Global Payments loses up to 1.5 million credit card records in data theft
Credit card processing company Global Payments has confirmed that a vulnerability within its system led to the theft of up to 1.5 million credit card records. The data breach was reported by the Wall Street Journal on Friday and the first incident report was published by security expert Brian Krebs, who cited sources within financial institutions. Krebs believes it is likely that both MasterCard and Visa customers are affected.
Credit card company MasterCard has confirmed a data theft at a card processing company and warned of the potential consequences. A MasterCard spokesperson emphasised that none of the company's computers were compromised. The US authorities have been informed and have launched investigations, he said, adding that an independent data security organisation will also investigate the case. The company didn't say exactly how many credit card accounts have been compromised. It is not known yet whether Visa data was affected, but the company has sent out a warning to its customers and has removed Global Payments from its list of providers.
According to Krebs, the computers were breached a few weeks ago, between 21 January and 25 February. He believes that the intruders stole "track 1" and "track 2" data – which can be used to create counterfeit credit cards. Global Payments has said that track 2 data "may have been stolen", but that cardholder names, addresses and social security numbers are safe.
How much financial damage has been incurred by the data theft is as yet unknown. Quoting two anonymous sources, Krebs said that transactions using the affected credit cards have so far mainly been observed in the New York metropolitan area. He also mentioned that the Public Service Credit Union (PSCU) financial service says that it has already identified 56,000 affected Visa and MasterCard accounts. Apparently, illegal activity has so far been observed in connection with 876 of these accounts.