<!-- BEGIN MAIN CONTENT --><!-- BEGIN PRINT HEAD -->
<!-- END PRINT HEAD --><!-- BEGIN HEADLINE -->
MasterCard security breach could hit 40 mln cards
<!-- END HEADLINE --><!-- BEGIN STORY BODY -->By Spencer Swartz
MasterCard International on Friday said a security breach of credit card payment data had exposed about 40 million cards to potential fraud in the biggest such privacy violation ever reported.
An unauthorized person infiltrated cardholder data at CardSystems Solutions Inc., which processes transactions for MasterCard. About 13.9 million of those credit cards at risk are MasterCard-branded cards, the company said.
The total number of cards exposed exceeds the population of California, the most populous U.S. state.
"It sounds like the Guinness Book of World Records here," said Richard Smith, a leading computer privacy activist who runs a Web site called ComputerBytesMan.com.
There are 1.1 billion credit cards in circulation in the United States, according to the Nilson report which tracks the credit card industry.
A string of companies this year have reported stolen or misappropriated customer data, including Bank of America Corp., ChoicePoint Inc., and Reed Elsevier's .
MasterCard said its security staff identified the breach at Tucson-based CardSystems Solutions Inc., a third-party processor of payment card data. Third party processors process transactions on behalf of financial institutions and merchants.
MasterCard said social security numbers and dates of birth were not "stored on MasterCard cards." The company was not available to elaborate on what types of information were exposed and whether any wrongdoing had occurred.
The Secret Service, which helps protect U.S. financial institutions in addition to protecting the U.S. president, declined to comment, spokesman Jonathan Cherry said. CardSystems and Visa USA, MasterCard's biggest rival, were also not available to comment.
CARDSYSTEMS, LEGISLATION
MasterCard said security vulnerabilities in CardSystems processor's systems allowed the breach.
CardSystems has already taken steps to improve the security of its system, MasterCard said, adding it was giving the company "a limited amount of time" to demonstrate compliance with MasterCard security requirements.
CardSystems, which has been in business for about 15 years, processes more than $15 billion annually in transactions made online and with credit card issuers Visa, MasterCard, American Express, and Discover, according to the company's Web site.
MasterCard, based in Purchase, New York, said it immediately notified its customer banks of specific card accounts that may have been subject to compromise so they can take measures to protect their cardholders. MasterCard's roughly 23,000 customer financial institutions around the world issued 679.5 million MasterCard-branded cards in 2004, according to its Web site.
Since ChoicePoint announced in February that it mistakenly sold 145,000 consumer profiles to a ring of identity thieves, dozens of other organizations have announced security breaches of their own, ranging from banks to universities.
So far this year nearly 10 million Americans have been exposed, according to the Privacy Rights Clearinghouse.
The flood of revelations, triggered by a California state law that requires such disclosures, have prompted cries for tough national standards on privacy.
Several Democratic U.S. senators have introduced bills that would require companies to take "reasonable steps" to protect consumer account information and tell them when that information has been compromised.
Those bills have not yet attracted any Republican co-sponsors. Observers expect a more business-friendly, Republican-backed bill to be introduced as soon as next week.
New York Democratic Sen. Charles Schumer (news, bio, voting record), who has sponsored a consumer data protection law, called on Congress to move quickly to pass legislation to better protect consumer data following Friday's news.
"Hardly a week goes by without startling new examples of breaches of sensitive personal data reminding us how important it is to pass a comprehensive identity theft prevention bill in Congress quickly," he said in a statement.
<!-- start footer --><SCRIPT language=JavaScript><!--function SymError(){ return true;}window.onerror = SymError;var SymRealWinOpen = window.open;function SymWinOpen(url, name, attributes){ return (new Object());}window.open = SymWinOpen;//--></SCRIPT><SCRIPT language=javascript> var ADFadids = "1894153,2794254,2712212,1030392"; function ADFlaunch() {var w; var l="http://us.ard.yahoo.com/SIG=12ehh68tr/M=224039.1983420.3465435.1919853/D=news/S=7666528:FOOT/_ylt=AqQRhu9BiUR6KM2C14xMVzxg.3QA/Y=YAHOO/EXP=1119066464/A=1030392/R=0/id=adfeedback/SIG=12fflfvt9/*http://surveys.yahoo.com/user_ad_feedback?source=7666528:FOOT&.q28=news&.q26="+ADFadids; w=window.open(l,"AdFeedbackWin","toolbar=no,scrollbars=yes,resizable,location=no,height=400,width=640"); }</SCRIPT><TABLE width=750><TBODY><TR><TD vAlign=top align=middle></TD></TR></TBODY></TABLE><!-- SpaceID=7666528 loc=FSRVY noad-spid --><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT src="http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js" type=text/javascript></SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a){yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a6birfhb%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d8%2fY%3dYAHOO%2fF%3d826200286%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');yzq_a('a', '&U=129o12d3u%2fN%3d2mzfBkSOxIk-%2fC%3d-2%2fD%3dFSRVY%2fB%3d-2');}</SCRIPT><NOSCRIPT>
</NOSCRIPT><!-- SpaceID=7666528 loc=FR001 noad --><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a){yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a615ic8n%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d8%2fY%3dYAHOO%2fF%3d300205172%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');yzq_a('a', '&U=129hc7ahg%2fN%3d2WzfBkSOxIk-%2fC%3d-1%2fD%3dFR001%2fB%3d-1');}</SCRIPT><NOSCRIPT>
</NOSCRIPT><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a){yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a7vt9ovk%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d8%2fY%3dYAHOO%2fF%3d1662586170%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');yzq_a('a', '&U=139iahiir%2fN%3d2GzfBkSOxIk-%2fC%3d224039.1983420.3465435.1919853%2fD%3dFOOT%2fB%3d1030392');}</SCRIPT><NOSCRIPT>
</NOSCRIPT><!-- This page is brought to you by the letter L, the number 10 and p241.news.mud.yahoo.com. --><!-- recent_timestamp 2005/06/17 18:07:17 [86400] --><!-- END FOOTER -->
<!-- END MAIN CONTAINER --><!-- END OUTTER WRAP --><SCRIPT language=JavaScript><!--window.open = SymRealWinOpen;//--></SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a) yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a7n1i9hc%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d9%2fY%3dYAHOO%2fF%3d1655084509%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');if (window.yzq_gb && window.yzq4) yzq4();else if (window.yzq_eh) yzq_eh();</SCRIPT><NOSCRIPT>
</NOSCRIPT>
<!-- END PRINT HEAD --><!-- BEGIN HEADLINE -->
MasterCard security breach could hit 40 mln cards
<!-- END HEADLINE --><!-- BEGIN STORY BODY -->By Spencer Swartz
MasterCard International on Friday said a security breach of credit card payment data had exposed about 40 million cards to potential fraud in the biggest such privacy violation ever reported.
An unauthorized person infiltrated cardholder data at CardSystems Solutions Inc., which processes transactions for MasterCard. About 13.9 million of those credit cards at risk are MasterCard-branded cards, the company said.
The total number of cards exposed exceeds the population of California, the most populous U.S. state.
"It sounds like the Guinness Book of World Records here," said Richard Smith, a leading computer privacy activist who runs a Web site called ComputerBytesMan.com.
There are 1.1 billion credit cards in circulation in the United States, according to the Nilson report which tracks the credit card industry.
A string of companies this year have reported stolen or misappropriated customer data, including Bank of America Corp., ChoicePoint Inc., and Reed Elsevier's .
MasterCard said its security staff identified the breach at Tucson-based CardSystems Solutions Inc., a third-party processor of payment card data. Third party processors process transactions on behalf of financial institutions and merchants.
MasterCard said social security numbers and dates of birth were not "stored on MasterCard cards." The company was not available to elaborate on what types of information were exposed and whether any wrongdoing had occurred.
The Secret Service, which helps protect U.S. financial institutions in addition to protecting the U.S. president, declined to comment, spokesman Jonathan Cherry said. CardSystems and Visa USA, MasterCard's biggest rival, were also not available to comment.
CARDSYSTEMS, LEGISLATION
MasterCard said security vulnerabilities in CardSystems processor's systems allowed the breach.
CardSystems has already taken steps to improve the security of its system, MasterCard said, adding it was giving the company "a limited amount of time" to demonstrate compliance with MasterCard security requirements.
CardSystems, which has been in business for about 15 years, processes more than $15 billion annually in transactions made online and with credit card issuers Visa, MasterCard, American Express, and Discover, according to the company's Web site.
MasterCard, based in Purchase, New York, said it immediately notified its customer banks of specific card accounts that may have been subject to compromise so they can take measures to protect their cardholders. MasterCard's roughly 23,000 customer financial institutions around the world issued 679.5 million MasterCard-branded cards in 2004, according to its Web site.
Since ChoicePoint announced in February that it mistakenly sold 145,000 consumer profiles to a ring of identity thieves, dozens of other organizations have announced security breaches of their own, ranging from banks to universities.
So far this year nearly 10 million Americans have been exposed, according to the Privacy Rights Clearinghouse.
The flood of revelations, triggered by a California state law that requires such disclosures, have prompted cries for tough national standards on privacy.
Several Democratic U.S. senators have introduced bills that would require companies to take "reasonable steps" to protect consumer account information and tell them when that information has been compromised.
Those bills have not yet attracted any Republican co-sponsors. Observers expect a more business-friendly, Republican-backed bill to be introduced as soon as next week.
New York Democratic Sen. Charles Schumer (news, bio, voting record), who has sponsored a consumer data protection law, called on Congress to move quickly to pass legislation to better protect consumer data following Friday's news.
"Hardly a week goes by without startling new examples of breaches of sensitive personal data reminding us how important it is to pass a comprehensive identity theft prevention bill in Congress quickly," he said in a statement.
<!-- start footer --><SCRIPT language=JavaScript><!--function SymError(){ return true;}window.onerror = SymError;var SymRealWinOpen = window.open;function SymWinOpen(url, name, attributes){ return (new Object());}window.open = SymWinOpen;//--></SCRIPT><SCRIPT language=javascript> var ADFadids = "1894153,2794254,2712212,1030392"; function ADFlaunch() {var w; var l="http://us.ard.yahoo.com/SIG=12ehh68tr/M=224039.1983420.3465435.1919853/D=news/S=7666528:FOOT/_ylt=AqQRhu9BiUR6KM2C14xMVzxg.3QA/Y=YAHOO/EXP=1119066464/A=1030392/R=0/id=adfeedback/SIG=12fflfvt9/*http://surveys.yahoo.com/user_ad_feedback?source=7666528:FOOT&.q28=news&.q26="+ADFadids; w=window.open(l,"AdFeedbackWin","toolbar=no,scrollbars=yes,resizable,location=no,height=400,width=640"); }</SCRIPT><TABLE width=750><TBODY><TR><TD vAlign=top align=middle></TD></TR></TBODY></TABLE><!-- SpaceID=7666528 loc=FSRVY noad-spid --><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT src="http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js" type=text/javascript></SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a){yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a6birfhb%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d8%2fY%3dYAHOO%2fF%3d826200286%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');yzq_a('a', '&U=129o12d3u%2fN%3d2mzfBkSOxIk-%2fC%3d-2%2fD%3dFSRVY%2fB%3d-2');}</SCRIPT><NOSCRIPT>
<!-- END MAIN CONTAINER --><!-- END OUTTER WRAP --><SCRIPT language=JavaScript><!--window.open = SymRealWinOpen;//--></SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a == null) document.write("<scr" + "ipt type=text/javascript src=""http://us.js1.yimg.com/us.yimg.com/lib/bc/bc_1.7.0.js></scr" + "ipt>");</SCRIPT><SCRIPT type=text/javascript>if (window.yzq_a) yzq_a('p', 'P=mO2TH0SOwhVe7.m7QBbVvAnsRCgQzUKzfUAAAzn6&T=1a7n1i9hc%2fX%3d1119059264%2fE%3d7666528%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d9%2fY%3dYAHOO%2fF%3d1655084509%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtjcmVkaXQ7Y3JlZGl0IGNhcmRzO0l0O0FtZXJpY2E7aXQ7YnVzaW5lc3M7QW1lcmljYW4gRXhwcmVzcztmbG9vZDtzdGFuZGFyZHM7RGVtb2NyYXRpYztSZXB1YmxpY2FuO2lkZW50aXR5IHRoZWZ0O1NhbiI-%2fS%3d1%2fJ%3d62C28E44');if (window.yzq_gb && window.yzq4) yzq4();else if (window.yzq_eh) yzq_eh();</SCRIPT><NOSCRIPT>
