In its September 3, 2013 opinion in Lone Star National Bank v. Heartland Payment Systems, Inc., the US Court of Appeals for the Fifth Circuit held that the economic loss doctrine does not necessarily bar a negligence claim under New Jersey law.

In Lone Star, a group of data hackers infiltrated Heartland Payment Systems, Inc.'s data systems and stole confidential information belonging to customers of the plaintiff banks. The plaintiff banks used Heartland to process customer information in furtherance of some of the banks' contracts with Visa and MasterCard. Heartland sent and received credit card customers' information to the plaintiff banks as part of the banks' approval or disapproval of the use of the card. As a result of the data breach, the plaintiff banks alleged that they incurred costs resulting from replacing the compromised cards and reimbursing customers for fraudulent charges. Because some of plaintiff banks lacked a written contract directly with Heartland, those banks asserted, among others, a negligence claim against Heartland.

The case turned on the applicability of the economic loss doctrine, which generally limits a plaintiff seeking to recover purely economic losses, such as lost profits, to contractual remedies.

The district court dismissed the negligence claim, finding that it was barred by the economic loss doctrine under New Jersey law. The district court reasoned that because the plaintiff banks had a contractual relationship with Visa and MasterCard, they could not bring common law tort claims, such as negligence, against Heartland. Instead, the plaintiff banks were limited to the specific remedies afforded by the Visa and MasterCard relationship. The plaintiff banks timely appealed the dismissal of the negligence claim.

On appeal, the Fifth Circuit reversed and remanded. The Fifth Circuit relied on New Jersey precedent to find that the economic loss doctrine does not bar tort recovery where the defendant causes economic loss to an identifiable class of plaintiffs to which it owes a duty of care, and where the defendant is not exposed to boundless liability. The court found that the plaintiff banks constituted an identifiable class because it was foreseeable that they would suffer economic loss from Heartland's alleged negligence. As a result, Heartland may have owed the banks a duty of care and could be liable for their purely economic losses. Heartland also was not exposed to boundless liability but rather to liability for the reasonable losses off a limited number of entities. Further, the court found that dismissal would be unfair because, in the absence of a tort remedy, some of the plaintiff banks would have no recourse for Heartland's alleged negligence. Because the case was only at the motion to dismiss stage, it was unclear whether Heartland even had contracts with Visa and MasterCard or some of the banks. Therefore it was not evident that the plaintiff banks asserting the negligence claim would have any contractual remedies to recoup their losses.