Payment Processor: Up To 1.5 Million Credit Card Numbers Stolen

The news from the hacked third-party payment processor for MasterCard and Visa got worse over the weekend, as early reported estimates of around 50,000 card numbers put at risk turned out to be wrong by 1.45 million.

In a statement to Consumerist, a rep for Global Payments writes:

The company believes that the affected portion of its processing system is confined to North America and less than 1,500,000 card numbers may have been exported. The investigation to date has revealed that Track 2 card data may have been stolen, but that cardholder names, addresses and social security numbers were not obtained by the criminals. Based on the forensic analysis to date, network monitoring and additional security measures, the company believes that this incident is contained.

The company continues to work with industry third parties, regulators and law enforcement to assist in the efforts to minimize potential cardholder impact. It has engaged multiple information security and forensics firms to investigate and address this issue.

While the company’s CEO says “We are open for business and continue to process transactions for all of the card brands,” the Wall Street Journal reported last night that Visa had removed Global Payments from its list of “compliant service providers.”


Edit Your Comment

  1. OSAM says:

    “Confined to North America” and then mentioning “social security numbers” = USA. Canada has Social Insurance Numbers.

  2. zegron says:

    You called 1.5 million stolen card numbers contained? Holy smokes…

    • NeverLetMeDown says:

      Contained = not getting worse.

    • jvanbrecht says:

      Could be worse, the TJMAX parent company incident resulted in 80+ million card numbers being stolen. As previously noted, contained just means no more data exfiltration, and has nothing to do with the scale of the loss.

    • Fineous K. Douchenstein says:

      Initial reports on Friday put this one at 10 million.

  3. Dr. Ned - This underwear is Sofa King Comfortable! says:

    ‘Contained’ in as much that the damage to the Titanic was ‘contained’.

  4. NotLeftist says:

    What is this “track 2” thing? How can I discover if I’m at risk? How many executives at these companies need to be executed before any real security gets implemented?

    • pegr says:

      “Track 2” is the data contents of the magnetic stripe on the back of the card. It means that the affected cards can be cloned. It’s a violation of card rules to store track 2 data, as it contains the encrypted PIN block, and is considered “sensitive authentication data”.

      My guess is that card processor will be out of business shortly.

  5. fsnuffer says:

    When are they going to run out of CC numbers?

  6. Fineous K. Douchenstein says:

    I had read about this on Friday, and the word then was an estimated 10 million accounts compromised. So who were the idiots that put the estimation out at 50,000? Also, how is it that it’s now 1.5 million? Who keeps pulling these numbers out of their collective ass?

  7. Thorzdad says:

    Any word on whether they are going to inform the affected cardholders? Or is this going to be another one of those “keep an eye on your statement and challenge any suspect charges” things?

  8. dolemite says:

    Isn’t it interesting how corporations always lowball the initial estimates of a disaster? At first it was only a few thousand, then 50k, now 1.5 million.

    Like BP said only 5k gallons of oil were leaking per day, when it was actually closer to 100k.

  9. daemonaquila says:

    Contained? I was one of those “lucky” people. I found out today when my card was declined. I called my bank and found out that it was flagged due to a charge from a “known fraud source.” (My bank sent me an automated email about half an hour later… ugh.) Apparently, part of the way they figured out how many got breached was the spate of test transactions that started in short order. Thanks, jerkoffs. I have a tremendously busy week ahead of me, and it will take 5 days to get a new card after canceling this one. I got cash out of the bank, but that’s a pain when you’re doing a ton of driving for work and have to buy gas, etc.