Security Breach Exposes 40M Credit Cards 304
The Good Reverend writes "MasterCard International announced today that a security breach at CardSystems Solutions, a third party processor of payment card data, potentially exposed more than 40 million cards. Mastercard is aware of the specific card numbers affected, and is giving its member financial institutions the numbers that may have been compromised. Unlike many of the past high profile cases this one involves a hacker rather than lost packages. CNN Money, the New York Times, Reuters, MSNBC, ZDNet, C|Net, and the Washington Post are also covering the story."
US numbers only? (Score:2, Interesting)
Cost of re-issuing cards (Score:2, Interesting)
What I would like to see (Score:5, Interesting)
being a site full of geeks (Score:4, Interesting)
but let me posit my own nontechnical solution: the processor must pay for a replacement card for every single victim
This is simply the price of outsourcing. (Score:5, Interesting)
Ok enough ranting, but trust me, in the late 90s banks were trying to outsource as many things as possible from customer service, to invoicing, bills, credit collections, applications and so on. As you can see when the "Credit card company" becomes nothing more than a brand, and a board of execs, everything is out of their control, not to mention every peice of the old credit empire is open for attack.....
If anything the question is why did it take so long to find them?!
Weakest link (Score:5, Interesting)
But they still complain, because their customers and they themselves don't ever notice. Hell at one point I was told by a demanding customer to remove the protections because he said "I'll risk it." I was tempted to show him how insecure he was by remotely accessing his system, getting his list of customer phone numbers, and telling all his customers that he was careless with credit card numbers and their numbers could have easily been stolen from his system.
People are pretty careless about credit card security. It's usually in the name of convenience and visible customer service. Credit card security is invisible service. Being able to purchase something conveniently flies right in the face of having security which just might prevent you from selling something to someone, so some people don't care, as long as they are selling. Owners care once they find out that they'll be issued chargebacks, but individual salesreps will write down every credit card number on a piece of paper if it means making money for them personally.
Visa and Mastercard have the right idea, and in the press release I like how they said that they gave cardsystems a "limited amount of time" to basically get their act together so this doesn't happen again. Education and enforcement of regulations... nice to see an organization, especially one that is a corporation, actually give a damn.
Re:Proves that the hackers... (Score:2, Interesting)
Agreed. One wonders how to trust your contractees and outsourcees. It would argue for the most data-secure companies to cut out the middleman and do their own processing.
The cynical side of me says that there lurks a propaganda campaign to be pushed here by those in favor of introducing new credit card feature, perhaps RFID or biometrics. I cannot say whether those are good solutions, but it certainly seems that some form of security that requires you to present physical evidence of your credit card or account seems in order -- may even a PIN?
Reset the Debt (Score:2, Interesting)
I mean, what do you do when something like 40 million transactions could be legit
Good thing I have online banking! (Score:3, Interesting)
However, before you do online banking, I would recommend you have both antivirus and firewall programs active and run anti-spyware programs at least once a day to keep out keystroke loggers.
Re:What I would like to see (Score:2, Interesting)
Re:What I would like to see (Score:4, Interesting)
Yes, they would like everybody to be in debt up to their eyeballs and still get 100% repayment, but the simple fact is some percentage of people who borrow to the max will have a period of unemployment, or divorce, or health problems, or simply get discouraged and choose to flake out.
Getting closer to 100% repayment would require significantly lower levels of personal debt and higher savings. It works out better for creditors, and perhaps even for the GDP of nations, to keep individuals highly motivated - on the edge of financial disaster. The ocassional losses are more than compensated by high balances at high interest.
Creditors like to take on this victim complex whenever somebody fails to repay. But in fact, all investments have risk, including loaning money to people through credit cards. That level of risk is already reflected in the high interest rates that borrowers pay on the cards. Why do companies offer these risky "payday loans"? Because the usurious interest rates and penalty fees more than make up for the losses.
Creditors also like to blame deadbeats for placing an extra burden on the rest of us good, hardworking and honest citizens. But this too is mostly false, since people are placed in different pools depending on their payment history. Those with significant credit history blemishes are already paying sky-high interest rates - a sort of security against the credit, which they will never get back even if they are perfect borrowers for the rest of their lives.
And in case you're wondering, no, I don't have bad credit. But I do have only so much pity for the credit card companies, with their crocodile tears, as they demand bankruptcy reform (favorable to themselves, of course) while socking away truckloads of profit. If our law were really putting creditors in an unfair disadvantage, credit would be hard to get, and that would be a problem. Instead, payday loan outfits are sprouting on every corner like mushrooms, and college students with no income can get as many credit cards as they like. That doesn't sound like an under-profitable industry to me.
Re:Proves that the hackers... (Score:3, Interesting)
That makes me wonder: how does the security of different payment processors correlate with their processing rates and operational cost? It seems to me, as a First National employee, that our fancy well-designed computer systems, our multiple security-related departments, etc., increase our cost of doing business, so we get beat on price by a lot of other processors. We're not the cheapest processor out there.
Since I'm not an industry expert, and I don't know what everybody else charges for processing, I'm curious: for any Slashdotters who are also merchants (own a business, accept credit card payments), does this ring true? Big company, big systems and good security, higher internal cost, higher prices? Small company, smaller systems and maybe less security, lower internal cost, lower prices?