In a case of first impression under New York Law, Golenbock Eiseman Assor Bell & Peskoe LLP secured a court victory in Jetro Holdings, LLC v. MasterCard International, Inc. With GEAB&P representing MasterCard International Incorporated (“MasterCard”), Justice Alan D. Scheinkman of the Supreme Court, Westchester County, dismissed in its entirety the ten-count complaint, holding that Jetro Holdings, LLC (“Jetro”), a wholesale restaurant and grocery supplier that was hacked twice in two years, did not have standing under the doctrine of equitable subrogation to sue MasterCard to recover certain monetary assessments that MasterCard imposed on Jetro’s acquiring bank, PNC Bank, pursuant to a MasterCard-PNC Bank contract (to which Jetro was not a party), and which PNC Bank then collected from Jetro pursuant to a PNC Bank-Jetro contract (to which MasterCard was not a party).
Background
MasterCard imposed the assessments on PNC Bank as a result of two payment card data breaches in 2011 and 2012 at PNC Bank’s merchant, Jetro. Under the MasterCard-PNC Bank contract, PNC Bank—as the bank that agreed to acquire MasterCard payment card purchases made at Jetro—was responsible to MasterCard for amounts used to partially reimburse the banks that issued the payment cards that were put at risk by the Jetro data breaches for fraud losses and operational losses (e.g., reissuing cards, extra monitoring of accounts, etc. to prevent or mitigate fraud). The assessments amounted to approximately $7 million for the two breaches.
PNC Bank, in turn, had a contract with Jetro, in which Jetro agreed to reimburse PNC Bank for any card brand assessments. After PNC Bank collected the amount of the assessments from Jetro, Jetro sued MasterCard, but not PNC Bank, claiming that MasterCard’s imposition of the assessments violated the MasterCard-PNC Bank contract (because, among other reasons, the assessments constituted unenforceable “penalties”). Although Jetro was not a party to the MasterCard-PNC Bank contract, Jetro argued that, because it ultimately was on the hook for the assessments, it should be able to “stand in the shoes” of PNC Bank and sue MasterCard under the doctrine of “equitable subrogation.”
Equitable Subrogation
The Court held that “equitable subrogation is a feature of insurance law; when an insurer pays for losses by its insured that were occasioned by a wrongdoer, the insurer is entitled to seek recovery from the wrongdoer for the monies the insurer expended.” “The equitable principle is that an insurer who has been compelled under its policy to pay a loss ought in fairness to be reimbursed by the party which caused the loss.”
The doctrine is premised on two related concepts:
First, that the party who causes injury or damage should be required to bear the loss by reimbursing the insurer for payments made on behalf of the injured party. Second, that the injured party should not recover twice for the same harm—once from its insurer and again from the wrongdoer.
The Decision
The Court held that, although, in the Appellate Division, Second Department, the doctrine of equitable subrogation is not limited to insurers, the doctrine did not give Jetro standing against MasterCard.
The Court held that the debt in question—namely, liability for the losses caused by the cyber criminals’ theft of account data and related assessments—was not a debt for which MasterCard “was primarily answerable or that equity and good conscience require that MasterCard discharge.” The wrongdoers were the cyber criminals. MasterCard simply bargained with PNC Bank to impose certain assessments on PNC Bank. PNC Bank, in turn, bargained with Jetro for the right to pass the assessments on to Jetro, and there was no limitation in the PNC Bank-Jetro contract conditioning Jetro’s indemnity obligation on a determination that the assessments were valid as between MasterCard and PNC Bank. The Court held that since Jetro was in the best position to prevent the underlying loss by safeguarding its computer system, the chain of contracts that placed the risk of loss on Jetro was “not unreasonable, unfair, or inequitable.” Jetro would have a claim in equitable subrogation against the cyber criminals, but not against MasterCard.
Conclusion
Although, at least in the Second Department, the doctrine of equitable subrogation is not limited to the insurance context, the Jetro decision recognized certain limits on its application in the commercial chain-of- contracts scenario. It is not sufficient that the plaintiff was compelled by contract to reimburse the alleged “middleman” for payments that the middleman made to the party at the top of the chain. If a party faces equitable subrogation claims outside the insurance context, it should analyze whether: (i) it caused the loss that triggered the recoupment provisions in the chain of contracts or whether the loss was caused by some wrongdoer outside the contractual chain (e.g., the cyber criminals in this case); (ii) whether the plaintiff expressly agreed to assume the risk without regard to whether the enforcement of the recoupment provision at the top of the chain was valid or not; and (iii) whether the plaintiff was in a position to prevent or mitigate the loss.
For further information on this topic or for a copy of the decision, please contact:
Martin S. Hyman
(212) 907-7360
mhyman@golenbock.com
Matthew C. Daly
(212) 907-7329
mdaly@golenbock.com