January 21, 2009
-
News: So, What Happened at Heartland?
The major credit card payment processor, Princeton, New Jersey-based Heartland Payment Systems, just found out about the incident. An undisclosed number of credit card accounts have been compromised. The statement from Heartland's President and Financial Executive Officer, H.B. Baldwin Jr. was "We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice." Heartland, the sixth-largest processor in our country processes about 100 million credit card transactions every month. No word yet on how many credit cards have been compromised by the thieves.
By use of malicious spyware, hidden in the company's secure computer network system, these thieves went undetected until the credit card associations, VISA and MasterCard, began discovering a growing number of suspicious activities that lead back to Heartland's submissions to them. Heartland immediately called in software security auditors to comb their networks. What they found was that the perpetrators "were grabbing numbers with ‘sniffer malware' as it went over [their] processing platform." The bad news was that they confirmed that full credit card numbers, complete with the owners' names were exposed.
The good news was that the more vital data such as CVV2 codes, PINs, SSNs, phone numbers and billing addresses were all encrypted and not usable by the thieves. However, enough ‘mag stripe information was stolen to produce counterfeits of these cards, minus having the CVV2 code on the backs of cards. CVV2s are used for transactions where the credit card itself is not physically present during the transaction (like over the phone).
What credit holders need to do now (and always should do) is closely go through their credit card statements for suspicious activities. Particularly suspicious are $1.00 transactions. Often, these minor charges are used by thieves to ‘test the waters' before making a really big transaction. Report any suspicious activities to your credit card lending institution immediately, especially any unauthorized charges. For the time being, Heartland has set up an informational web site at the address WWW.2008Breach.com. You are encouraged to access this site with further questions.