CardSystems Data breach case

CardSystems, as a credit card processor and aggregator who processed cards for most of the major processors, was a high profile target for this sort of fraud.

As a result, they were told they had to comply with data security standards. CardSystems contacted an auditor and in June 2004 they were certified as compliant. Relevant to the case, this standard certified that they were following a high standard of security and data was encrypted.(wired.com 2005 via archive.org)

On June 17th 2005 Mastercard disclosed that there had been a major data breach at CardSystems (Securityfocus). The issue of who discovered the fraud has been debated. CardSystems claimed they discovered it, while Mastercard stated that they tracked it back externally (CNN).

The result was the same. 40 Million credit cards had been compromised.

As with an increasing number of cases, the CardSystems case appears to have been an external fraud with no inside help.

Internet news quotes a statement covering the hack, but more information is available from Xiom and The FTC Complaint. Here is a summary:

It appears that a hacker or hackers gained access to the system through a web application which customers used to access their own data. They used a SQL injection attack, where a small snippet of code is inserted onto the database through the front end (browser page). Once inserted onto the server the code ran every four days. It gathered credit card data from the database, put it in a file (zipped to reduce size) and sent it to the hackers via FTP.

Three such files were downloaded, with over 200,000 credit card details in them.

On the 19th July 2005 Visa, unhappy with the corrections CardSystems had made following the breach, announced that it was withdrawing the right for CardSystems to process payments on its behalf. It gave the banks that had used them until October to find another payment processor.

This was the final recourse of any of the card providers, and using it caused a stir. CardSystems stated that they hoped Visa would reconsider, only for Amex to follow Visa's lead a few days later. (Opinion piece)

With the loss of two of the major providers and the banks that took those cards taking business elsewhere, CardSystems' future was in doubt.

The case opened up a can of worms, and the legal effects are still ongoing.

The question of liability was tricky. Because of a law change, card-owners have to be notified if their card is stolen. This raised the hotly debated and ongoing question of who notifies them and who is liable for the cost.

CardSystems and its purchaser face independent security audits every other year for the next twenty years.

Four years later, in May 2009, the case made the news again. One of the banks affected began a lawsuit against Savvis, the auditors who stated that CardSystems was compliant. (Wired, June 2009) They estimate the case cost them nearly £16M.

If you would like to know more about the case, as well as the articles I have linked to throughout, here are a few others used for background detail.

Please note the last article deals with the Savvis Lawsuit, where one of the banks is now suing CardSystems auditor.

The Card Systems case was overshadowed by the TJX case, and now the revelations about Heartland and RBS. Are there any comments about the case, questions that the lens raises, or anything you think I've missed? Let me know here.