Scam and Phishbusters → [Credit Card Fraud] Heartland Payment Systems Card Data Hacked.

quote:

---

Payments processor heartland Payment Systems Inc. said Tuesday its system used to process Visa, MasterCard, American Express and Discover Card transactions was breached last year, but asserted that merchant and customer data were not affected.

Robert H.B. Baldwin Jr., president and CFO,......
.....
...
heartland, based in Princeton, N.J., said the breach did not involve merchant data, cardholders' Social Security numbers, unencrypted personal identification numbers, addresses or telephone numbers......
...
.
Baldwin said in an interview that the only information breached were card numbers and cardholders' names, or one or the other.

heartland said it was alerted by Visa and MasterCard of unspecified suspicious activity surrounding processed card transactions and enlisted the help of auditors to investigate. The investigation last week uncovered "malicious software" that compromised data in heartland's network, it said.

"We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice," Baldwin said.
......
...
..

---

quote:

---

.....heartland Payment Systems may have compromised tens of millions of credit and debit card transactions, the company said today.

---

quote:

---

.....Baldwin said heartland does not know how long the malicious software was in place, how it got there or how many accounts may have been compromised. The stolen data includes names, credit and debit card numbers and expiration dates.

"The transactional data crossing our platform, in terms of magnitude... is about 100 million transactions a month," Baldwin said. "At this point, though, we don't know the magnitude of what was grabbed.

---

quote:

---

heartland Data Breach Update: Now More Than 500 Institutions Impacted.

---

quote:

---

The law firm says it is suing on behalf of consumers whose sensitive financial information was compromised in the data breach at heartland. The complaint raises a claim pursuant to the New Jersey Consumer Fraud Act, and asserts causes of action for negligence, breach of implied contract, breach of contracts to which Plaintiffs and Class members were intended third party beneficiaries, breach of fiduciary duty, and negligence. The payments processor did not disclose how many credit card account numbers were compromised as a result of the breach.

The suit also states that heartland only became aware of the breach after it was notified of patterns of fraudulent credit card activity by VISA and MasterCard. "Analysts have stated that the fact that heartland did not detect the breach on its own suggests that it had not implemented (or was not using) all of the security controls called for by the Payment Card Industry Data Security Standard ("PCI"), a set of security controls mandated by the major credit card companies," the suit asserts.

---

quote:

---

2. Sometime in 2008, unknown and unauthorized third persons hacked
into heartland’s computer network and gained access to the Sensitive Financial
Information of an undetermined number of consumers.

3. heartland only became aware of the data breach after it was notified of
patterns of fraudulent credit card activity by Visa and MasterCard. Analysts have
stated that the fact that heartland did not detect the breach on its own suggests
that it had not implemented (or was not using) all of the security controls called for
by the Payment Card Industry Data Security Standard (“PCI”), a set of security
controls mandated by the major credit card companies.

4. heartland apparently learned that its computer systems might have
been hacked in late October of 2008, and only determined that its systems had
indeed been breached in mid January 2009. On January 20, 2009 – the date of the
Presidential Inauguration – heartland silently issued a press release that publicly
revealed for the first time that a data breach had occurred.

5. While it has belatedly disclosed the data breach, heartland has
refused to identify which of its merchants are affected by the breach. Upon
information and belief, heartland has also failed to personally notify the consumers
whose Sensitive Financial Information in a sufficiently timely manner, as required
under various state statutes that require notice of a data breach without
unreasonable delay.

6. The Sensitive Financial Information that was compromised in the
heartland data breach – which reportedly includes names and all of the information
contained on a credit card’s magnetic strip – can be used to make fake credit cards.

7. While heartland has advised cardholders to carefully monitor their
credit card statements and has set up a website with information regarding the
data breach, it has not offered affected consumers anything that may protect or
compensate them for their injuries suffered as a result of the breach, such as free
credit monitoring, identity theft insurance, or payments for freezing/unfreezing
one’s credit.

8. heartland has not revealed the number of consumers whose Sensitive
Financial Information has been compromised. However, analysts have stated that
the data breach at heartland may rank among the biggest ever reported.

---

quote:

---

A bank in Texas reports that its customers are being targeted in a phishing scam related to the heartland breach. Extraco Bank in Killeen, TX had to replace 9,000 cards that were compromised. On Saturday, the bank told customers in an email that if they received a text message or page that told them to call an 866 number and asked for debit or credit card number, expiration date and PIN numbers, to contact the bank. It is a phishing scam, the bank told its customers.

---