The Target data breach will not be claiming security vendor Trustwave as one of its victims after all.
On March 24, a class-action lawsuit was filed in the U.S. District Court, Northern District of Illinois by Trustmark National Bank and Green Bank naming Trustwave alongside retailer Target in their complaint. The legal action against Target and Trustwave has now been dropped by both banks.
Target was the victim of a large data breach that was first disclosed on Dec. 19, 2013, leaving as many as 110 million customers at potential risk. The class-action lawsuit by Trustmark National Bank and Green Bank had named Trustwave on the belief that the security vendor was directly involved in the security operations of Target and was somewhat responsible for not adequately protecting the retailer.
The original legal complaint alleged, “Target outsourced its data security obligations to Trustwave, which failed to bring Target’s systems up to industry standards.” The complaint also alleged that on Sept. 20, 2013, Trustwave scanned the Target network and at the time told Target that there were no vulnerabilities in Target’s systems.
At the time of the initial legal complaint, Trustwave did not issue any public comment. That changed on March 29, when Robert J. McCullen, chairman, CEO and president of Trustwave, published an open letter calling the claims against his company baseless allegations without merit.
“Contrary to the misstated allegations in the plaintiffs’ complaints, Target did not outsource its data security or IT obligations to Trustwave,” McCullen stated. “Trustwave did not monitor Target’s network, nor did Trustwave process cardholder data for Target.”
McCullen’s statement, however, does not make any specific mention of whether or not Trustwave conducted Payment Card Industry Data Security Standard (PCI-DSS) audits for Target. PCI-DSS is a security compliance requirement for merchants and is a key topic at the center of the unfolding Target breach information disclosure.
Both of the plaintiffs in the class-action legal suit against Trustwave have now filed to dismiss the case, “without prejudice.” Trustmark National Bank filed its notice of dismissal on March 28, while Green Bank filed its notice of dismissal on March 31.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.