Archive Links

Consumer Archive
CU System Archive
Market Archive
Products Archive
Washington Archive

News Now

CU System
Data breach suit targets CardSystems auditor
NEW YORK (6/3/09)--In what may be a first in the field of data-breach litigation, a bank has sued the security auditor of CardSystems Solutions for liability in the 2004 data breach of the now-defunct card payment processor. Merrick Bank, based in Utah, sued the processor's security auditor, Savvis Inc., which had just given CardSystems Solutions an all-secure clearance three months before the hacking was discovered, according to Wired.com (June 2). The hacking compromised thousands of credit and debit cards, including those of credit union members. Hundreds of credit unions ended up closing accounts and reissuing cards and some saw losses due to fraudulent activity on the compromised accounts. The case will test the card industry's primary security standard, which was known in 2004 as Cardholder Information Security Program (CISP). CISP was the predecessor of today's current card industry standard, the Payment Card Industry Data Security Standard (PCI DSS). It will also test the liability of security auditing firms that deem companies as compliant with the standards. Merrick Bank, in its suit filed last year in Missouri, alleges that Savvis was negligent in certifying that CardSystems was complaint with industry standards. The compliance certification issue came to the forefront after Heartland Payment Systems and RBS WorldPay experienced large breaches even thought they had been certified as compliant with PCI standards. Another breached company, Hannaford Bros.,was certified in February 2008--while its customers' data were compromised in an ongoing breach process. The case moved to an Arizona court five months ago but only recently was assigned a judge, which means the case can move forward, said Wired.com. Arizona has a law that allows an entity that isn't a direct party to a contract to seek recovery if it is an "intended beneficiary" of the contract. In this case, even though Merrick didn't contract directly with Savvis to certify CardSystems, it relied on that certification being trustworthy, said the publication.


RSS print
News Now LiveWire
.@CFPB today finalized changes 2 remittance rule, proposed in April. See rule here: http://t.co/tPs6Mlimni
1 hours ago
State OKs Floridacentral #creditunion's bank branch purchase #NewsNow http://t.co/37uXorWsmV
3 hours ago
Today is deadline to order your T-shirt for #MiracleJeansDay @CU4Kids @CMNHospitals http://t.co/UXIqW3cFN6
4 hours ago
#Creditunion #100MM on display with @NWCUA's Minickiello, Wash. Rep. Sharon Tomiko Santos at @NCSLorg @CUNAadvocacy http://t.co/xVwnS39uEM
4 hours ago
Fraudsters hit @jpmorgan with smash and grab #phishing campaign http://t.co/VEkAvctYLJ
5 hours ago