Hudson’s Bay Company Financial Institution Data Breach Settlement

If your financial institution issued one or more payment cards identified as having been at risk as a result of the data security incident that Hudson’s Bay Company announced in 2018, it could get a payment from a class action settlement.

More Information

Frequently Asked Questions

Learn How This Settlement Affects Your Financial Institution’s Rights and Get Answers to Questions About the Settlement

More Information

Important Deadlines

Important Settlement Deadlines That Will Affect Your Financial Institution’s Rights

More Information

Court Documents

UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF NEW YORK

If your financial institution issued one or more payment cards identified as having been at risk as a result of the data breach that Hudson’s Bay Company announced in 2018, it could get a payment from a class action settlement.

  • A Settlement has been proposed to resolve a lawsuit against Defendants Hudson’s Bay Company ULC (formerly known as Hudson’s Bay Company), Saks Fifth Avenue LLC, Saks & Company LLC, Saks Incorporated, and Lord &Taylor, LLC (collectively, “Hudson’s Bay” or “Defendants”) brought by a putative class of financial institutions as a result of a third-party criminal cyberattack on Defendants’ stores, which was announced in 2018 and affected millions of payment cards (the “Data Security Incident”).
  • The lawsuit, Arkansas Federal Credit Union and Summit Federal Credit Union v. Hudson’s Bay Company, et al., No. 19-cv-4492 (PKC) (S.D.N.Y.), asserts claims on behalf of a class of financial institutions related to the Data Security Incident and Hudson’s Bay’s data security practices. These claims include alleged negligence, negligence per se, violations of California and New York unfair and deceptive trade practices statutes, unjust enrichment and seek injunctive and declaratory relief. Hudson’s Bay denies these allegations, any wrongdoing, and that it is liable in any amount to the financial institutions.
  • Under the Settlement, two types of claims may be made: “Fixed Payment Claims” and “Documented Out-of-Pocket Claims.” A Settlement Class Member may make one or both types of claims. Hudson’s Bay will pay, on a claims-made basis, up to a maximum aggregate amount of $3 million to the Settlement Class Members who submit approved Fixed Payment Claims and $1 million to the Settlement Class Members who submit approved Documented Out-of-Pocket Claims (subject to a pro rata reduction, if necessary).
  • In addition, Hudson’s Bay has agreed to adopt and/or maintain certain practices related to its data security. If approved by the Court, Hudson’s Bay also will pay Class Counsel’s reasonable attorneys’ fees and expenses, service awards up to $3,000 to each Settlement Class Representative, and notice and settlement administration costs in an amount not to exceed $1.1 million.

SUBMIT A CLAIM FORM

If eligible, your financial institution will receive a cash payment. This is the only way to get compensation from the Settlement

EXCLUDE YOUR FINANCIAL INSTITUTION

If you ask to be excluded, you will not receive a cash payment, but you may be able to file your own lawsuit against Hudson’s Bay for the same claims. This is the only option that leaves your financial institution the right to file its own lawsuit against Hudson’s Bay and/or Defendants’ Released Persons (defined in the Settlement Agreement) for the claims that are being resolved by the Settlement. In order to be effective, a request to be excluded from the Settlement must include all information required by the Settlement.

OBJECT

Your financial institution can remain in the Settlement Class and file an objection telling the Court why you do not like the Settlement. If your objections are overruled, your financial institution will be bound by the Settlement.

DO NOTHING

If you do nothing, you will not receive any cash payment. If you do nothing, you will also forfeit your right to sue or bring any claim against Hudson’s Bay and/or Defendants’ Released Persons related to the Data Security Incident.