[ISN] Citibank cards pulled after network breach

[InfoSec News]

http://www.networkworld.com/news/2006/030706-citibank-network-breach.html

By Robert McMillan
IDG News Service
03/07/06

Citigroup is reissuing MasterCard credit and debit cards used in the
U.K., Russia and Canada, saying they may have become compromised
following an unspecified breach of its network.

"Last year, Citibank and our customers were the victims of a
third-party business' information breach," the company said Wednesday
in a statement. "In mid-February, we detected several hundred
fraudulent cash withdrawals in three countries. We are currently
reissuing cards, as appropriate, to affected customers."

In an earlier statement, published in media outlets, Citigroup said
that the accounts may have been compromised in "previous retailer
breaches in the U.S.," and that the company was aware of fraudulent
ATM cash withdrawals being made in the U.K., Russia, and Canada. The
company did not say how many cards were affected by these breaches.

Citigroup, which does retail banking under the name Citibank, did not
provide any details on the retailer breaches that prompted this
action, but it said it has blocked PIN-based transactions on some
cards in those three countries.

Last week Wal-Mart Stores' Sam's Club members-only retail chain
confirmed that it was looking into a possible compromise of its fuel
station point of sale system. But no PINs were used in any of the
fraudulent transactions reported in this case, which involved about
600 cards, according to Wal-Mart.

News of the Citigroup breach first surfaced over the weekend, when
Boing Boing Web site contributor Jake Appelbaum reported that he had
been unable to use a Citibank ATM card in Toronto.

After calling Citibank customer service on Saturday night, Appelbaum
was told that he would have to return to the U.S. to change his PIN
number before the ATM component of his card would be useable again.  
"They told me by using my ATM card on the Canadian network it
automatically locked the ATM portion of my card," he said in an
interview Tuesday.

The MasterCard portion of the card continued to work normally, but
Appelbaum was left frustrated by the fact that he was unable to access
the cash in his bank account as he waits for a reissued card, and that
Citibank could not say whether the new card will work in Canada. "I
was dumfounded by that," he said. "It was the worst customer service
I've ever heard of from a bank."

He had some advice for Citibank customers travelling abroad. "Cancel
your account and get a new bank," he said. "I'm going to close my
Citibank account, not just because of the security problems, but
because of the way they deal with their customers when they're
stranded."