The 28,000-member, $211 million Alabama State Employees Credit Union alleges retailer Targetwas not compliant with card industry data security standards duringa major incursion in November and December that led to the theft ofdata from millions of credit and debit cards. ASECU made the claimin court as the first financial institution to file suit to recoupits losses from the card data breach.

“Among other things, merchants are prohibited from storingunprotected cardholder information,” the credit union observed inits class-action complaint. “The stolen data includes among otherthings, customer names, credit and debit card numbers, cardexpiration dates and the three-digit security codes located on thebacks of cards. There is no legitimate reason for Target to keepall of this information stored electronically.”

Target acknowledged on Dec, 19 all of its stores had been hit inthe breach and that data from roughly 40 million credit and debitcard accounts had been compromised.

There have been no estimates yet of industry-wide losses fromthe breach yet and the credit union also refrained from using manyhard numbers.

“Plaintiff has lost significantly in refunding the unauthorizeduse and access of its customers and members accounts due toTarget's data breach,” the credit union said. “The cost inrefunding loss deposits, time, and resources spent to remedy thesituation of Plaintiff's customers and members are untold.”

Calls to the credit union's law firm have not yet been returned.Target said it does not comment on pending litigation and theretailer has not yet filed a response to the credit union'scomplaint.