CardSystems Solutions, the credit card payment processor at the center of one of the biggest data breaches, said yesterday that it hoped to comply with the industry's security standards by the end of August, at least eight months after data thieves installed software on its computer network to facilitate a break-in.
CardSystems disclosed last month that its computer network in Tucson had been compromised, putting the sensitive account information of as many as 40 million cardholders at risk for fraud.
The company's chief executive, John M. Perry, acknowledged that CardSystems had been improperly storing data, violating Visa and MasterCard security rules.
Yesterday, CardSystems said that it had hired AmbironTrustWave, a security auditor based in Chicago, to assess its data protection technology, policies and practices. Mr. Perry said on June 19 that data thieves had obtained from CardSystems' computer network a file containing the names, account numbers and security code data of about 200,000 cardholders. A person briefed on the matter said that software had been installed secretly on the network to facilitate the theft.
MasterCard and Visa said that storing the information on the 200,000 cardholders, even for what Mr. Perry called "research purposes," was in violation of their security rules.
At the time, Mr. Perry said that the company was taking steps to remedy that practice and that it "no longer stored that data on files." It is unclear if CardSystems was working with another security specialist at that time, but since the incident was disclosed, it said it had bought new software to bolster data protection.
While MasterCard disclosed the incident on June 18, it said that it had focused on CardSystems from as early as April. MasterCard did not conclude that the processor's systems had been breached until a forensic investigation by Cybertrust of Herndon, Va., in mid-May. But an Australian bank said that it was able to detect fraud related to CardSystems as early as the end of last year.
Even before the breach, CardSystems had taken steps to improve its security. In December 2003, it hired Cable and Wireless Americas, now part of Savvis Communications, to conduct a similar security audit for compliance with Visa rules. Savvis said the company made some improvements and was certified by Visa in June 2004. MasterCard said CardSystems was never certified as compliant with its security rules; Visa said CardSystems was no longer in compliance after Visa investigated the processor in May.
Nonetheless, CardSystems was allowed to handle millions of consumer transactions handled by both card companies and other major brands like Discover Financial and American Express.
The hiring of a new security auditor is a first step as CardSystems works to meet with the payment industry's security rules that have often been loosely enforced.
Still, CardSystems has several other inquiries on its hands. Both the Federal Bureau of Investigation and a group of federal banking regulators are investigating the company, and a group of state attorneys general has sent letters requesting information on the break-in.