Malicious software delivered to its computer network through the Internet broke into records of credit card account information in the second half of last year, though the security breach did not include passwords and other information typically needed to process payment transactions, Heartland Payment Systems revealed this week.
"We found evidence of an intrusion last week and immediately notified federal law enforcement officials as well as the card brands," Robert H.B. Baldwin Jr., Heartland`s president and chief financial officer, said on Jan. 20. "We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice."
Criminals were able to access credit card account numbers and cardholder names, but not related information typically needed to process card transactions, a spokesman says. “What’s important to note is that the breach did not compromise Social Security numbers, PIN numbers, CV2 numbers or cardholders’ mailing addresses,” the spokesman says. CV2 numbers are used to identify an actual plastic card, so that criminals cannot complete fraudulent online transactions by only using a payment card account number.
The spokesman adds that the network breach cut through 37 different layers of security software that protect the Heartland computer network. “We have an extremely tough firewall, and we’re looking into how they broke through it,” he says.
He adds that Heartland believes that the malicious software has been contained, and that the Princeton, NJ-based company is looking at a next-generation security system that, among other things, will automatically flag suspicious network activity and forward notices of them in real time to law enforcement agencies.
Heartland says it discovered the breach after it was initially alerted about suspicious card transaction activity by credit card companies Visa and MasterCard. Heartland then used a team of forensic auditors to uncover the use of malicious software delivered to its network over the Internet.
Payment security experts say the type of attack that hit Heartland represents a significant trend in criminal activity. “The data breach at Heartland Payments represents an important security trend, that of malware increasingly infecting corporate servers and not just individuals’ PCs,” says James Van Dyke, president of Javelin Strategy & Research, a payments industry research and advisory firm.