Intellectual Property Law

Heartland Breach Affects 135 Banks and Credit Unions (So Far)

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

At least 135 banks and credit unions are reporting that their customer credit and debit cards were among those breached by intruders who hacked Heartland Payment Services last year.

The Independent Community Bankers of America association (ICBA) conducted a survey of its members to determine how many were notified by Heartland after the company disclosed on January 20th that hackers had breached its authentication system months earlier and obtained customer card account numbers and expiration dates, as well as an unspecified number of customer names.

Heartland acts as a middleman for authenticating and processing credit and debit card transactions between commercial entities -- such as restaurants and retail outlets -- and the financial institutions that issue the credit and debit cards to customers.

Heartland said it first learned of a possible breach in late October after Visa and MasterCard contacted it about suspicious transactions that appeared to indicate fraud. It took the company until mid-January, however, to find evidence of the breach on its system.

Heartland told the New York Times that the hackers had installed malicious software on its systemas early as May 2008. The company hasn't disclosed which of its customers were affected, but financial institutions that have since been contacted by Heartland stating they were affected by the breach have started to come forward.

According to the survey conducted by ICBA, 83 percent of its member financial institutions that responded to its survey said they had credit or debit cards compromised in the breach.

Bank Info Security has published a lst of 135 member institutions that say they've been affected and included, in some cases, the number of cards the institutions said were affected. Below are the institutions that reported the highest number of cards affected by the breach:

See also:

• Card Processor Admits to Large Data Breach

Full post as published by Threat Level on February 10, 2009 (boomark / email).