A U.S. district judge in Minnesota has granted class-action status to five financial institutions suing Target Corp. over the 2013 data breach in which hackers gained access to millions of customers’ financial information.

Five financial institutions, including Whitman, Massachusetts-headquartered Mutual Bank, had charged the big-box retailer with failing to adequately protect customers’ data from the attack and that it violated Minnesota’s Plastic Card Security Act.

Judge Paul A. Magnuson rejected Target’s arguments against class-action status, including its argument that damages resulting from the breach ought to be calculated on a bank-by-bank basis, according to court documents publicized first by Credit Union Times.

In opposing class-action certification, Target had argued that because financial institutions had no legal duty to reissue cards in the wake of the data breach, that the retailer should not be held liable for their losses.

“What Target suggests is that, because there was no requirement to act, financial institutions should have done nothing in the face of dire alerts regarding the data breach issued by the card-issuing companies and by Target itself and the known potential consequences for the institutions’ customers,” Magnuson wrote. “The absurdity of this suggestion is evident from the fact that Target itself reissued all of its RedCards, both debit and credit, in the weeks after the breach. Whether a specific action was legally mandated is not required to establish injury or causation.”

While Tuesday’s decision does not find in favor of either the retailer or the financial institutions, it does allow other financial institutions that incurred losses from reissuing cards after the data breach to join the lawsuit against Target.

Magnuson wrote in his decision, “… given the number of financial institutions involved and the similarity of all class members’ claims, plaintiffs have established that the class action device is the superior method for resolving this dispute.”