Archive Links

Consumer Archive
CU System Archive
Market Archive
Products Archive
Washington Archive

News Now

CU System
Data breach suit targets CardSystems auditor
NEW YORK (6/3/09)--In what may be a first in the field of data-breach litigation, a bank has sued the security auditor of CardSystems Solutions for liability in the 2004 data breach of the now-defunct card payment processor. Merrick Bank, based in Utah, sued the processor's security auditor, Savvis Inc., which had just given CardSystems Solutions an all-secure clearance three months before the hacking was discovered, according to Wired.com (June 2). The hacking compromised thousands of credit and debit cards, including those of credit union members. Hundreds of credit unions ended up closing accounts and reissuing cards and some saw losses due to fraudulent activity on the compromised accounts. The case will test the card industry's primary security standard, which was known in 2004 as Cardholder Information Security Program (CISP). CISP was the predecessor of today's current card industry standard, the Payment Card Industry Data Security Standard (PCI DSS). It will also test the liability of security auditing firms that deem companies as compliant with the standards. Merrick Bank, in its suit filed last year in Missouri, alleges that Savvis was negligent in certifying that CardSystems was complaint with industry standards. The compliance certification issue came to the forefront after Heartland Payment Systems and RBS WorldPay experienced large breaches even thought they had been certified as compliant with PCI standards. Another breached company, Hannaford Bros.,was certified in February 2008--while its customers' data were compromised in an ongoing breach process. The case moved to an Arizona court five months ago but only recently was assigned a judge, which means the case can move forward, said Wired.com. Arizona has a law that allows an entity that isn't a direct party to a contract to seek recovery if it is an "intended beneficiary" of the contract. In this case, even though Merrick didn't contract directly with Savvis to certify CardSystems, it relied on that certification being trustworthy, said the publication.


RSS print
News Now LiveWire
NCUA re-schedules start of tomorrow's closed meeting to 9 a.m. ET. Open meeting still at 10 a.m. ET.
14 hours ago
.@lisamurkowski @SenatorEnzi @SenJohnBarrasso are latest to weigh in on NCUA risk-based capital proposal. See #NewsNow tomorrow for more
14 hours ago
Now up on News Now: Fed stays course on taper, interest rates http://t.co/6DntsW58vA
16 hours ago
Positive performance indicators and the potential for rising interest rates in @TheNCUA 's latest economic update. http://t.co/yptPbIGvnU
19 hours ago
The @CFPB has launched a nationwide effort to provide financial education. http://t.co/sF3FXHpv3k
20 hours ago