Wednesday, January 21, 2009

Heartland data breach may surpass TJX

By Mass High Tech staff

Heartland Payments Systems Inc. announced yesterday that it had discovered a security breach dating back to an unspecified time in 2008, affecting its processing system. While the company has downplayed the impact of the breach, saying that it “believes the intrusion is contained,” widespread online reports are citing possibly more than 100 million cards impacted.

News of the affected 100 million cards stem from Heartland’s corporate profile of serving more than 250,000 businesses and, according to several online reports, more than 100 million credit card transactions monthly.

If true, the 100 million cards would far surpass the more than 45 million credit and debit cards impacted by the 2007 TJX Cos. data breach.

Heartland president and chief financial officer Robert H.B. Baldwin, Jr. cited “widespread global cyber fraud” as the cause of the data breach.

According to a statement released from the company, “No merchant data or cardholder Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers were involved in the breach.”

Princeton, N.J.-based Heartland first heard about the breach last week when both Visa and MasterCard alerted the company to suspicious card activity. An investigation turned up malicious software as the source of the data compromise.

The company has set up a website to cover questions and concerns about the data breach, at www.2008breach.com.