Visa Suspends Heartland: A Little Revisionist History?
Written by Evan SchumanMarch 13th, 2009
Visa struck back at both Heartland on Thursday (March 12), suspending the data breach victim and removing it from Visa's online list of PCI DSS compliant providers. Visa's chief enterprise risk officer, Ellen Richey, told banks the news in an E-mail Thursday. Richey described Heartland's status as being "in a probationary period," during which it can still accept payments, assuming it meets various new requirements. Heartland "is now in a probationary period, during which it is subject to a number of risk conditions including more stringent security assessments, monitoring and reporting. Subject to these conditions, Heartland will continue to serve as a processor in the Visa system."
The Visa move is interesting, but it appears to be much less about protecting data and card accounts than protecting Visa's public persona. If the suspension prevented Visa transactions from going through Heartland, that would have sent a very loud message. But that didn't happen. What has happened with Visa are some delicious attempts at rewriting history. In presentations that have been given this month by two top Visa data risk executives, Eduardo Perez and Hector Rodriguez, Visa's party line is now "As of today, no compromised entity has been found to be compliant at the time of the breach." And it shall forever be so.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
5 Comments | Read Visa Suspends Heartland: A Little Revisionist History?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
March 13th, 2009 at 11:08 pm
Haha. In my past life, when dealing with auditors, we always figured that if we thought something was questionable (expense or asset sort of thing) then we would do a best-guess and let the auditors find it. Mostly because if auditors don’t find SOMETHING to quibble about, they will get so anal that it wasn’t even mentionable in public.
Just for Grins,
R
March 16th, 2009 at 10:22 am
Would anyone expect anything else? Did anyone expect that Hartland would have to stop taking transactions? Does anyone believe that the credit card associations care about anything other than their own Brand?
Altbough PCI is a valuable organization in that controls are need to protect card holders and their data, should the card associations be controlling it or is it objective enough to faily provide regulations at all levels regardless of it size and service?
Major Point… If you are hacked, by definition you can’t be PCI compliant.
March 16th, 2009 at 11:04 am
The question to me seems to be this: During the post-breach investigation, was the breach possible because of a failure to properly implement a PCI requirement? That is the important question.
The next, much less important question may be: Were there any MATERIAL PCI requirements not met that DID NOT contribute to the breach.
And then, finally, Were there any NON-Material PCI requirements not met (like a signature missing from an acceptable use policy).
The binary view of PCI complaince does not serve very well when trying to understand how high the wall is built to keep the bad guys out.
March 16th, 2009 at 12:52 pm
“As of today, no compromised entity has been found to be compliant at the time of the breach.†And it shall forever be so.”
Why do you think that, about the “forever” part? Today “change after the assessment” scenario is the one leading to breaches, but in the future it might well change: for example, if some co is breached via a mechanism not covered by PCI than the above will not longer be true.
Thus, “As of today, no compromised entity has been found to be compliant at the time of the breach†might well represent today’s reality, not simply marketing posturing…
March 17th, 2009 at 10:48 pm
I think it will be sometime later this year that we finally find out that there have been multiple breaches across the entire industry, and they are most likely related.
The extent of the breach is so pervasive that to suspend any one processor would be precedent to suspend them all once the full impact of this complete undermining of PCI DSS is revealed.
I’ll throw out another prediction: Bob Carr of Heartland is going to resign shortly, and it may be due to the SEC/FTC investigation.
As of the 3-11-09, Robert O. Carr is completely divsted from the company he built.
Yes, there was a recent “forced sale” of stock that was collateral for HPY loans, but there is obviously more to all of this than we know now.
One more, just for luck: The cost to HPY to replace the compromised cards, even if only at $2 a pop, could easily reach levels that rival their market cap – and that would be big trouble.
If the costs, fines, and lawsuits add up to around $100 Million, HPY would very likely go into bankruptcy.
If HPY is BK – then it’s number one creditor, Key Bank, takes a big hit.
So, theoretically, the breach at Heartland could cause a stable bank like Key to become a another TARP sucking blight on our nation, and more shareholders will have been unnecessarily harmed.
And there are way worse processors than Heartland – where will their clients turn?