Heartland Commended for Breach Response

Heartland Payment Systems Inc. CEO Robert Carr is getting high marks from some analysts for his response so far to a massive data breach discovered at the credit- and debit-card payment processor early this year.

The breach may have been the largest ever involving payment card data -- some analysts estimate that data from more than 100 million cards may have been exposed in the intrusion, which Heartland disclosed on Jan. 20.

Since then, Carr has moved to accelerate an end-to-end encryption project for protecting card data. It is now slated for completion in the third quarter.

Princeton, N.J.-based Heartland is also pushing for development of an industrywide standard for encrypting data while it's being transmitted over networks, and it has co-founded the Payments Processing Information Sharing Council, through which payment processing companies can share information about security threats, vulnerabilities and fraud.

In an interview last week, Carr said he has also reached out to customers, industry groups, security analysts and reporters to discuss the company's response to the breach.

Avivah Litan, an analyst at Gartner Inc., said Carr took a different approach than most CEOs have taken in similar situations.

"Generally when something like this happens, the CEOs hide," she said. "Some might question his real motives. But the bottom line [is], he is elevating the debate around card security and even got card companies to speak about end-to-end encryption."

Tom Wills, an analyst at Javelin Strategy and Research, said Carr's response compares favorably with that of El Al Airlines after a series of plane hijackings in the 1970s.

"El Al redesigned its security from the ground up and went on to build a reputation, one that it holds to this day, as the world's most secure airline," Wills wrote in an alert this month. Based on Carr's moves so far, "it's clear that Heartland intends to take the El Al route," Wills added.

Carr said the breach fulfilled one of his worst fears as CEO of Heartland. "It was devastating," he said. "People had asked me for years 'What keeps you awake at night?' and I would keep telling them it was the fear of a data breach."

This version of the story originally appeared in Computerworld 's print edition.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.