Heartland Breach Still Generating New Compromised Accounts
Written by Frank HayesOld breaches never die, they just—well, they never die. A small bank in Illinois on April 1 announced that some customers’ payment card information had been compromised at card processor Heartland Payment Systems. Yes, that Heartland. And yes, that breach—the one in 2008. “MasterCard and Visa, along with the FBI and Secret Service, have been investigating the incident for several years, and although the security breach is reported to have occurred between May 2008 and November 2008, the compromised information is only now being used to conduct fraudulent transactions,” Freestar Bank President Scott Bauknecht told a local newspaper.
That means that, more than two years after the breach was closed and the first arrests were made in the Heartland case, the thieves are still working their way through the trove of stolen card numbers. Holding onto the numbers that long is a gamble for the thieves, of course, because many of the cards could expire or be canceled over that much time. Then again, after two years without any fraudulent activity, banks and retailers will almost always assume that a card number hasn’t been stolen. That assumption may not be safe again for a long time.
-Marc
April 23rd, 2011 at 1:50 pm
Clearly,a well-orchestrated breach is designed to maximize the value of the card numbers that were stolen. Indeed, years after they were stolen, the effect is still being felt. Retailers in the convenience store, petroleum and quick-serve restaurant markets are often in denial about what it means to be secure.
Filling out an SAQ is not the answer to data security. There is a misconception that if a retailer qualifies for filling out SAQ C, then they don’t have to worry about any other requirement. On the contrary, they still need to follow all aspects of PCI DSS to whatever extent possible. This is the only way to minimize the risk of breach. Once breached, the damage maybe felt for years to come. I really do hope that smaller retail chains wake up and do something about data security. Senior management of these companies need to start protecting their business interests rather than assuming the risk of a data breach.