JPMorgan slaps TransUnion with trade secrets suit after linked DoJ settlement

Suit follows $37m settlement between TransUnion subsidiary and US government following Department of Justice investigation | Bank claims that “tens of millions” of consumers' credit card data was stolen in an attempt to recover lost revenue from the “lucrative” federal contracts.

JPMorgan Chase Bank (JPMC) has sued TransUnion just one week after the credit information company’s subsidiary agreed to pay the US government $37 million, to resolve connected claims it had stolen consumer data via federal contracts.

JPMC accuses TransUnion, its subsidiary Argus Information & Advisory Services, and former Argus parent Verisk Analytics, of stealing confidential credit card data belonging to “tens of millions” of consumers.

Through this “elaborate, decade-long scheme”, Argus “secretly misappropriate[d] JPMC’s valuable trade secret data comprising anonymised monthly account and portfolio credit card data for tens of millions of credit card users.”

This, the bank alleges, was an attempt to recompense the loss of “lucrative” government regulator contracts.

Whistleblower alleges misuse of federal contracts

Just last week, on March 12, a US Department of Justice (DoJ) investigation reported that Argus has agreed to pay the US government $37 million to resolve claims that it misused credit card data.

This data was, according to the DoJ, obtained via data aggregation contracts with various federal regulators (the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau).

Following the DoJ investigation, the government alleged that between 2010 and 2020 Argus used anonymised data to create synthetic (proxy) data that it incorporated into the products and services it sold to some commercial customers in place of actual data from certain banks.

After the loss of these contracts, JPMC said it learned of the alleged infringement in an unsigned letter in 2021 from a whistleblower—thought to be a Verisk employee—alleging that Argus and Verisk were improperly disclosing JPMC credit card data to other Verisk subsidiaries.

In response to JPMC sending a copy of the whistleblower’s letter to Argus, the bank received a letter from Argus that it describes in the complaint as “misleading”, and “an intentional effort to conceal its ongoing wilful and malicious misappropriation and prevent JPMC from discovering Argus’ unlawful conduct.”

Verisk, which acquired Argus in 2012 for $425 million, owned Argus for almost ten years, until 2022 when it sold Argus to TransUnion as part of a $515-million transaction.

The federal regulators also notified JPMC of the alleged infringement in mid-2022, prior to which the bank says it “knew nothing of the scheme, which included the creation and use of customised software to surreptitiously mimic JPMC’s trade secret data for Argus’ commercial benefit.”

The bank added: “...for more than ten years, Argus covertly used, retained, and disclosed JPMC’s trade secrets in Argus’ commercial analytics business involving the nation’s largest financial institutions.”

JPMC’s chief data and analytics officer Seth Wheeler said in a statement that “it's time this pattern of behaviour stops once and for all,” according to Reuters.

Verisk Analytics spokesperson Alberto Canal said the company “disagrees with the allegations in this lawsuit, and we will vigorously defend against them," adding that data security and ethics are "cornerstones of Verisk's business”.

Attorneys for JPMC are Amy Dudash, Julie Goldemberg, Phillip Wolfe, Michael Abernathy and Maria Doukas of Morgan Lewis.

Attorneys for TransUnion and co-defendants have not yet appeared.

The complaint was filed on March 19 at the US District Court for the District of Delaware.