Wendy’s suffered a data breach in the fall of 2015 that it recently reported affected one particular point of sale system at fewer than 300 restaurants. Wendy’s has already been sued as a result of the incident, including a putative class action filed in the Western District of Pennsylvania by First Choice Federal Credit Union.

First Choice, a payment card issuer that had issued cards allegedly compromised in the breach, seeks to recover the costs it claims to have incurred in canceling and reissuing compromised cards and in reimbursing fraudulent charges.

First Choice alleges that the credit card data at issue was exposed from a period beginning on October 22, 2015 and ending on March 10, 2016. First Choice alleges that Wendy’s “systematically failed to comply with industry standards and protect payment card and customer data.”

If you read my E-Alert titled “If Your Business Takes Credit Cards, Are You Ready for October 1, 2015?“, you may predict where this is going. First Choice contends that Wendy’s missed the “deadline of October 1, 2015 for businesses to transition their systems from magnetic-stripe to EMV technology.” Thus, First Choice argues that Wendy’s “failure to transition to the use of EMV technology” constituted negligence.

It will be interesting to monitor this case and see how the argument fares. It may not be well-received, given that the payment card industry did not mandate the use of EMV technology but instead set a deadline for a liability shift. Another interesting factor that will likely come into play is the widely-reported EMV certification backlog that is holding up use of the technology.