The extent of the breach is so pervasive that to suspend any one processor would be precedent to suspend them all once the full impact of this complete undermining of PCI DSS is revealed.

I’ll throw out another prediction: Bob Carr of Heartland is going to resign shortly, and it may be due to the SEC/FTC investigation.

As of the 3-11-09, Robert O. Carr is completely divsted from the company he built.

Yes, there was a recent “forced sale” of stock that was collateral for HPY loans, but there is obviously more to all of this than we know now.

One more, just for luck: The cost to HPY to replace the compromised cards, even if only at $2 a pop, could easily reach levels that rival their market cap – and that would be big trouble.

If the costs, fines, and lawsuits add up to around $100 Million, HPY would very likely go into bankruptcy.

If HPY is BK – then it’s number one creditor, Key Bank, takes a big hit.

So, theoretically, the breach at Heartland could cause a stable bank like Key to become a another TARP sucking blight on our nation, and more shareholders will have been unnecessarily harmed.

And there are way worse processors than Heartland – where will their clients turn?

Why do you think that, about the “forever” part? Today “change after the assessment” scenario is the one leading to breaches, but in the future it might well change: for example, if some co is breached via a mechanism not covered by PCI than the above will not longer be true.

Thus, “As of today, no compromised entity has been found to be compliant at the time of the breach” might well represent today’s reality, not simply marketing posturing…

The next, much less important question may be: Were there any MATERIAL PCI requirements not met that DID NOT contribute to the breach.

And then, finally, Were there any NON-Material PCI requirements not met (like a signature missing from an acceptable use policy).

The binary view of PCI complaince does not serve very well when trying to understand how high the wall is built to keep the bad guys out.

Altbough PCI is a valuable organization in that controls are need to protect card holders and their data, should the card associations be controlling it or is it objective enough to faily provide regulations at all levels regardless of it size and service?

Major Point… If you are hacked, by definition you can’t be PCI compliant.

Just for Grins,
R