Customers of Michaels say in a federal class action that their bank accounts were looted because the crafts retailer failed to safeguard against card skimming and then failed to give its customers timely notice.
In the suit filed in U.S. District Court in Chicago, Brandi F. Ramundo of West Chicago, Ill., charges that Michaels knowingly violated federal and state law by failing to take reasonable steps to safeguard its customers' personal financial data, including credit and debit card numbers and PINs.
“In essence, Michaels' security failure enabled cyber-pickpockets to steal customer financial data from within the retailer's stores and subsequently loot the customers' bank accounts from remote [ATMs],” the suit alleges.
The data thefts occurred between February 8 and May 6 and affected customers who shopped at 80 Michaels stores but the company did not alert any of its customers to the problem until May 5, when it sent an email alert saying Michaels “may have been” a victim of PIN-pad tampering and that some customer data “may have been” compromised, the suit charges.
The email alert advised customers to contact their banks and credit card companies and to seek advice on how to protect their account.
“Based on the email Alert, Michaels apparently expects its victimized consumers to bear the fallout form its security breach, thereby thrusting upon the consumers a continuous burden of monitoring their bank accounts and credit histories,” the suit charges.
Further, the suit alleges that Michaels failed to send the email alert to all of its customers, including Ramundo.
Ramundo says she used her Fifth Third Bank debit card to buy $19.35 worth of merchandise from a Michaels store on April 18. On May 3, her card when rejected when she tried to use it at a Costco store.
Ramundo telephone the bank and was told that the card had been suspended because of “suspicious activity,” specifically three withdrawls from the account to which the card was linked.
The first withdrawal, for $303, occurred on May 2 at an ATM in Los Angeles, the second, for $503 at an ATM in Woodland Hills, Calif., and the third from another ATM in Los Angeles for $503.
Ramundo contacted her local police precinct and learned that numerous other Michaels customers had filed similar complaints.
The class action seeks to represent all U.S. Residents who made an in-store purchase at Michaels and used a debit or credit card that was swiped through a PIN pad.
The suit accuses Michaels of negligence, violation of the Federal Stored Communications Act, the Illinois Consumer Fraud and Deceptive Practices Act and breach of contract.