Court Opinion

ID: 9375348
Source: CourtListenerOpinion
Date Created: 2023-02-27 16:00:55.585439+00
Date Added: 2024-06-11T17:16:58.125847
License: Public Domain

Case: 21-20447    Document: 00516653713          Page: 1    Date Filed: 02/23/2023

           United States Court of Appeals
                for the Fifth Circuit                               United States Court of Appeals
                                                                             Fifth Circuit

                                                                           FILED
                                                                    February 23, 2023
                                 No. 21-20447                         Lyle W. Cayce
                                                                           Clerk

   Paymentech, L.L.C.; JPMorgan Chase Bank, N.A.,

                                        Plaintiffs—Appellees/Cross-Appellants,

                                     versus

   Landry’s Incorporated,

                                        Defendant—Appellant/Cross-Appellee,

                                     versus

   Visa, Incorporated; Mastercard International,
   Incorporated,

                                              Third Party Defendants—Appellees.

                 Appeal from the United States District Court
                     for the Southern District of Texas
                          USDC No. 4:18-CV-1622

   Before Higginbotham, Duncan, and Engelhardt, Circuit Judges.
   Stuart Kyle Duncan, Circuit Judge:
         A major data breach compromised sensitive consumer information on
   thousands of credit cards. In this appeal, we address who must pay for the
   cleanup. Beginning in 2014, hackers compromised credit card data at
Case: 21-20447     Document: 00516653713          Page: 2   Date Filed: 02/23/2023

                                   No. 21-20447

   multiple businesses owned by Landry’s Inc. (“Landry’s”). Many of those
   cards belonged to Visa and Mastercard. In response, Visa and Mastercard
   imposed over twenty million dollars in assessments on JPMorgan Chase and
   its subsidiary Paymentech (collectively, “Chase”), who were responsible for
   securely processing card purchases at Landry’s properties. Chase then sued
   Landry’s for indemnification, and Landry’s impleaded Visa and Mastercard.
          The district court dismissed Landry’s third-party complaints against
   Visa and Mastercard and granted summary judgment for Chase, finding that
   Landry’s had a contractual obligation to indemnify Chase. Landry’s now
   argues that it should not have to indemnify Chase because the assessments
   are not an enforceable form of liquidated damages. Even if they are, Landry’s
   contends that summary judgment was improper because fact disputes remain
   about its contractual duty to indemnify. Finally, Landry’s argues that it
   should be able to recoup any liability to Chase from Visa and Mastercard,
   who wrongly imposed the assessments in the first place. We disagree on all
   counts. We therefore affirm and remand solely for the district court to
   determine whether Chase should receive prejudgment interest.
                                        I.
                                        A.
          First, some background on the credit and debit card system. Sitting
   atop the system are companies like Visa and Mastercard (“Payment
   Brands”), which operate networks that facilitate card transactions. The
   intermediaries in the system are banks, which act in two capacities. As
   “issuers,” banks issue cards to consumers. As “acquirers,” banks give
   merchants access to the Payment Brands’ networks by processing card
   payments. See Pulse Network, L.L.C. v. Visa, Inc., 30 F.4th 480, 484–86 (5th
   Cir. 2022) (describing same structure in context of a debit network market).

                                        2
Case: 21-20447      Document: 00516653713          Page: 3   Date Filed: 02/23/2023

                                    No. 21-20447

          The system involves various contractual relationships. The Payment
   Brands contract with both issuers and acquirers. Acquirers, in turn, contract
   with merchants. Importantly, the Payment Brands have no direct contractual
   relationship with merchants; they contract only with a merchant’s acquirer.
   Nor do acquirers and issuers contract with one another; they are connected
   only indirectly via their respective contracts with the Payment Brands. This
   diagram from one of the parties’ briefs helpfully sketches these relationships:

          Visa and Mastercard each have rules governing this interlocking
   system—the “Visa Core Rules” and the Mastercard “Standards.” (We refer
   to them together as the “Rules”). The Rules are incorporated into the
   Payment Brands’ contracts with acquirers and issuers and into the acquirers’
   contracts with merchants. The upshot is that the Rules bind every party to
   the payment processing system—merchants, acquirers, issuers, and the
   Payment Brands themselves.
          Three features of the Rules are important here. First, the Rules
   require acquirers and merchants to follow industry-wide security protocols
   to protect card data. Most prominent are the Payment Card Industry Data
   Security Standards (“PCI DSS”), which require measures to protect

                                          3
Case: 21-20447       Document: 00516653713             Page: 4      Date Filed: 02/23/2023

                                        No. 21-20447

   cardholder data and apply to “any network component, server or application
   that is included in, or connected to, the cardholder data environment.” 1
          Second, the Rules require responsive measures when an entity
   discovers a potential data breach. For example, they provide for an industry-
   approved forensic investigator to investigate any suspected breach. 2
   Investigators must make findings about whether the potentially
   compromised entity complied with the security protocols.
          Third, and most relevant here, the Rules impose loss-shifting schemes
   that effectively make acquirers compensate issuers impacted by data
   breaches. Such breaches impose significant costs on issuers—they must
   reimburse cardholders for fraudulent charges, notify affected customers,
   replace compromised cards, and monitor at-risk accounts. The Rules allow
   the Payment Brands to impose “assessments” on parties who cause such
   harms by failing to comply with security protocols. The Payment Brands then
   distribute the assessments to impacted issuers.
           Visa and Mastercard’s loss-shifting programs—respectively, the
   Global Compromised Account Recovery (“GCAR”) program and the
   Account Data Compromise (“ADC”) program—operate similarly. Both
   give the Payment Brand the sole right to determine whether a breach qualifies
   for assessments, and, if it does, whether to impose them. Notably, both
   programs hold acquirers responsible for their merchant’s conduct. But the
   programs do not determine whether a merchant must indemnify an acquirer
   for assessments—that risk allocation depends on the merchant-acquirer

          1
            The PCI DSS are promulgated by the PCI Security Standards Council, a body
   created by multiple electronic payment processing companies to help bring uniformity to
   the industry’s data security practices.
          2
           Mastercard mandates hiring a forensic investigator, while Visa has discretion to
   mandate hiring one.

                                              4
Case: 21-20447      Document: 00516653713          Page: 5   Date Filed: 02/23/2023

                                    No. 21-20447

   contract. Finally, both programs allow an internal appeal to the Payment
   Brand regarding any assessments.
          While these loss-shifting rules are designed to compensate issuers,
   they also include some benefits for acquirers. GCAR caps acquirers’ total
   liability exposure and allows Visa to impose alternatives if assessments would
   prove catastrophic. ADC allows Mastercard to reduce or eliminate
   assessments based on various mitigating factors. In sum, the GCAR and ADC
   programs make each Payment Brand an arbiter of sorts, balancing the
   competing interests of acquirers and issuers in the aftermath of a data breach.
          With this background in mind, we turn to the facts.
                                         B.
          Landry’s is a multi-billion-dollar company that operates restaurants,
   hotels, and casinos throughout the United States. Landry’s contracted with
   JPMorgan Chase, through its subsidiary Paymentech, to be its acquirer and
   process card purchases made at Landry’s properties. The contract
   (“Merchant Agreement”) required Landry’s to comply with all applicable
   Payment Brand rules and data security standards, including its cooperation
   with any forensic investigation required by a Payment Brand in the event of a
   breach. Finally, the Merchant Agreement required Landry’s to indemnify
   Chase for any assessments levied on Chase due to Landry’s lack of
   compliance with security protocols or the compromise of cardholder data.
          From May 2014 to December 2015, Landry’s suffered a data breach.
   Hackers installed malware in some of Landry’s payment processing systems
   that lifted sensitive customer data from cards. Landry’s reported the breach
   and hired Mandiant, a Payment Brands-approved forensic investigation firm.
   Mandiant released its findings in a February 2016 report (“Mandiant
   Report”), concluding that there was “evidence[] the cardholder data
   environment was breached” and that approximately 180,000 Visa and

                                         5
Case: 21-20447        Document: 00516653713              Page: 6      Date Filed: 02/23/2023

                                         No. 21-20447

   Mastercard-branded cards had been exposed. Mandiant attributed the breach
   to Landry’s lack of compliance with the PCI DSS. 3
           In 2017, Visa and Mastercard each determined pursuant to their
   separate contracts with Chase that the breach justified imposing assessments
   on Chase, as Landry’s acquirer. Visa levied approximately $12.5 million in
   assessments; Mastercard approximately $10.5 million. Chase exercised its
   right to appeal the assessments and presented arguments provided by
   Landry’s. While Visa upheld its assessments, Mastercard reduced its levy by
   approximately $3 million.
           Chase then sued Landry’s, demanding indemnification against the
   assessments. Landry’s impleaded the Payment Brands, challenging the
   assessments’ validity and seeking to recover from them in the event it was
   held liable to Chase. Landry’s third-party complaints included claims against
   the Payment Brands as Chase’s equitable subrogee as well as claims in
   Landry’s own right. The district court dismissed the third-party complaints
   in their entirety under Federal Rule of Civil Procedure 12(b)(6), reasoning
   that Landry’s lacked standing to challenge Chase’s contracts with the
   Payment Brands.
           Landry’s then moved for summary judgment against Chase, arguing
   the assessments were legally unenforceable. The district court denied the
   motion, finding the assessments reasonably compensated the harm caused by
   the breach. Chase subsequently moved for partial summary judgment on its

           3
              Specifically, the report found that Landry’s did not require two-factor
   authentication to remotely access its corporate network, thus allowing the hackers to
   “move laterally” into the card data environment, and that Landry’s had used a shared local
   administrator password that had not been regularly updated to access accounts connected
   to card data. The hackers exploited these weaknesses to “spread malware across a
   significant portion of [Landry’s] properties” and “harvest cardholder data” as it was being
   processed during the transaction process.

                                               6
Case: 21-20447      Document: 00516653713          Page: 7   Date Filed: 02/23/2023

                                    No. 21-20447

   indemnification claim, and Landry’s countered by moving to strike the
   Mandiant Report. The district court denied Landry’s motion and granted
   summary judgment for Chase. It reasoned that the Mandiant Report was
   admissible because it was akin to an auditor’s report, not expert testimony,
   and that Chase was contractually entitled to indemnification because it had
   shown that Landry’s violated the data security guidelines.
          Landry’s now appeals both the dismissal of its third-party complaints
   against the Payment Brands and the summary judgment granted to Chase.
   Chase cross-appeals, asking us to reform the judgment to include
   prejudgment interest, which the district court did not grant.
                                        II.
          We review both a summary judgment and a Rule 12(b)(6) dismissal de
   novo. Davidson v. Fairchild Controls Corp., 882 F.3d 180, 184 (5th Cir. 2018);
   Ruiz v. Brennan, 851 F.3d 464, 468 (5th Cir. 2017).
                                        III.
          Landry’s raises three arguments on appeal. First, it argues summary
   judgment should have been granted in its favor because the Payment Brands’
   assessments on Chase were unenforceable. Second, in the alternative,
   Landry’s argues summary judgment was improper because there is a fact
   dispute over whether it breached any security protocols. Finally, even if it is
   liable to Chase, Landry’s argues it can at least maintain its suits against the
   Payment Brands to recoup what it had to pay Chase. We address each
   argument in turn.
                                         A.
          Landry’s first argues the assessments on Chase were not valid
   liquidated damages under applicable state laws. All agree New York law
   governs Chase’s contract with Mastercard and California law governs

                                          7
Case: 21-20447     Document: 00516653713           Page: 8   Date Filed: 02/23/2023

                                    No. 21-20447

   Chase’s contract with Visa. The premise of Landry’s argument is that
   liquidated damages must estimate damages only to the nonbreaching party,
   not to a third party. Landry’s claims the assessments do not estimate the
   Payment Brands’ damages for two reasons. First, the assessments are meant
   to compensate third-party issuers for their breach-related damages. Second,
   the Payment Brands are not obligated to pay the issuers’ damages, so their
   discretionary distribution of assessments to issuers cannot represent
   “damages” to the Payment Brands. Because the assessments are
   unenforceable, the argument continues, Chase had no obligation to pay but
   did so anyway. So, any duty by Landry’s to indemnify Chase was
   extinguished by the common law voluntary payment rule. See generally BMG
   Direct Mktg., Inc. v. Peake, 178 S.W.3d 763, 768 (Tex. 2005) (discussing
   voluntary payment rule).
          California and New York law treat liquidated damages similarly. Both
   presume the validity of liquidated damages in commercial contracts unless
   the challenging party shows otherwise. See Cal. Civ. Code § 1671(b);
   JMD Holding Corp. v. Cong. Fin. Corp., 828 N.E.2d 604, 609 (N.Y. 2005).
   Both also maintain the traditional distinction between liquidated damages,
   which are enforceable, and penalties, which are not. Under both states’ laws,
   the key question is whether the amount of contractual damages is
   proportionate to the harm the parties could have reasonably foreseen would
   flow from a breach. See, e.g., Ridgley v. Topa Thrift & Loan Ass’n, 953 P.2d
   484, 488 (Cal. 1998); Truck Rent-A-Ctr., Inc. v. Puritan Farms 2nd, Inc., 361
   N.E.2d 1015, 1018 (N.Y. 1977).
                                         1.
          Landry’s tries to marshal California and New York authorities to
   support its argument that a liquidated damages provision may legally
   compensate only the nonbreaching party to the contract. But none of the

                                         8
Case: 21-20447        Document: 00516653713             Page: 9      Date Filed: 02/23/2023

                                        No. 21-20447

   cases Landry’s cites teaches that lesson. Landry’s thus fails to overcome the
   assessments’ presumptive validity under state law.
           Landry’s first relies on the California Supreme Court’s 1998 decision
   in Ridgley v. Topa Thrift & Loan Association. Landry’s zeroes in on the court’s
   statement that assessments are unenforceable penalties when they “bear[] no
   reasonable relationship to the range of actual damages that the parties could
   have anticipated would flow from a breach.” Ridgley, 953 P.2d at 488
   (Landry’s emphasis). But Landry’s overreads that statement. One could just
   as easily read the quoted language to allow the contracting parties to
   anticipate damages to third parties. 4 More to the point, Ridgley did not
   involve a third party at all and so the court had no occasion to opine on the
   distinct question of third-party damages before us.
           Landry’s other California authorities fare no better. For instance,
   Bondanza v. Peninsula Hospital and Medical Center involved a different
   standard for enforceability than the one here. 590 P.2d 22, 25–26 (Cal. 1979).
   The liquidated damages provision there was in a consumer rather than a
   commercial contract, thus requiring the enforcing defendant to prove “it
   would be impracticable or extremely difficult to fix the actual damage.” Id. at
   25 (quoting Cal. Civ. Code § 1671). The court refused to enforce the
   provision because the parties had agreed only that liquidated damages would
   be “reasonable,” and the defendant did not try to show it would be hard to
   fix actual damages. Id. at 25–26. The fact that the liquidated damages, if
   enforced, would have ultimately flowed to a third party played no role in the
   court’s analysis. See ibid.

           4
             That reading of Ridgley would be consistent with the California Supreme Court’s
   previous observation that liquidated damages need only reasonably estimate “fair average
   compensation for any loss that may be sustained.” Garrett v. Coast & S. Fed. Sav. & Loan
   Ass’n, 511 P.2d 1197, 1202 (Cal. 1973) (emphasis added).

                                              9
Case: 21-20447     Document: 00516653713           Page: 10   Date Filed: 02/23/2023

                                    No. 21-20447

          Landry’s also fails to support its argument with any New York
   authorities. For instance, in Aetna Casualty and Surety Company v. Aniero
   Concrete Company, Inc., 404 F.3d 566, 567 (2d Cir. 2005) (per curiam), the
   court (applying New York law) declined to enforce the liquidated damages
   provision because it held the underlying contract “was invalid due to an
   unsatisfied express condition precedent.” So, all claims predicated on the
   nullified contract necessarily failed. See id. at 601–02. The involvement of a
   third party was immaterial.
          Finally, Landry’s cites Dyer Brothers Golden West Iron Works v. Central
   Iron Works for its one-sentence explication of a 1908 New York case that
   refused to enforce liquidated damages that flowed to a third party. 189 P. 445,
   447 (Cal. 1920) (discussing McCord v. Thompson-Starrett Co., 113 N.Y.S. 385
   (N.Y. App. Div. 1908)). But in summarizing that case, the Dyer Brothers court
   highlighted the key feature that separates it from our facts: the provision was
   unenforceable because “the money was not to be apportioned among the
   parties to the contract . . . but was the property of the [third-party]
   association created by the contract, which, as such, could suffer no pecuniary
   loss from the violation of the agreement.” Id. at 447 (emphasis added). The
   problem was not the involvement of a third party per se, but rather that the
   third-party association was incapable of suffering damages. So, the purported
   liquidated damages were “in fact given to secure penalties for non-
   compliance with the [contract].” McCord, 113 N.Y.S. at 386. Here, by
   contrast, Landry’s does not deny that the issuers suffered damages
   responding to the data breach.
          In sum, Landry’s does not provide, nor have we found, any relevant
   state authority barring parties in commercial contracts from tying liquidated
   damages to the anticipated harm to a third party. Landry’s has therefore not
   rebutted the assessments’ presumptive validity. See Cal. Civ. Code
   § 1671(b); JMD Holding Corp., 828 N.E.2d at 609.

                                         10
Case: 21-20447      Document: 00516653713            Page: 11     Date Filed: 02/23/2023

                                      No. 21-20447

                                           2.
          But even if Landry’s legal premise were correct, there is still a
   problem: Landry’s is mistaken that the assessments do not estimate the
   Payment Brands’ own losses. True, the assessments compensate issuers for
   their breach-related losses. But the assessments also reflect the Payment
   Brands’ damages because the Payment Brands are contractually obliged to
   pay any assessments they collect to issuers. 5 That is an independent reason
   why Landry’s claims must fail.
          Landry’s contends the assessments cannot be liabilities because the
   Payment Brands impose and distribute assessments as a matter of discretion,
   not contractual obligation. A voluntary payment, Landry’s says, is not a
   liability. We disagree. Landry’s conflates the Payment Brands’ front-end
   discretion to impose assessments with their back-end obligation to distribute
   the assessments they collect.
          It is true, as Landry’s emphasizes, that the Payment Brands have
   considerable discretion at the start of the assessment process. The Visa Core
   Rules reserve Visa’s authority to decide whether to impose assessments and
   in what amount based on the GCAR criteria. 6 Mastercard retains similar
   authority under its rules. 7 This discretion cannot be second-guessed by the
   issuers or the liable acquirers.

          5
          The Payment Brands ultimately retain no portion of the assessments except a
   management fee to cover the cost of operating the GCAR and ADC programs.
          6
             As the Visa Core Rules put it, “Visa has authority and discretion to
   determine . . . estimated Counterfeit Fraud Recovery and Operating Expense Recovery
   amounts . . . in accordance with the Visa Global Compromised Account Recovery (GCAR)
   Guide and the available information regarding each event.”
          7
          “MasterCard reserves the right to determine which ADC Events will be eligible
   for ADC operation reimbursement and/or ADC fraud recovery. . . . MasterCard may

                                            11
Case: 21-20447        Document: 00516653713               Page: 12       Date Filed: 02/23/2023

                                          No. 21-20447

           But once the Payment Brands decide to levy assessments, their
   discretion ends: any assessments they collect belong to the issuers. Under the
   ADC program, for instance, Mastercard “has no obligation to disburse an
   amount in excess of the amount that MasterCard actually and finally collects
   from the responsible Customer.” By clear implication, Mastercard must
   disburse what it does collect. Similarly, Visa provides that “issuer recoveries
   are limited to the amount, if any, that Visa collects from the Compromised
   Entity’s acquirer(s).” Moreover, the GCAR and ADC programs include
   rules governing the timing and manner of the assessments’ distribution.
   Visa’s, for example, provide that “[i]ssuers are credited approximately 30
   calendar days after Visa has collected the liability funds from the
   acquirer(s).” These later stages of the assessment process do not include the
   same discretionary language that marks the beginning. In short, contrary to
   Landry’s assertions, the Payment Brands do not have free rein over the
   assessments. Once assessments have been collected, they are contractually
   obligated to distribute them to issuers. 8
           During the litigation, the Payment Brands confirmed this is the right
   way to read the contracts. Visa’s brief concedes it “must reimburse issuers
   for any losses recovered through the GCAR program.” Visa Br. at 37.
   Mastercard’s counsel did the same at oral argument, explaining “the

   determine the responsible Customer’s financial responsibility with respect to an ADC
   Event.”
           8
              We are not the first court to reach this conclusion. Recently, a Texas court of
   appeals, applying California law, upheld Visa’s GCAR program against a similar challenge.
   Visa Inc. v. Sally Beauty Holdings, Inc., 651 S.W.3d 278 (Tex. App.—Fort Worth 2021, pet.
   filed). The court recognized that Visa was contractually obligated to reimburse issuers for
   their damages “condition[ed] . . . on Visa’s successful imposition and collection of the
   GCAR assessment.” Id. at 286–87 & n.14; see also id. at 296 n.39 (noting that “[a]lthough
   Visa’s liability is contingent on Visa’s ability to collect the calculated assessment from the
   responsible acquirers, it nonetheless exists” (cleaned up)).

                                                12
Case: 21-20447          Document: 00516653713       Page: 13   Date Filed: 02/23/2023

                                     No. 21-20447

   distribution of the assessments is provided for in the rules, and that’s part of
   the agreement between Mastercard and its banks.” 9 Visa’s counsel also
   explained that Visa’s discretion regarding assessments is “built in on the
   front end before the assessment is levied.” 10 These representations confirm
   what the contracts say.
          Because the Payment Brands are liable to issuers for any collected
   assessments, Landry’s argument fails on its own terms: the assessments
   reflect the Payment Brands’ own liabilities, not only harm to issuers. So, even
   assuming state law requires liquidated damages to estimate harm to the
   nonbreaching party alone, the Payment Brands’ own liability to the issuers
   would satisfy that standard. Either way, the assessments are enforceable.
                                         B.
          Alternatively, Landry’s argues summary judgment for Chase was
   improper because genuine disputes remain over whether Landry’s had a duty
   to indemnify. The district court granted summary judgment for Chase after
   finding that the Mandiant Report showed Landry’s violated security
   protocols, triggering Landry’s obligation to indemnify Chase against the
   resulting assessments. We agree with the district court, albeit on different
   grounds.
          The Merchant Agreement, which is governed by Texas law, contains
   the following indemnification provision:

          9
             Oral Argument at 33:00, Paymentech v. Landry’s (No. 21-20447),
   https://www.ca5.uscourts.gov/OralArgRecordings/21/21-20447_12-5-2022.mp3.
          10
               Id. at 38:35.

                                          13
Case: 21-20447      Document: 00516653713             Page: 14    Date Filed: 02/23/2023

                                       No. 21-20447

          You [Landry’s] understand that your failure to comply with the
          Payment Brand Rules,[ 11] including the Security
          Guidelines,[ 12] or the compromise of any Payment Instrument
          Information, may result in assessments, fines, and/or penalties
          by the Payment Brands, and you agree to indemnify and
          reimburse us [Chase] immediately for any such assessment,
          fine, or penalty imposed on [Chase].
   Landry’s argues this clause requires Chase to prove that Landry’s violated
   the Security Guidelines or that card data was compromised—it is not enough
   that the Payment Brands imposed assessments. Landry’s further argues that
   Chase cannot show either condition occurred because the Mandiant Report
   was not competent summary judgment evidence. Chase counters that
   Landry’s duty arose when the Payment Brands imposed assessments after
   making their own determination that Landry’s violated the Security
   Guidelines. At bottom, the parties disagree over who decides whether
   Landry’s violated the Security Guidelines: the Payment Brands or a court.
          We favor Chase’s interpretation for several reasons. First, it comes
   within the natural reading of the text. The Merchant Agreement requires
   Landry’s to indemnify Chase for “any such assessment[s],” referring to
   assessments “by the Payment Brands” that “result” from “failure to comply
   with the Payment Brand Rules . . . or the compromise of any Payment
   Instrument Information.” Here, the Payment Brands levied assessments
   because they found the breach was caused by Landry’s noncompliance with
   the PCI DSS. For instance, Visa’s letter to Chase announcing the
   assessments documented its investigation into intrusions at 14 different

          11
             The Merchant Agreement defines ‘Payment Brand Rules’ as “the bylaws, rules,
   and regulations, as they exist from time to time, of the Payment Brands.”
          12
             As relevant here, the Merchant Agreement defines ‘Security Guidelines’ to
   include the PCI DSS.

                                            14
Case: 21-20447      Document: 00516653713             Page: 15      Date Filed: 02/23/2023

                                       No. 21-20447

   Landry’s properties. For each, Visa found “conclusive evidence” of a
   breach, which it attributed to Landry’s noncompliance with the PCI DSS.
   Landry’s may dispute Chase’s ability to independently prove the Payment
   Brands’ conclusions on this record, but it is within the text of the clause that
   the assessments were imposed “by the Payment Brands” as a “result” of
   Landry’s “failure to comply with the Payment Brand Rules.”
          Furthermore, the Merchant Agreement incorporates the Payment
   Brand Rules, which give the Payment Brands the right to determine whether
   someone violated them. The agreement provides that “[t]he Payment Brand
   Rules . . . are made a part of this Agreement for all purposes,” and it requires
   Landry’s to “comply with . . . all Payment Brand Rules as may be applicable
   to you[.]” The rules make the Payment Brands the arbiters of their
   assessment programs. Mastercard “has the sole authority to interpret and
   enforce the Standards,” and its “determinations with respect to the
   occurrence of and responsibility for [data breaches] are conclusive.” Visa’s
   Core    Rules    likewise     reserve    the   “authority      and    discretion    to
   determine . . . estimated [assessment] amounts, Issuer eligibility, and
   Acquirer liability under the GCAR program.” 13 Landry’s understood how
   the GCAR and ADC programs worked when it entered the contract. So, it
   cannot complain now that those programs give the Payment Brands the
   authority to determine who violated the security protocols.
          This conclusion is reinforced by two final textual clues. Landry’s duty
   to indemnify arises “immediately” for covered assessments. And, elsewhere
   in the Merchant Agreement, Landry’s agrees that “adjustments, fees,
   charges, fines, assessments, penalties, and all other liabilities are due and

          13
              Because an acquirer cannot be liable under GCAR program without it or its
   merchant violating required security protocols such as the PCI DSS, the Visa Core Rules
   necessarily reserve the authority to make determinations about compliance.

                                             15
Case: 21-20447        Document: 00516653713            Page: 16      Date Filed: 02/23/2023

                                        No. 21-20447

   payable by [Landry’s] when [Chase] receive[s] notice thereof from the Payment
   Brands or otherwise pursuant to Section 4 herein.” 14 Tying an immediate
   obligation to the Payment Brands’ mere provision of notice further supports
   the conclusion that the parties intended the Payment Brands to be the
   arbiters with respect to assessments. The Payment Brands, after all, oversee
   an elaborate system to investigate data breaches and adjudicate the propriety
   of assessments.
          Accordingly, summary judgment for Chase was proper. This is so
   regardless of the competency or the findings of the Mandiant Report. The
   Payment Brands imposed assessments on Chase after determining that
   Landry’s caused the breach through noncompliance with the PCI DSS, and
   that is sufficient under the Merchant Agreement. Landry’s and Chase are
   sophisticated parties familiar with the loss-shifting inherent in the GCAR and
   ADC programs, so we will not disturb the allocation of risk adopted by the
   parties themselves.
                                            IV.
          Because Landry’s is liable to Chase, the question becomes whether
   Landry’s can pursue its third-party complaints to recoup its liability from the
   Payment Brands. Landry’s brought six claims against each Payment Brand,
   four as Chase’s equitable subrogee—that is, standing in Chase’s shoes and
   asserting Chase’s rights—and two as “direct” claims “in its own right.” 15
   The district court properly dismissed these claims, both subrogated and
   direct, because Landry’s lacks standing.

          14
               Section 4 provides Chase with various options for collecting funds owed by
   Landry’s.
          15
             The claims differed materially between each Payment Brand only with respect to
   which state’s laws they were brought under.

                                              16
Case: 21-20447      Document: 00516653713           Page: 17   Date Filed: 02/23/2023

                                     No. 21-20447

                                          A.
            We begin with the subrogated claims. As a threshold matter, the
   parties dispute whether Texas or New York law governs Landry’s
   subrogation rights. We need not decide this question because Landry’s
   claims fail under both.
            Equitable subrogation is the doctrine by which a party, after having
   paid the losses of another party, obtains that party’s rights and remedies
   against the third party that caused the loss. See Gen. Star Indem. Co. v. Vesta
   Fire Ins. Corp., 173 F.3d 946, 949 (5th Cir. 1999) (applying Texas law);
   Winkelmann v. Excelsior Ins. Co., 650 N.E.2d 841, 843 (N.Y. 1995). The
   doctrine’s paradigmatic application is in the insurance context. See Frymire
   Eng’g Co. ex rel. Liberty Mut. Ins. Co. v. Jomar Int’l, Ltd., 259 S.W.3d 140, 142
   (Tex. 2008). For instance, “in the typical example of subrogation, an insurer
   attempts to recoup covered medical expenses from the tortfeasor who caused
   the insured’s injuries and need for treatment in the first place.” Aetna Health
   Plans v. Hanover Ins. Co., 56 N.E.3d 213, 218 (N.Y. 2016) (Stein, J.,
   concurring). Subrogation thus allows the subrogee to “stand[] in the shoes”
   of an injured party and recover from the wrongdoer who is culpable for the
   loss. Cont’l Cas. Co. v. N. Am. Capacity Ins. Co., 683 F.3d 79, 85 (5th Cir.
   2012) (citation omitted); see also Millennium Holdings LLC v. Glidden Co., 53
   N.E.3d 723, 728 (N.Y. 2016); Fasso v. Doerr, 903 N.E.2d 1167, 1170 (N.Y.
   2009).
            Landry’s compares itself to an insurer, arguing that if it must
   indemnify Chase, then it should be able “to recover the losses that Chase
   sustained by reason of the wrongful conduct of the Payment Brands.” The

                                          17
Case: 21-20447        Document: 00516653713               Page: 18       Date Filed: 02/23/2023

                                          No. 21-20447

   wrongful conduct Landry’s alleges for all its subrogated claims is the
   Payment Brands’ levying of “illegal assessments” on Chase. 16
           Landry’s analogy falls short for one overarching reason: Landry’s paid
   its own debt, not the Payment Brands’ debt. As discussed, equitable
   subrogation exists to prevent an innocent party from having to bear a loss
   attributable to a wrongdoing third party. See Md. Cas. Co. v. W.R. Grace &
   Co., 218 F.3d 204, 211 (2d Cir. 2000). It follows from that principle that
   subrogation is a “remedy not given to one who merely pays his own debt.”
   Pathe Exch. v. Bray Pictures Corp., 247 N.Y.S. 476, 481 (N.Y. App. Div. 1931);
   Smart v. Tower Land & Inv. Co., 597 S.W.2d 333, 337 (Tex. 1980) (equitable
   subrogation is for “one who pays a debt owed by another”); Mid-Continent
   Ins. Co., 236 S.W.3d at 776. As explained below, Landry’s debt is its own, not
   that of the Payment Brands, because the assessments stem from Landry’s
   own conduct—namely, its failure to abide by the PCI DSS as it promised to
   do in the Merchant Agreement.
           To support this conclusion, the Payment Brands correctly point to
   Jetro Holdings, LLC v. MasterCard International, 88 N.Y.S.3d 193 (N.Y. App.
   Div. 2018), which held that a merchant obligated to indemnify its acquirer
   could not challenge Mastercard’s assessments as the acquirer’s subrogee. Id.

           16
              Landry’s first cause of action was for breach of contract, alleging the assessments
   were “not authorized” by the GCAR/ADC programs and “unenforceable under
   applicable law.” The second was for breach of the covenant of good faith and fair dealing,
   likewise alleging that Visa’s assessments were “not authorized by the Visa Rules and GCAR
   Guide or applicable law” and that Mastercard’s assessments “w[ere] not authorized by the
   Standards or applicable law.” The third cause of action alleged that the Payment Brands
   were “unjustly enriched” because they imposed assessments “without any contractual or
   lawful basis for so doing.” The fourth and final cause of action was for deceptive business
   practices. It alleged the Payment Brands deceived Chase by imposing assessments that
   were “invalid under . . . applicable law.” All of Landry’s subrogated claims thus turn on
   the enforceability of the assessments.

                                                18
Case: 21-20447       Document: 00516653713              Page: 19      Date Filed: 02/23/2023

                                         No. 21-20447

   at 196. The court found that the merchant’s (Jetro) contract with PNC, its
   acquirer, constituted a “separate and distinct obligation to PNC” that
   precluded subrogation. Ibid. In other words, the contract made Jetro’s
   indemnification of PNC its own debt. The court noted two pertinent aspects
   of that contract. First, it noted that Jetro had agreed to indemnify PNC for
   assessments that resulted from its own “acts or omissions,” such as failing
   to comply with data security rules. See id. at 195–96. Second, it observed that
   Jetro was required to indemnify PNC even if Mastercard illegally imposed
   assessments. Id. at 196. Thus, Jetro’s obligation to PNC was “broader” than
   PNC’s obligation to Mastercard. Ibid.
           As in Jetro, the Merchant Agreement tied Landry’s indemnification
   obligation to Landry’s own acts or omissions, so the assessments constitute
   Landry’s own debt. The agreement provided that Landry’s would indemnify
   Chase for assessments resulting from “failure to comply with the Payment
   Brand Rules, including the Security Guidelines.” Unlike an insurer who
   passively becomes responsible for a loss caused by someone else, the
   agreement made Landry’s responsible only for assessments resulting from its
   own conduct. The resulting “debt” is therefore attributable to Landry’s, not
   the Payment Brands. See ibid. 17
           Landry’s tries to distinguish Jetro because the second contractual
   feature there is not present here. Landry’s denies that it must indemnify
   Chase even for illegal assessments, and thus it argues that its obligation to
   Chase is not broader than Chase’s obligation to the Payment Brands, as was
   the case in Jetro. But even accepting this difference, Jetro remains apposite.

           17
             In other words, this is not a case in which the Payment Brands as wrongdoers “in
   equity and good conscience should have [] discharged” the debt. See Bank of Am. v. Babu,
   340 S.W.3d 917, 925 (Tex. App.—Dallas 2011, pet. denied) (quoting Murray v. Cadle Co.,
   257 S.W.3d 291, 299 (Tex. App.—Dallas 2008, pet. denied)).

                                              19
Case: 21-20447        Document: 00516653713                Page: 20        Date Filed: 02/23/2023

                                           No. 21-20447

   We read Jetro as identifying two independently sufficient bases for finding
   Jetro’s obligation separate and distinct. Both features, in other words, were
   standalone reasons for making the assessments attributable to Jetro. Nothing
   in the opinion suggests both features were logically necessary to the outcome.
   Thus, since Landry’s indemnification obligation stems from its own acts or
   omissions under the Merchant Agreement, the debt is its own. 18
                                                 B.
           Landry’s direct claims for unjust enrichment and deceptive business
   practices remain. Their dismissal was also proper because these claims were,
   as a practical matter, also subrogated claims. They therefore fail for the same
   reason given above.
           We evaluate pleadings based on substance, not labels. Gaudet v.
   United States, 517 F.2d 1034, 1035 (5th Cir. 1975) (per curiam); Armstrong v.
   Capshaw, Goss & Bowers, LLP, 404 F.3d 933, 936 (5th Cir. 2005). While
   Landry’s styled these claims as “direct” and made “in [Landry’s] own
   right,” they require litigating Chase’s contractual relationships with the
   Payment Brands just as the subrogated claims do. Landry’s alleged the
   Payment Brands were “unjustly enriched” by “imposing [assessments] on
   [Chase] . . . without any contractual or lawful basis for doing so.” Likewise,
   Landry’s alleged for its deceptive business practices claims that the
   assessments were “invalid” under the Payment Brand Rules and “applicable
   law” and therefore the Payment Brands’ “imposition and collection of the
   [assessments] was an unlawful business practice.” Because these claims turn

           18
              Additionally, we note that equitable subrogation is not a matter of right but arises
   through equity based on the facts and circumstances of the case. Murray, 257 S.W.3d at
   300; Costello on Behalf of Stark v. Geiser, 85 N.Y.2d 103, 109 (N.Y. 1995). Since Landry’s
   has already had an opportunity to litigate the validity of the assessments in its action against
   Chase, it is no injustice to say that it cannot try again against new defendants.

                                                 20
Case: 21-20447       Document: 00516653713              Page: 21      Date Filed: 02/23/2023

                                         No. 21-20447

   on the assessments’ enforceability under Chase’s contracts with the
   Payment Brands, they are functionally the same as the subrogated claims.
   Since Landry’s cannot challenge the Payment Brands over those contracts as
   Chase’s subrogee, it cannot do so through a change in labeling. 19
                                              V.
           Because we rule for Chase, we must address its cross-appeal for
   prejudgment interest. The district court did not act on Chase’s request for
   prejudgment interest and thus implicitly denied it. See Manuel v. Turner
   Indus. Grp., L.L.C., 905 F.3d 859, 868 (5th Cir. 2018). Chase now asks us to
   reform the judgment to include prejudgment interest, while Landry’s argues
   we should remand.
           We decline to reform the judgment. While prejudgment interest is
   usually awarded “as a matter of course” under Texas law, the district court
   may exercise its discretion to reduce or deny it if “exceptional
   circumstances” exist. Executone Info. Sys., Inc. v. Davis, 26 F.3d 1314, 1330
   (5th Cir. 1994) (citation omitted). Because the court must explain those
   circumstances, “[i]f the district court denies prejudgment interest without
   explanation, our appropriate course is to remand the issue so that the court
   may either explain the exceptional circumstances . . . or award interest at the
   appropriate rate.” Ibid; see also Meaux Surface Prot., Inc. v. Fogleman, 607 F.3d

           19
             Landry’s argues that the district court did not address these claims and so we
   must reverse at least as to them. Even if that were so, we may affirm for any reason
   supported by the record, United States v. Gonzalez, 592 F.3d 675, 681 (5th Cir. 2009), and
   the record cleanly presents this issue.

                                              21
Case: 21-20447        Document: 00516653713              Page: 22       Date Filed: 02/23/2023

                                          No. 21-20447

   161, 172–73 (5th Cir. 2010); Concorde Limousines, Inc. v. Moloney
   Coachbuilders, Inc., 835 F.2d 541, 549–50 (5th Cir. 1987). We do so here. 20
                                               VI.
           The district court’s judgment is AFFIRMED. The case is
   REMANDED solely to allow the district court to determine whether Chase
   should receive prejudgment interest.

           20
            Chase’s primary authority is distinguishable. See Farmland Indus., Inc. v. Andrews
   Transp. Co., 888 F.2d 1066 (5th Cir. 1989). There, the district court had already awarded
   prejudgment interest, but both parties agreed that it applied an incorrect interest rate. Id.
   at 1068.

                                                22