Credit Card Data Breach at Heartland Payment Systems

Heartland Payment Systems issued a press release at 9:00 AM today, announcing (sort of) that they had been a victim of a data breach. They didn’t announce the number of possible compromised records- or much of anything else either, but they did say that they found malware in their system.

I’d heard some rumors over the past weekend. In fact, they were more than rumors. I had information from a very reliable source that the breach had the potential of being bigger than the TJX breach of around 90 million credit card records. The breach had been ongoing from May until November.

While reading the initial press release. I was struck with the fact that they made a point of saying what was not compromised but said nothing about what was. Phrases like “No merchant information or cardholder Social Security numbers compromised” don’t instill a lot of confidence in e-Commerce merchants. Neither of those are credit card numbers.

Given the lack of detail in the press release and the information that I had, I sent an email to the address on the initial press release. The gist of the email was:

Would I be correct in assuming that “merchant data” does not include credit card information and that a huge number of credit card accounts were compromised? Word in the rumor mill since last week is that this one could be bigger than TJX. That would put it in the 100 million credit card neighborhood.

Care to comment?

Within minutes I got a response asking for my phone number. They wanted to talk to me. I responded with my cell phone number about 7 hours ago but haven’t heard from them. I guess they’re a bit busy right now!

There’s been some speculation in the blogosphere that HPS was pulling a sleazy thing releasing the information on Election Day hoping to slide in under the radar. I’m not sure.

Here’s my take on the release of information

I think HPS had no choice but to disclose today. They might have done it yesterday if it wasn’t a holiday. There was obviously a leak of information. I have more than I’m sure they’d like me to have and I had it over the weekend. If they knew there was a leak, they probably had to disclose with as little information as possible.

The final damages from this breach?

A lot depends on the level of security they had in place. If they were PCI compliant there will certainly be less repercussions than if they were full of holes. But in the end, I suspect the damage will be unmeasurable.

As for the number of credit card accounts that were compromised, I think it will exceed the 100 Million mark. Exceed it a lot! Here’s the thing…

Heartland Payment Systems claims that they do 100 Million transactions per month. My sources tell me the breech was on-going for 6 months. You do the math. Even if a huge number of their transactions are with cardholders using the same card number, that would put the number way over 100 million card records. Probably closer to 300 million.

And it’s all mag strip data!

Similar Posts:

• Heartland Data Breach rears its ugly head again
• Albert Gonzales may be in Jail but it ain’t over for a long time.
• Fraud Spree points to merchant security
• Credit card fraud trends
• Card Breach Victim Gets Twenty Years ‘Probation’