blog:Lessons from the Data Breach at Heartland
Robert Carr was settling in for the evening in a New York hotel on Jan. 12 this year when at 10:30 p.m. he got a phone call that every financial services executive dreads. Carr, CEO of Heartland Payment Systems (HPY), learned that intruders might have hacked into the company’s computer network.
The next morning, his fears were confirmed. For a period starting in May 2008, cybercriminals had burrowed deeply into Heartland’s network and recorded consumers’ credit- and debit-card data. “That’s the worst thing that can happen to a payments company and it happened to us,” says Carr.
Heartland, the fifth-biggest payments processor in the U.S., had suffered what within days would be called the largest-ever criminal breach of card data. Security experts estimate that as many as 100 million cards issued by more than 650 financial services companies may have been compromised. Heartland faces class actions and inquiries by federal regulators over the matter. The intrusions not only put consumer or corporate data at risk but can also exact a high financial and public-relations toll on the companies whose systems are hacked. The TJX Companies (TJX), which operates retailers including T.J. Maxx and Marshalls, has said it incurred costs of more than $171 million related to an intrusion discovered in 2006 that resulted in the compromise of tens of millions of accounts. Costs for the average company are lower, about $6.65 million, according to a January survey by the Ponemon Institute.
Unlike peers who tend to stay mum on security breaches, Carr has gone public with Heartland’s story to encourage companies to share information about attacks and band together against cybercriminals who themselves are becoming better organized. He has divulged parts of the story previously but went into extensive detail in an interview with BusinessWeek.com.
