Intellectual Property Law

Visa and MasterCard have issued alerts warning of a security breach at yet another payment processor.

The two credit and debit card issuers are warning financial institutions that malicious software was  placed on the network of a payment processor, according to an announcement posted by the Tuscaloosa VA Federal Credit Union. The announcement was uncovered by Databreaches.net.

This would make it the second payment processor reporting a major breach in a month, following an announcement last month from Heartland Payment Systems that it had been hacked as well.

The breach involves stored information from card-not-present transactions ? purchases conducted over the phone or internet. The breach exposed card numbers and expiration dates, but not PINs or personally identifiable information stored on the card's magnetic stripe, such as the account holder's name.

This limits the amount of fraud someone can conduct with the card since a fraudster would not be able to create a cloned card to use in person at a retailer, and would have difficulty using it with an online merchant that asks for the security code printed on the back of the card or verification of the cardholder's billing address.

It's not known how many cards are at risk, but the announcement indicates that the malicious software was on the payment processor's system from February 2008 until last month.

The announcement says Visa and MasterCard are unwilling to name the processor because that company hasn't gone public with the breach. Tuscaloosa Credit Union has not responded to a call for comment. Visa and MasterCard also have not returned phone calls.

A second announcement on a website for the Pennsylvania Credit Union Association says that Visa and MasterCard held a conference call with issuing banks on Feb. 12 to discuss the new breach.

DataLossdb, a website that tracks breach news, began reporting on Feb. 13 that it was receiving tips that a second payment processor had been breached. The tips varied on the scale of the attack: Some indicated the new breach was larger than the breach at Heartland Payment Systems. Others said it's smaller.

In January, DataLoss received a tip about a large breach a week before the Heartland Payment Systems  acknowledged on Jan. 20 that it had been hacked. More than a hundred financial institutions, and an unknown number of cardholders, have been affected by that breach.

Photo: Andres Rueda/Flickr

See also:

• Card Processor Admits to Large Data Breach
• Heartland Breach Affects 135 Banks and Credit Unions (So Far)