Network Security News

Heartland hacker identified

Monday, January 26, 2009

The cybercriminal responsible for the Heartland Payment Systems breach has been identified by the Secret Service with the hacker's location "pinpointed" outside of North America.

According to the trade publication Storefront Backtalk, the investigation has been turned over to the U.S. Department of Justice.
On Friday, a spokesman for the company said the malware attack came from a "sophisticated bug," SCMagazineus.com reports.

There is still no word as to how many of Heartland's customers were compromised from the attack, though it was confirmed by the company no Social Security numbers, unencrypted personal identification numbers (PIN), addresses or phone numbers were involved in the breach. Heartland handles approximately 100 million card transactions from 175,000 merchants each month.

Heartland's security breach is similar to past corporate attacks such as TJX, which lost an estimated 94 million credit card numbers. To date, it is still the largest reported data-loss incident in history.
Robert Carr, founder and chairmen of Heartland, told Darkreading.com the company may have found the problem sooner if security information was shared among companies in the market.

"Up to this point, there has been no information sharing, thus empowering cybercriminals to use the same or slightly modified techniques over and over again," Carr said.