Wendy's data breach that began last fall has spawned a lawsuit seeking class-action status. A Pennsylvania credit union filed the suit in U.S. Federal Court on Monday, alleging that Wendy's failed to secure customer payment data and that banks have so far footed the bill to make consumers whole.

Wendy's data breach that began last fall has spawned a lawsuit seeking class-action status.

A Pennsylvania credit union filed the suit in U.S. Federal Court on Monday, alleging that Wendy's failed to secure customer payment data and that banks have so far footed the bill to make consumers whole.

First Choice Federal Credit Union, located in New Castle, Pennsylvania, alleges in the suit that the data breach lasted for almost five months, from late October to early March. The credit union cites credit-card issuer Visa as the source of that information and says that financial institutions stand to lose millions of dollars.

Wendy's declined to comment on the lawsuit.

"We have no updates at this time beyond what we have said previously, since our investigation into unusual payment card activity at some Wendy�s restaurants is active and ongoing," said Bob Bertini, Wendy's spokesman.

The lawsuit says banks and other financial institutions have canceled and reissued cards, closed accounts, sent notifications to customers, investigated claims, refunded fraudulent charges and invested in fraud-monitoring programs. First Choice thinks Wendy's should reimburse banks for their losses.

The credit union does not seek specific monetary damages, but the suit mentions that financial institutions face more than $5 million in losses.

Wendy's reported the data breach in late January. The company has not commented on the possible scope of the breach.

Dan Berger, president of the National Association of Federal Credit Unions, said in March that the breach could eclipse recent issues at Target and Home Depot. The Home Depot breach affected 56 million credit and debit cards in 2014; the Target breach in 2013 affected about 40 million debit and credit cards. Target settled with financial institutions late last year for $39.4 million related to fraudulent charges.

First Choice wants the court to force Wendy's to beef up its encryption software, implement chip-card payment technology, and make other technology upgrades across its 6,000 restaurants.

jmalone@dispatch.com

@j_d_malone