SAN FRANCISCO — Testing the bounds of consumer protection laws, Visa USA Inc. and MasterCard International Inc. are headed for court to determine whether they are obliged to notify 264,000 customers that a computer hacker stole their account information.

The dispute to be argued today in San Francisco County Superior Court revolves around a highly publicized security breakdown at CardSystems Solutions Inc., one of the nation's largest payment processors.

Although a ruling in the class-action consumer lawsuit wouldn't have legal standing outside the state, it would increase the pressure on Visa and MasterCard to notify all affected account holders in this and any future breaches.

That would compound the headaches that the CardSystems imbroglio already has caused.

The breach, initially disclosed by MasterCard three months ago, exposed up to 40 million credit and debit card accounts to potential abuse between August 2004 and May 2005.

It's the largest of more than 70 consumer information security breaches reported in the past seven months, according to the Privacy Rights Clearinghouse.