Security breach may have exposed 40 million credit cards

A hacker was able to access potentially 40 million credit card numbers by infiltrating the network of a company that processed payment data for MasterCard International and other companies, MasterCard said Friday.

MasterCard has notified banks that issue its credit cards about the security breach, which victimized CardSystems Solutions, a Tucson, Ariz., back-office processing company, said Jessica Antle, a MasterCard spokeswoman. Those banks will then take steps to notify their customers as they see fit, she said.

The network at CardSystems had certain vulnerabilities that allowed an outsider to access the card numbers, 13.9 million of which were connected to MasterCard cards, Antle said. MasterCard's fraud detection system first became aware of the infiltration in May, and the company promptly launched an investigation into the breach.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

A hacker was able to access potentially 40 million credit card numbers by infiltrating the network of a company that processed payment data for MasterCard International and other companies, MasterCard said Friday.

MasterCard has notified banks that issue its credit cards about the security breach, which victimized CardSystems Solutions, a Tucson, Ariz., back-office processing company, said Jessica Antle, a MasterCard spokeswoman. Those banks will then take steps to notify their customers as they see fit, she said.

The network at CardSystems had certain vulnerabilities that allowed an outsider to access the card numbers, 13.9 million of which were connected to MasterCard cards, Antle said. MasterCard's fraud detection system first became aware of the infiltration in May, and the company promptly launched an investigation into the breach.

However, the complicated investigation was not completed until earlier this week, when MasterCard was able to determine which credit card numbers were exposed and notify the banks that issued those cards, Antle said. Ubizen handled the initial forensic investigation, and the case has also been turned over to the FBI. As far as MasterCard is aware, the person who infiltrated the CardSystems network has not yet been identified, she said.

Companies such as CardSystems process payment data for multiple credit card companies, which is why MasterCard numbers only accounted for 13.9 million of the numbers, Antle said. No other types of personal information, such as Social Security numbers, were compromised in the breach, she said.

Cardholders can dispute purchases that were not made by them with the bank that issued their card, and card holders will not be held liable for any purchases determined to have been made fraudulently, Antle said.

Security breaches don't always happen through hacking into a company's network. Citigroup recently notified customers that the credit information of 3.9 million customers was inside a package that disappeared while in transit from New Jersey to Texas in the care of UPS.

The IDG News Service is a Network World affiliate.