of waiting for the bank to send new ones.

The bank’s upfront costs, not counting administrative and clerical time, should total about $25,000.

“We don’t expect to recoup any of that. We resent it,” said Murphy.

But Murphy saw little to gain from a lawsuit or a lot of finger-pointing. “If financial institutions start suing over these things, it’s going to be a mess,” he said. “There’s nothing to be gained from cross-litigating each other.”

___

Information from: Portland Press Herald,
http://www.pressherald.com