Evan Schuman's StorefrontBacktalk

An E-Commerce software company that, as part of its service for small retailers accepted payment card data and then sent it to various processors, has found itself on the wrong end of a breached company news release, confirming that payment data from some 574,000 customers—processed through 4,343 of its small retail clients—had been accessed. The stolen data included transaction specifics, card account numbers, names and consumer addresses.

The details include an early PCI attempt to try and walk back the certification, retailers complaining about their names appearing in a breach notification letter and the vendor bringing in General Dynamics, a familiar name from the data breach probes of both TJX and Hannaford. Plus a former IT manager with the company claiming that they retain credit card data a lot longer than they say they do.

The vendor—Network Solutions—had been certified PCI compliant (you just knew that was coming, no?) Visa has been fine-tuning its revisionist-history dance, where it has declared that no PCI compliant organization has ever been breached, forcing the card brand to find a reason to unvalidate any entity that had been certified compliant. A statement from the PCI Council on Monday (July 27) laid the groundwork for taking back the PCI certification that assessor PSC granted them last Halloween. (A PCI certification that is good only until a breach happens? Now that’s a scary retail trick-or-treat.)

The statement under the name of Bob Russo, the general manager for the PCI Security Standards Council, said: “Until a forensics investigation is completed, an organization cannot comment accurately on its compliance status.” The statement then said that ongoing vigilance is essential in maintaining PCI compliance. Once again, the retailer dreams of a PCI Safe Harbor are just that.

Back to the Network Solutions breach. Network Solutions provides a full E-Commerce suite, designed for very small retailers. Although a small business is generally defined as fewer than 100 employees, Network Solutions PR Director Susan Wade said “Our average merchant tends to have fewer than ten employees.” It has the usual shopping cart and design elements, which is customized for thousands of small retailers. Each retailer has to arrange for its own processor, of course, but Network Solutions relays the credit card info from its site to the processor chosen by that merchant.

During an ordinary maintenance sweep in early June, Wade said, code was discovered on certain parts of various servers. Network Solutions CEO Roy Dunbar said in a letter: “We believe that some credit card transactions that took place on your website this past spring were intentionally diverted from certain of our servers to servers outside Network Solutions by an unknown source.”

Network Solutions brought in General Dynamics to help diagnose the problem. General Dynamics is getting to be an old hand at such matters, given that it had performed the same sort of post-breach evaluation for TJX and also worked with Hannaford on boosting its post-breach security.

“It took quite a while to crack the code,” Wade said, adding that they finally figured out “some of the code” on July 13 and saw that it had been grabbing payment data and sending it outside the network.

The E-Commerce vendor was able to identify very specific numbers of those impacted—4,343 retailers and 573,928 consumers—because “that’s the number of sites that were on the portions of the servers that were impacted,” Wade said, adding that the impacted transactions were made between March 12, 2009 and June 8, 2009.