VISA, MasterCard Warn of 'Massive' Breach At Credit Card Processor

concealment writes with news that VISA and MasterCard have been warning banks of an incident at a U.S. card processor that may have compromised as many as 10 million credit card numbers. From the article: "Neither VISA nor MasterCard have said which U.S.-based processor was the source of the breach. But affected banks are now starting to analyze transaction data on the compromised cards, in hopes of finding a common point of purchase. Sources at two different major financial institutions said the transactions that most of the cards they analyzed seem to have in common are that they were used in parking garages in and around the New York City area." According to the Wall Street Journal, the breached company is Global Payments Inc.

Comments

No Source?

[MrJones]

The article has no credible source. Is this Spam?

Re:No Source?

[Anonymous Coward]

Krebs is all over it:

http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/

Re:No Source?

[EliSowash]

No, it's real. I saw it on Krebs earlier. http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/

Re:No Source?

[buchner.johannes]

One of these perhaps
https://www.networkworld.com/news/2012/033012-visa-mastercard-breach-257824.html
http://www.cnbc.com/id/46904168
https://www.google.com/news?ned=us&q=VISA%2C%20MasterCard%20Breach&btnG=Search+News

Re:No Source?

[CuriousGeorge113]

It seems like all of the links pertaining to this story point back to the Krebs blog as the source for the information. Yet, Krebs provides no 3rd party verification to the story other than a 'source'

Shit like this is how rumors get started. Can anyone verify with a statement from Visa/MC, a bank, etc? I'm not saying it isn't true, but even the WSJ article is referencing the Krebs blog.

Re:No Source?

[ohnocitizen]

This actually impacted me. I live in NY, and was contacted my my credit card company. They informed me I was getting a new card, that visa and mastercard said there was a breach - but were not required to report who had compromised my credit card number. "At least they tell us there is a breach". This right here is why "the market" is insufficient protection for consumer rights. We need a law requiring credit card companies to disclose businesses that compromise data.

Re:No Source?

[binarylarry]

You aren't on the hook for the fraudulent charges.

Unless they can prove you actually made them, they have to pay for the charges.

If it's all on them, why do they need to give you a detailed breakdown?

Re:No Source?

[scubamage]

Most likely its a numbers thing. If visa has 300 call center reps and they have to call 20 people, it'll be done in a few minutes. However 300 reps calling 10 million will take a much, MUCH longer amount of time. Now these numbers are hyperbolic, but you get the idea. Most likely your branch office didn't have that many people affected by the valve hack (thankfully).

Re:No Source?

[berashith]

100% agree. I just went through this a few weeks ago. VISA told my card issuer that there had been a breach. They actually sent me a new card, but didnt tell me until fraudulent use occured. This was before my new card arrived, which actually shortened the amount of time that I had no credit card. I wanted to know who had the breach, so I could avoid ever giving them business that wasnt cash based, but they would not tell me. That part pisses me off. There needs to be an awareness as to which vendors dont find it worth their time to protect me , so I can make a decision to not use them.

Re:No Source?

[Taty'sEyes]

You haven't parked in NYC have you?

Re:No Source?

[knarfling]

The WSJ has an updated story here. http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html?mod=WSJ_hp_LEFTTopStories
From the link, Global Pay seems to be the processor, and it appears that only 26,094 VISA cards were affected. It did not mention how many MasterCard cards were affected. While that is a lot, it is nowhere near the 10 million speculated.

Re:No Source?

[wickerprints]

Because all borrowers end up indirectly paying for the cost of fraud. As is the case with many forms of financial risk, a lender typically insures against identity theft and credit card fraud. The cost of that insurance is factored into their interest rate and fee calculations and is passed on to the borrower.

Granted, insurance doesn't completely absolve the insured of all responsibility, in as much as a driver with car insurance would not think to be totally careless about driving. Lending institutions still have an interest in preventing fraud despite being insured. The point is that when fraud increases, or if there's a catastrophic breach (as in this case, opposed to isolated small-scale instances of ID theft), the associated financial costs eventually reach the borrowers.

Re:No Source?

[CuriousGeorge113]

Credible sources are still fallible.

Re:No Source?

[tlhIngan]

This was before my new card arrived, which actually shortened the amount of time that I had no credit card. I wanted to know who had the breach, so I could avoid ever giving them business that wasnt cash based, but they would not tell me. That part pisses me off. There needs to be an awareness as to which vendors dont find it worth their time to protect me , so I can make a decision to not use them.

And what makes you think it was the *business* that was hacked? Retailers obtain a merchant account and the merchant bank provides the processing equipment. That equipment talks to a credit card processor who handles the transactions and transfers and such.

A credit card processor being breached means it affects MANY retailers at once. Boycotting one business over the breach may mean you're still vulnerable as your new go-to place can use the same processor.

For many businesses, there's nothing to breach - the information is temporairly stored on that terminal you use for the duration, and the only thing the retailer has is the tiny slip of paper they get at the end. Which is probably why credit card processors get attacked, rather than individual companies.

Even online companies do the same - that box you enter your information into may be temporarily hosted by the store, but the information is promptly forwarded to a credit card processor and forgotten by the store's server to reduce PCI requirements. Some make it obvious when they forward you to Google, Amazon or Paypal, or to a processor's site directly. Most don't, even though in the back end they're really proxying the processor's site.

Re:No Source?

[slew]

...I wanted to know who had the breach, so I could avoid ever giving them business that wasnt cash based, but they would not tell me. That part pisses me off. There needs to be an awareness as to which vendors dont find it worth their time to protect me , so I can make a decision to not use them.

I don't know if you can believe the story, but if the breach occured with a credit card processor and not the retailer. The Credit card processor is the retailer's vendor (e.g., the company that the retailer contracts with to process credit card batches). This vendor relationship is not unlike the company that the retailer buys paperclips from, or the company that processes their payroll. Credit card processing is a highly competitive industry. Some retailers will often switch processors every few years when competing companies offer promotions with lower merchant fees (the fees/percentage that they charge the retailer for processing a credit card transaction).

Even if you had been told what retailer the fraudulent charges were made at, since there are so many credit card processing companies, it's quite likely that the retailer didn't use the same processing company. Additionally, because of credit card merchant contracts, retailers are supposed to follow certain "merchant" rules (e..g, no minimum*** or maximum purchase amounts, no steering to different forms of payment, not allowed to require ID, etc, etc). So even if the retailer wanted to be more careful when trying to accept this apparently frauduant card transaction, they probably aren't allowed by contract to be as paranoid as you apparently want them to be...

So feel free to throw the baby out with the bath water, but it's might be just as likely that the retailer you want to disown actually helped the credit card company identify the fraudulent transaction before it appeared on your credit card statement. If that were the case, perhaps you should be thinking about thanking them, before you disown them?

*** As of part of the Dodd-Frank wall street reform act of 2010, retailers are now allowed by law to imposed a minimum transaction amount up to $10 (this law supercedes the language in the contracts in place with the credit card companies)

Re:No Source?

[wickerprints]

Your response indicates you have entirely failed to grasp the meaning of my previous post.

Government regulation of the credit card industry prevents a lender from penalizing a fraud victim in the manner that you describe. A penalty in the form of a higher interest rate may only be applied if the borrower fails to pay an outstanding balance in a timely manner. A late fee may also be assessed. This is legal because a borrower's failure to repay the incurred debt is a reflection of their poor creditworthiness relative to other borrowers who pay their balance on time. However, a victim of fraud may not have had anything to do with the theft of the information that precipitated that fraud, which is the case with this data breach.

In relation to my previous post, then, the cost of insuring against losses due to fraud is passed on IN AGGREGATE to the entire pool of borrowers in the form of higher interest rates and/or fees, just like the way in which they factor in other costs of doing business (such as worker salaries, marketing, customer service, and legal representation). Competition between lenders exerts pressure to keep the interest rate low, but if the overall rate of fraud increases across ALL lenders, then the overall financial risk of lending money in this manner has also increased, and therefore the interest rate must also increase to reflect this risk trend.

To be absolutely clear, I am not talking about a scenario in which an individual borrower reports fraudulent activity on their account, and the lender then decides to punish that borrower by increasing their interest rate. What I am talking about is the big picture, in which the cost of credit card fraud and ID theft is spread out over the entire pool of borrowers because the risk of fraud is one component of the risk of lending money, and the risk of lending is part of why interest exists. Granted, this is a gross simplification of the way things actually work (as I do not discuss the role of merchants in this process, for example), but the basic point remains valid: the cost of fraud is eventually paid by the borrower. Even the merchants purchase insurance for their business, and factor these costs in the pricing of the goods and services they sell to consumers. All of it eventually falls on the shoulders of the consumer, who pays for it in the form of higher prices or higher interest.

Really, no fucking article?

[Anonymous Coward]

And slashdot gets increasingly pathetic. Well, if anyone cares to RTFA:
http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html

Not a whole lot of info from any source, Krebs seems to be the best though:
http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/#more-14393

Sketchy source is sketchy

[milbournosphere]

Here's an article from the WSJ: http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html

That said, a window of 21 Jan to 25 Feb...that's quite a big window...

Let's hope

[JamesP]

It had nothing to do with idiots like these: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

Re:Let's hope

[jeffmeden]

It had nothing to do with idiots like these: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

Good read... From the story:

PCI SSC have responded and are investigating him and the company. Our software has now moved on[...]

Phew!

[...]to PayPal so we know it's safe,

ah FUCK

Thankfully!

[fuzzyfuzzyfungus]

Luckily, nobody would be stupid enough to build a money transfer system where the user ID and the authentication secret are identical, so this breach should be no big deal.

Oh wait.

Fuck.

Re:Thankfully!

[Anonymous Coward]

What do you expect when the parties that can best improve security (banks, VISA, Mastercard) have made sure that merchants (who can do very little about security) carry most of the liability from security failures?

Banks, VISA, and Mastercard make tons of money from transaction fees, so they want to make transactions as easy as possible. They don't have to pay much for security breaches, so they are willing to sacrifice security for more transactions and more fees.

If a buyer goes into a store with a stolen card, there is practically nothing a merchant can do to detect the fraud and stop the buyer from walking out the door with merchandise. Who pays for the fraud? The merchant.

Until banks are on the hook for this fraud, nothing will change.

Re:Thankfully!

[Anonymous Coward]

Never mind that the merchant can utter the words "can I see your ID?" and then, in one brilliant move, authenticate AND authorize the user of said card...

Actually, Visa prohibits merchants from asking to see your ID. Lots of stores do it anyway, but it's a breach of their Terms of Service.

Re:Thankfully!

[forand]

As someone else who replied to your message noted: VISA (and in face MasterCard) explicitly forbid this in their terms of service. More can be found here which also links directly to the TOS in question.

Credit Card Fraud generates profits for banks

[Dainsanefh]

because each time when there is a chargeback, the bank will take back the money from the merchant + $25 per transaction as a penalty. They have no incentives to make the system more secure.

Re:Hahah.

[tripleevenfall]

Suck it, Tri-State Area!

Re:Criminal

[LizardKing]

Yup, WSJ confirms it: http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html