This really leads me to two possible conclusions. First, someone on the inside, most likely in IT or someone with a high level of network access, and a very high knowledge of exactly how their system works, helped plant the software so it couldn’t be found either inherently or by the massive amount of data being extracted. Or second, Heartland had extremely weak security, unacceptably weak, and someone was actually allowed enough time to hack across multiple systems, and had enough time to find a very unique pathway of data, and had enough time to plant some software that was undetected, and extract this huge amount of data without ever being noticed for months.

This statement, coupled with the almost countless retailer breaches, demonstrates the need for an industrywide rearchitecture of the fundamentals of credit/debit authorization. Just as retailers are trying different schemes to avoid having unencrypted data, the fact that it still has to be cleartext to cross the interfaces between retailer and processor, and processor and bank, demonstrates the flaws in the system.

Data should be protected in the cardholder’s hands and in the issuing bank’s systems. Nobody in between should ever be trusted with anything other than presenting or carrying encrypted data.

This technology has existed for over a decade now. The days of routing paper charge slips are over. We don’t need the credit industry continuing to expose the rest of us to horrendous risks because they can’t modernize beyond carbonless paper.