Heartland Payment Systems - 21 January '09
Hack using sophisticated malware believed to have lifted data of thousands of credit card transactions in the course of being processed.
A brief summary of the data loss is shown below:
Heartland Payment Systems
21 January 2009
Credit card users
Transactional data such as credit card number, expiry date and magnetic stripe data
Major hacking of entire system after bypassing firewalls and using keylogging malware to record details of passing credit card authorisations.
Heartland Payment Systems, which processes over 100 million credit card transactions every month, has announced that a major breach occurred in its systems in 2008.
Although the company is the largest processor of credit card transactions in the US, the breach appears only to have resulted in the loss of in-flight transactional data, which can be used to clone credit cards. Full details of the extent of the breach have yet to be announced, but such credit cards may include those owned by UK nationals who have transacted with the US either face-to-face or via distance selling, such as on US owned websites.
Heartland’s President and Chief Financial Officer Robert Baldwin advised that no Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers have been breached. He also added that the method used to breach the previously believed secure system remains under investigation. The company has set up a website to keep the public informed but at the time of writing this website was not available.
The breach was identified after Visa and MasterCard alerted Heartland Payment Systems of high levels of suspicious activity of processed credit cards.
