June 20, 2005 4:51 PM PDT

Details emerge on credit card breach

Related Stories

Credit card breach exposes 40 million accounts

June 17, 2005
More details emerged Monday on the cyberbreak-in at a payment processing company that exposed more than 40 million credit card accounts to fraud.

The data security breach, possibly the largest to date, happened because intruders were able to exploit software security vulnerabilities to install a rogue program on the network of CardSystems Solutions, MasterCard International spokeswoman Jessica Antle said. The program captured credit card data, she said.

The malicious code was discovered after a probe into the security of CardSystems' network. That investigation, by security experts from Cybertrust, was triggered by a MasterCard inquiry into atypical reports of fraud by several banks. The trail led to CardSystems, Antle said.

The probe also found that the Atlanta-based payment processor did not meet MasterCard's security regulations. CardSystems held onto records that it should have discarded, and it stored transaction data in unencrypted form, Antle said.

MasterCard declined to disclose more information on the breach, citing an ongoing investigation by the FBI. CardSystems did not respond to e-mail messages and phone calls seeking comment. A Cybertrust representative declined to comment on the case.

Online discussion boards, meanwhile, are abuzz about which vulnerable software CardSystems may have been running. The data processor's Web site runs on Microsoft's Windows 2000 operating system and IIS Server 5.0, which has fueled speculation that its other set-ups may also be Microsoft-based.

Into the breach
CardSystems said in a statement Friday that it had identified a "potential security incident" on Sunday, May 22, and called in the FBI the next day. Visa and MasterCard were also contacted, the company said. MasterCard went public with the CardSystems' breach on Friday after it had identified all the affected accounts, Antle said.

More than 40 million credit card accounts were exposed by the breach. About 22 million of those are Visa cards and 13.9 million are MasterCard, the companies have said. The remaining accounts were linked to other brands, including American Express and Discover.

While millions of accounts were potentially accessed by the attackers, the investigation into the theft has found that records covering about 200,000 cards were transferred outside the CardSystems network, Antle said. Of those records, 68,000 are for MasterCards, she said.

The thieves got access to names, account numbers and verification codes that could be used to commit fraud. However, the information did not include social security numbers, addresses or birth dates, which would be needed for identity theft.

CardSystems is one of many companies that process electronic payments. The company handles more than $15 billion in card transactions annually for more than 105,000 small and medium-size businesses, according to its Web site.

All the major credit card companies protect their customers against unauthorized transactions on their accounts. Fraudulent transactions are typically reversed. Cardholders should monitor their accounts online and contact the credit card company or card-issuing bank when fraud is suspected, experts said.

Staying mum
MBNA, one of the largest U.S. credit card issuers, said it has received information from CardSystems about exposed customer accounts. The company won't contact the individuals affected but is keeping a close eye on the compromised accounts, said Jim Donahue, an MBNA spokesman. In a case of fraud, an account would be closed and a new card issued, he said.

American Express is still deciding whether to contact its customers. Christine Elliott, a company spokeswoman, said accounts were exposed, but she did not disclose how many. In a case of fraud, she said, American Express would bear the financial burden, assuming the merchant has followed all standard card acceptance procedures.

MBNA would also not disclose how many of its customer accounts were compromised.

The CardSystems breach follows several high-profile data loss incidents that potentially exposed American consumers to identity theft. Two weeks ago, CitiFinancial said tapes containing unencrypted information on 3.9 million customers were lost by the United Parcel Service while in transit to a credit bureau. CitiFinancial is the consumer finance subsidiary of Citigroup.

In past months, data leaks have been reported by Bank of America and Wachovia, data brokers ChoicePoint and LexisNexis, and the University of California at Berkeley and Stanford University.

Two recent surveys have highlighted growing worries about data protection. Last Wednesday, the Cyber Security Industry Alliance reported that 97 percent of the American voters it polled said identity theft was a problem that needs addressing, and 64 percent wanted the government to do more to protect computer security.

In addition, a study commissioned by Adobe Systems and RSA Security found that eight out of 10 "senior-level professionals" in Washington, D.C., thought that lawmakers weren't doing enough to keep consumer data safe.

5 comments

Join the conversation!
Add your comment
Well no wonder, it's Windows
Regardless of one's take on the reason why Windows security is so commonly breached, to use Windows for anything which requires the utmost security is just plain foolish. I'm not at all surprised by this and credit companies really should be expected to adhere to much more stringent security or else find themselves in court every 6 months due to recurring account theft.
Posted by Freiheit13 (92 comments )
Reply Link Flag
Yes But !!!
The Report did say that Cardsystems did not Follow procedure and Delete the information, And also some transactions were stored in unencrypted form, so even if another operating system was used, the lion share of the blame goes to Cardsystems.
Posted by (32 comments )
Link Flag
The lowest bidder and don't check twice
Hey, MasterCard, thought you was going to safe a bundle by outsourcing hey?

"The probe also found that the Atlanta-based payment processor did not meet MasterCard's security regulations. CardSystems held onto records that it should have discarded, and it stored transaction data in unencrypted form, Antle said."

Man it takes a breech for them to check their contractors security? Rich. Hope someone takes MasterCard to the cleaners for dereliction of duties.
Posted by Albertv (92 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.