Heartland CEO: PCI Certification Sucks

"Heartland Payment Systems' top executives on Tuesday shed more light on the firm's massive data breach, and said that Heartland would fight ensuing lawsuits stemming from the incident.

"In an earnings call, the transcript of which has been posted online as well as summarized in the firm's fourth quarter 2008 financial report, Heartland chairman and CEO Bob Carr said the malware that infected the firm's systems could read and collect unencrypted data in motion, and that the attackers may have been able to `trade` from its network some of the data that was accessed.

"`Keep in mind that Heartland passed its PCI certification last April, and assessors are currently on-site for 2009 certification, which we are targeting to begin to complete by the end of April. In that regard, throughout the potential period of the breach, Heartland did have antivirus software installed on its payment processing network,` Carr said."

More at DarkReading...

PCI DSS? Never Heard of IT!!

"Hackers broke into a Merrimack [New Hampshire -Ed.] movie theater's servers and stole customers' credit card information, police said Wednesday.

"Investigators said that after receiving numerous reports of fraudulent use of credit cards, police determined that a majority of the victims used their credit cards over the summer and early fall at a Zyacorp Entertainment Cinemagic Stadium movie theater in Merrimack.

"Police and the Secret Service determined that a security breach was made into the company's server, allowing someone access to customers' information. The server has since been replaced, and new security measures put in place, police said.

"There was no indication how many customers' may have had their credit card information stolen."

From WMUR 9...