OSAC Item (Printer Friendly Version)

[an error occurred while processing this directive]

CurzTech News Network

OSAC Item (Printer Friendly Version)
from C|Net Networks on Thursday, February 20, 2003

The FBI is investigating a recent computer hacking incident in which as many as eight million credit card numbers may have been stolen from a company that processes transactions, industry representatives and investigators say.

In what is believed to be the biggest credit card hacking incident so far, Omaha-based Data Processors International, which processes transactions involving Visa, MasterCard, American Express and Discover Financial Services for merchants, said in a statement that it had "recently experienced a system intrusion by an unauthorised outside party".

"We are aware of the matter and looking into it," said FBI spokesman Paul Bresson, who said he could not comment further on the pending investigation.

The credit card issuing agencies said there had been no evidence that the numbers had been fraudulently used and cited "zero-liability" policies under which consumers would be protected in the case of fraud.

A MasterCard spokeswoman put the total number of credit cards exposed at around 8 million.

When news of the breach first became public on Monday, Visa and MasterCard pegged the number of credit cards exposed at 3.4 million and 2.2 million, respectively.

American Express said their number was "significantly less" than those figures, and Discover declined to give a number.

MasterCard has said it began notifying its members of the situation during the week of 3 February.

"There is an epidemic of credit card thefts from banks and e-commerce companies," said Alan Paller, research director at the Bethesda, Maryland-based System Administration, Networking and Security Institute.

Paller and David Robertson, publisher of The Nilson Report, a credit card industry trade journal in Oxnard, California, said they believed the case was the biggest theft of credit card numbers in history.

Black market sales While consumers are protected from liability, the credit card issuers will have to pay about $4 to $5 each, or about £2.50 to £3 each, to replace the cards, putting the total cost at between $32m to $40m, said Robertson.

"The real losers here are the (card) issuers themselves and potentially (Data Processors International), depending on how much insurance they have," he said. "The costs to issuers are not only just the new piece of plastic and mailing the card, but the customer service issues, such as notifying the card holders."

Credit card institutions are prime targets for organised crime groups who try to extort money out of them and sell the card numbers on the black market, according to Paller.

In one of the first cases to became public, a hacker in Russia stole an estimated 300,000 credit card numbers from CD Universe and posted them online after the online music store refused to pay him money three years ago.

"These are sophisticated criminals; it's big business," Robertson said. "Credit card numbers stolen in the US can end up on counterfeit cards in another part of the world."

There have also been inside jobs at credit agencies. In November, three New York men, including one who worked at a company that provides access to consumer credit information, were charged with orchestrating the largest identity theft scheme in US history -- involving more than 30,000 consumers and an estimated $2.7m in losses.

But, the data is not safe in a file drawer either, Robertson said.

"There's an illusion of safety that goes on every day. The difference with Internet hacking is the ability to crack a large database in which there are millions of accounts," he said. "This is what causes fear on the part of card issuers themselves."

Merchants and credit card companies do a good job of keeping fraud low in the United States, Robertson said.

Other countries do not have as many point-of-sale card authorisation systems and they have higher telecom costs that keep them from checking the validity of the card while the customer is waiting, he said.

"(Credit card) fraud is far worse every where in the world than in the United States, with the exception of France, which uses smartcards, with microchips in them," which can't be easily faked, Robertson said. "As a result, fraud in the US is only 7 cents out of every $100 of sales."

[an error occurred while processing this directive]