CardSystems Settles With FTC Over Credit Card Security Breach

by Glen Shapiro, LawAndTax-News.com, New York

28 February 2006

It emerged last week that CardSystems Solutions, the firm behind the largest known compromise of financial data to date, and its successor, Solidus Networks, Inc., (doing business as Pay By Touch Solutions) have agreed to settle Federal Trade Commission charges that CardSystems' failure to take appropriate security measures to protect the sensitive information of tens of millions of consumers was an unfair practice that violated federal law.

CardSystems provided merchants with products and services used in “authorization processing” – obtaining approval for credit and debit card purchases from the banks that issued the cards. Last year, it processed about 210 million card purchases, totaling more than $15 billion, for more than 119,000 small and mid-size merchants.

In processing these transactions, CardSystems collected personal information from the magnetic strip of the card, including the card number, expiration date, and other data. CardSystems then stored this information on its computer network. Pay By Touch acquired CardSystems' assets in December 2005, and now processes transactions for the same merchants CardSystems served.

According to the FTC, the security breach resulted in millions of dollars in fraudulent purchases. The settlement will require CardSystems and Pay By Touch to implement a comprehensive information security program and obtain audits by an independent third-party security professional every other year for 20 years.

“CardSystems kept information it had no reason to keep and then stored it in a way that put consumers' financial information at risk,” explained Deborah Platt Majoras, Chairman of the FTC, adding that:

“Any company that keeps sensitive consumer information must take steps to ensure that the data is held in a secure manner.”

The Commission vote to accept the proposed consent agreement was 4-0, with Commissioner Pamela Jones Harbour recused. The agreement will be subject to public comment for 30 days, after which the Commission will decide whether to make it final.

Recommended