Visa dumps Global Payments after it flashed 1.5m US card numbers
Processing firm: This was our first intrusion...
Steps to Take Before Choosing a Business Continuity Partner
Visa has dropped Global Payments from its list of approved service providers after a security breach at the firm exposed 1.5 million US card numbers.
The world's largest credit and debit card company has booted Global Payments off its list because of the "unauthorised access into a portion of [its] processing system". Global can't get back on Visa's nice list until it has revalidated its compliance processes with the payment card industry's data security standard (PCI DSS).
"It’s essential that every business that handles payment card information adhere to the highest standards to protect the security and privacy of cardholder information and remain vigilant over time," Visa said in an emailed statement.
"Validation is typically an annual process whereas actually being PCI DSS compliant is an ongoing responsibility. The PCI DSS remains an effective security tool when implemented properly – and remains the best defence for businesses against the loss of sensitive data."
Global Payments reported on Friday that it had sniffed out unauthorised access into its systems and said today that its investigation so far showed the breach had only slurped so-called Track 2 card data only, leaving cardholder names, addresses and social security numbers out of the hackers' reach.
"I am pleased to inform you we are making significant progress in defining and rectifying the breach," CEO Paul Garcia said in a conference call. "Based on forensic analysis to date, network monitoring and additional security measures, we believe that this incident is contained."
Garcia said that "on reflection, it was not unexpected" that Visa would dump it from its approved provider list.
"You are compliant, and then if something [like this] happens, by definition you're not.
"We are focused on the remediation measures necessary for a full and timely PCI reinstatement," he said, adding that the firm couldn't put any timeline on how long it would take to be compliant again.
Global Payments said that as far as it knew, there had been no fraudulent transactions reported on any credit cards, but it advised consumers to monitor their bills and make sure all their purchases were legitimate.
Garcia also said that there had been a lot of misinformation about the state of Global Payments' security. He denied reports that there had been another data breach last year, saying that this intrusion was the first.
He said that Global Payments had detected the possibility that data might have been taken three weeks ago and "within hours" it had informed the authorities and card companies. ®
COMMENTS
Security, we've heard of it...
"It’s essential that every business that handles payment card information adhere to the highest standards to protect the security and privacy of cardholder information and remain vigilant over time," Visa said in an emailed statement.
Not sure how this stacks up with NFC visa cards giving out cardholder names and places like Amazon accepting orders based on the information gained from sniffing those cards
Re: wtf?
This is down to his misunderstanding and is not in accordance with the stance of the PCI Security Standards Council. The PCI SSC and most people who deal with the PCI DSS are perfectly aware that being truly compliant still doesn't mean a breach cannot happen.
The fact that there has been a breach is indeed good evidence that the organisation was not compliant but, as you say, it doesn't prove it. So far, no organisation that has been subject to a forensic QSA assessment following a breach has proved to be compliant with the PCI DSS at the time the breach occurred, but it could indeed happen.
What he should have said is "One minute you think you are compliant, then something like this happens and you realise that you were not.".
wtf?
"You are compliant, and then if something [like this] happens, by definition you're not."
Err, no. PCI compliance is a set of standards. Just because you get broken into doesn't mean you lose compliance. It says when you patch, how often critical vulnerabilities have to be applied, etc. It provides a *best effort* methodology. A system is never hack-proof, there are always zero-day exploits and more found.
If the *founders* of PCI:DSS consider getting hacked into a measure of being not in compliance, then the methodology is broken and needs to be reworked. Most ricky-tick.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
