MasterCard has joined the recent list of big financial institutions embarassed by a hacker with the acknowlegement that as many as 40 million credit card number have been wrongly accessed.
A hacker was able to infiltrate MasterCard's and other companies' payment systems through back-office processing company CardSystems Solutions. MasterCard has notified banks and the banks will notify customers as they see fit, said a MasterCard spokeswoman.
The network at CardSystems had certain vulnerabilities that allowed an outsider to access the card numbers, 13.9 million of which were connected to MasterCard cards, Antle said. MasterCard's fraud detection system first became aware of the infiltration in May, and the company promptly launched an investigation into the breach.
However, the complicated investigation was not completed until earlier this week, when MasterCard was able to determine which credit card numbers were exposed and notify the banks that issued those cards. Ubizen handled the initial forensic investigation, and the case has also been turned over to the FBI. As far as MasterCard is aware, the person who infiltrated the CardSystems network has not yet been identified.
Companies such as CardSystems process payment data for multiple credit card companies, which is why MasterCard numbers accounted for under half of the numbers. No other types of personal information, such as Social Security numbers, were compromised.
Cardholders can dispute purchases that were not made by them with the bank that issued their card, and card holders will not be held liable for any purchases determined to have been made fraudulently, Antle said.
Security breaches don't always happen through hacking into a company's network. Citigroup recently notified customers that the credit information of 3.9 million customers was inside a package that disappeared while in transit from New Jersey to Texas in the care of couriers UPS.