Banking Law

Data Breaches: On The Rise and Striking the Heartland

While most honest citizens are recovering from the hangover induced by the Obama Inaugural Extravaganza, the few rotten apples in the barrel have been busy little bees. Last week, the WSJ reported that last year, businesses reported 656 data security breaches, up 47% from the previous year. Much of that increase may be due to the expansion of state laws that require notification of such breaches, according to the Identity Theft Resource Center. More distressing was the news that over 35% of the breaches were due to human error, and worse, that insider abuses that resulted in data breaches were double those of 2007. "The Bozo Factor" that affects employees can be mitigated by training, and by implementing policies and procedures that are rigorously enforced, but as we've noted before, a banker's worst nightmare is the rogue employee. If an employee's bent when he starts working for you, it's doubtful that any training will straighten him or her out.

Yesterday, the news did not get better. Heartland Payment Systems Inc., a major credit-card processor, disclosed a data breach "that analysts said may be among the biggest ever reported."

Heartland Payment Systems Inc. said Tuesday that cyber criminals compromised its computer network, gaining access to customer information associated with the 100 million card transactions it handles each month.

The company said it couldn't estimate how many customer records may have been improperly accessed, but said the data compromised include the information on a card's magnetic strip -- card number, expiration date and some internal bank codes -- that could be used to duplicate a card.

100 million rockets past the previous record of 45 million, set by TJX (which we last discussed here). Heartland's president said that his company was targeted by malicious software that "light-years more sophisticated" than what is usually downloaded from the Internet by your average stooge. This points up another problem we've often discussed: the crooks are smart cookies. Bet you a dollar to a donut that they came from Eastern Europe. That area of the world appears to be breeding gifted amoral cyber thieves at a rate that would make your average Mafia don green with envy.

An analyst at Forester Research estimates that the average data breach costs $300 to $600 in fraudulent purchases, fees and legal costs, for a total of hundreds of millions, perhaps in excess of a billion, of dollars to be spread around between Heartland, the card issuing banks, and others (including merchants who are duped by the fraudulent use of the stolen data).

It's tough becoming the poster child of data breaches. Coming in the midst of an economic maelstrom makes it all the tougher to deal with. On the other hand, most of the average citizenry will have little sympathy for Heartland. The man on the street may sell his e-mail password for a discount card to Starbucks, but he expects businesses, especially those that handle sensitive personal and financial information, to be impenetrable fortresses when it comes to data security. That may not be fair, but it's just the way it is.

Speaking of the TJX fiasco, the Maine Bureau of Finacial Insitutions released a report that showed the financial costs to banks in that state from the TJX and other data security breaches. The TJX breach cost banks from $60 to $32,146 in card reissuance expenses. H/t CSBS

Full post as published by Bank Lawyers Blog on January 21, 2009 (boomark / email).