Heartland Payment Systems on Tuesday revealed it was the victim of a system security breach. The hack occurred in 2008, and Heartland believes the intrusion has been contained.
According to the company, no merchant data or cardholder Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers were involved in the breach.
Robert H.B. Baldwin Jr., Heartland’s president and CFO, said the company discovered suspicious activity last week and immediately notified federal law-enforcement officials as well as the payment card brands.
“We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice,” Baldwin said.
250,000 Companies at Risk
Heartland delivers credit/debit/prepaid card processing, payroll, check management, and payments solutions to more than 250,000 business locations nationwide.
It discovered the breach after Visa and Mastercard reported suspicious activity surrounding processed card transactions. Heartland engaged forensic auditors to conduct an investigation that uncovered malicious software compromising data on Heartland’s network.
Heartland said it immediately took steps to secure its systems. Heartland is also implementing a next-generation program designed to flag network anomalies in real time and enable law enforcement to apprehend cybercriminals.
“Heartland apologizes for any inconvenience this situation has caused,” Baldwin said. “Heartland is deeply committed to maintaining the security of cardholder data, and we will continue doing everything reasonably possible to achieve this objective.”
An Expensive Attack
Michael Argast, a security analyst at Sophos, said the Heartland breach may not be as bad as it looks — it may be worse. This is going to be a painfully expensive experience for Heartland, he said, because the costs don’t stop at disclosure, lack of good faith with merchants, or regulatory penalties. The cost of securing Heartland’s environment and fixing the data loss could run into the millions or…