PCI Hypocrisy: Citi’s Data Breach

Written by Walter Conway
June 14th, 2011

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

This past week, Citigroup announced its credit-card systems were hacked, compromising the card information on approximately 360,000 individuals. If this were a retailer, we would expect to see the card brands order a formal review by a PCI Forensic Investigator (PFI), a re-assessment of the retailer’s PCI compliance at the time of the breach and possibly significant fines and other penalties. Will Citi treat itself as harshly as it does its retailer customers that are breached? I wonder (and I imagine just about every merchant or processor that paid for PCI compliance or suffered a breach is wondering, too) if Citigroup will face similar consequences?

Just about a year ago, I raised the question of whether payment-card issuers should have an outside assessment of their PCI compliance. Everyone understands that issuers need to be PCI compliant. The PCI Council’s Frequently Asked Questions (FAQ) #5391 confirms this position with the statement: “PCI-DSS applies to any entity that stores, processes or transmits cardholder data and any such entity is expected to comply with PCI-DSS, including issuers.”

The big difference between merchants and issuers, however, is how they validate their compliance. Or I should say, whether they even need to validate their compliance. That same FAQ continues: “At their discretion, payment-card brands may require issuers [emphasis added] to validate PCI-DSS compliance.” In this case, the payment-card brands are American Express, Discover, JCB, MasterCard and Visa.

Let’s be clear on one thing: This data breach is a big deal. Based on public reports (I have no first-hand or inside information), hackers broke into Citi Account Online sometime in May and made off with the names, PANs, E-mail addresses and other personal information on roughly one percent of its 21 million North American customers. Maybe one percent doesn’t sound like a big number, but it translates into about 360,000 compromised accounts, which is a big number. Note, too, that the “other personal information” compromised could lead to identity theft and much more serious consequences for individuals than the inconvenience of having their credit or debit card replaced.

We should give Citigroup credit for going public to the extent it has fairly soon after the breach. But other than replacing the compromised cards, I have not read anything to indicate what Citi is doing internally to fix its system and network vulnerabilities. I would also be curious to know whether the card brands are involved.

If a retailer lost 200,000 PANs and cardholder names, the affected card brand(s) would want some answers. I know an organization that was ordered to investigate a breach, and it involved only 12 cards. A card brand could order Citigroup to go through a more formal forensic investigation (which Citi would get to pay for). Even if such an investigation isn’t ordered, it sounds like a good idea because Citi announced the breach was due to an external attack. (Full disclosure: I work for a QSA firm that is also a PFI.) Will Citigroup be ordered to conduct such an investigation?


7 Comments | Read PCI Hypocrisy: Citi’s Data Breach

  1. Rick Watson Says:

    More data here:

    Sadly the article claims this is a “sophisticated attack”. It is certainly not.

    Changing the URL in an address bar is not “a vulernability in the browser.”

  2. Ray Says:

    Generally speaking, banks only have two rules.
    1. We make the rules
    2. You must follow them

  3. Mike Baglietto Says:

    Walt poses an interesting question to say the least. “Will Citi treat itself as harshly as it does its retailer customers that are breached?” If PCI doesn’t force issuers to follow the same protocol as the merchants/retailers in the event of a breach, we may see a StorefrontBacklash from the retailers.

  4. Juan David Says:

    Great article,
    I know small companies, here in Colombia, investing great quantity of money, and great effort, in order to become PCI Compliant, just for one reason: The bank gives them all complete PAN, even if the small service provider doesn’t need it… the owner of the company told to me: “I dont need the PAN, I have requested the bank to not send me the PAN, I dont want the PAN!!!”…. but you know: The bank send that number, increasing the risk of fraud.
    I think banks have the power, the money, and because of that, they enjoy some liberties, who needs who? who depends of who?
    if the banks, accord that they dont like PCI, what can the brands do?? who’s bigger?? who’s stronger?? who’s the boss??… I’ve always have that doubt.

  5. Patrick Says:

    Up until now the breaches occurred at PCI certified entities. What does it say about PCI, as a process? How could it be possible to buy by a PCI compliance seal for $299, and PCI compliant overnight at this place:

  6. T.Anne Says:

    I think the issuers should be held to higher standards – not weaker… But then again I also think people high in the public eye should be held to higher standards as they’re our decision makers and/or role-models… sadly that isn’t the case either… if anything, they’ve proved to me if you have enough money or are high enough up the food chain – you can get away with a lot more than the general public. Unfortunately I believe the same will be true with the issuers… they’re high enough up the food chain to be able to get away without many consequences.

  7. Damian Says:

    @Patrick – Dear Patrick, I am not an employee of Trustwave, nor will I derive any benefit at all from what I am about to elucidate…

    I work with Trustwave professionally, and they are fast becoming one of the most recognised names in the PCI DSS compliance industry, because they are highly professional and 100 trustworthy (which I infer is accepted by the PCI Security Standards Council). They work with everyone from retailers to large national banks and government agencies (i.e. this is by no means a “fly-by-night” company, as your comment implies).
    The seal you refer to is available for $299, but only if one is an ongoing member of Trustwave’s Trusted Commerce programme to achieve and maintain PCI DSS compliance. The seal is not just purchased over the counter to “be compliant overnight”.
    If you have any further questions please contact a Trustwave sales representative and put in the investigative work to establish a proper case before going online with (possibly libellous) assertions. Sorry, don’t want to sound pedantic (too late!), and I also have my reservations about PCI DSS. I don’t have any reservations about Trustwave, however.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.