A federal judge has capped the liability that Schnuck Markets’ is responsible to pay its payment-processing partners to $500,000 in relation to its data breach case.

Judge John Ross ruled on Thursday that transaction processor First Data Merchant Services Corp. and merchant bank Citicorp Payment Services Inc. could only withhold up to $500,000 in funds, according to the St. Louis Business Journal. Any funds held in excess of that will now have to be returned to the company.

Schnucks did not specify how much the third-parties were withholding.

While the processing partners argued that its agreement with the company did not cover “third-party fees” and others related to fraud reimbursement, Judge Ross rejected the argument.

Schnucks recently reached a settlement agreeing to pay customers for bogus charges and monetary losses resulting from its breach which exposed 2.4 million payment cards.