By Jaikumar Vijayan
January 6, 2010
Nearly a year after Heartland Payment Systems Inc. disclosed what turned
out to be the biggest breach involving payment card data, the incident
remains a potent example of how compliance with industry standards is no
guarantee of security.
Princeton, N.J.-based Heartland last Jan. 20 disclosed that intruders
had broken into its systems and stolen data on what was later revealed
to be a staggering 130 million credit and debit cards. That number
easily eclipsed the 94 million cards that were compromised in the
massive breach disclosed by TJX Companies Inc. in 2007.
However, it wasn't just the scope of the Heartland breach that made it
remarkable, but also the company's insistence that it was certified as
fully compliant with the requirements of the Payment Card Industry Data
Security Standard (PCI DSS) when it was compromised.
In public comments after the breach, Heartland CEO Robert Carr
emphatically claimed the intrusion occurred even though the company had
implemented every single one of the security controls mandated by the
PCI standard. In an interview with Computerworld last June, Carr said
the breach pointed to both the sophistication of the attacks against
Heartland and the inadequacy of relying on PCI controls alone for data
Did a friend send you this? From now on, be the
first to find out! Subscribe to InfoSec News