Incident: Data Security Breach at Global Payments Exposing Credit Card Information

Published Date: 2012-03-30

Postmortem Analysis
Timeline 1. The software failure incident at Global Payments, as reported in Article 10724, occurred sometime from late January to late February [10724]. Therefore, the software failure incident happened in late January to late February.
System 1. Global Payments processing system [10724] 2. Track 1 and Track 2 data encryption system
Responsible Organization 1. Global Payments - The software failure incident was caused by a data security breach at Global Payments, the company that processes transactions for Visa and MasterCard [10724].
Impacted Organization 1. Credit card holders, potentially affecting one to three million accounts [10724] 2. Visa and MasterCard [10724]
Software Causes 1. The software cause of the failure incident was unauthorized access into a portion of Global Payments' processing system, leading to a data security breach that exposed private customer information [10724].
Non-software Causes 1. Lack of timely disclosure and transparency by Global Payments regarding the breach details [10724]. 2. Insufficient regulation and oversight of the payment processing industry compared to banks, leading to potential vulnerabilities [10724].
Impacts 1. Private customer information was improperly exposed, potentially affecting millions of credit card holders [10724]. 2. Credit card information on the cardholders was exposed, including details like names, card numbers, validation codes, and in some cases, customer addresses [10724]. 3. The breach led to a drop in Global Payments' share price by 9.1% to $47.50 [10724]. 4. The breach raised concerns about the vulnerability of electronic financial data and highlighted the need for improved security measures [10724]. 5. The incident underscored the increasing sophistication of attacks targeting payment processors, which are considered a weak point in the credit card system's security [10724].
Preventions 1. Implementing stronger security measures and encryption protocols within the payment processing system could have prevented the software failure incident [10724]. 2. Conducting regular security audits and assessments to identify and address vulnerabilities in the system could have helped prevent the breach [10724]. 3. Enhancing collaboration and communication between payment processors like Global Payments, banks, and card companies to ensure prompt disclosure of security incidents and sharing of information could have mitigated the impact of the breach [10724]. 4. Enforcing stricter regulations and oversight on third-party payment processors to ensure they adhere to security standards and protocols could have potentially prevented the breach [10724].
Fixes 1. Implementing stronger security measures in the payment processing system to prevent unauthorized access and data breaches [10724]. 2. Enhancing encryption protocols to protect sensitive customer information during transactions [10724]. 3. Conducting regular security audits and assessments to identify and address vulnerabilities in the system [10724]. 4. Improving communication and transparency between payment processors like Global Payments and banks to ensure prompt disclosure of any security incidents [10724]. 5. Strengthening regulations and oversight for third-party payment processors to mitigate risks of data breaches and fraud [10724].
References 1. Bank officials [10724] 2. Visa and MasterCard [10724] 3. Global Payments [10724] 4. Security consultants [10724] 5. Symantec [10724] 6. Trend Micro [10724] 7. Gartner Research [10724] 8. Heartland Payment Systems [10724] 9. Krebs on Security blog [10724] 10. Federal law enforcement [10724] 11. The Secret Service [10724] 12. Electronic Transactions Association [10724] 13. MasterCard [10724] 14. Visa [10724] 15. Banking regulators [10724] 16. F.D.I.C. [10724] 17. Patton Boggs [10724]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: The article mentions that this is the second breach at Global Payments in the last 12 months, indicating a recurring issue within the same organization [10724]. (b) The software failure incident having happened again at multiple_organization: The article also references a similar attack disclosed by Heartland Payment Systems in 2009, which began in 2007 and resulted in the exposure of data on 130 million credit cards. This suggests that similar incidents have occurred at other organizations as well [10724].
Phase (Design/Operation) design, operation (a) The software failure incident at Global Payments was primarily due to a design failure. The breach occurred as a result of vulnerabilities in the system's design and security measures, allowing hackers to gain unauthorized access to sensitive customer information [10724]. (b) Additionally, the software failure incident could also be attributed to operational factors. The breach was facilitated by the operation of the system, including the processing of transactions and the handling of customer data, which exposed the system to exploitation by cybercriminals [10724].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Global Payments was due to unauthorized access into a portion of its processing system, as stated by the company's chief executive, Paul R. Garcia [10724]. This indicates that the failure originated from within the system itself. (b) outside_system: The breach at Global Payments was a result of hackers targeting the payment processors, which act as a bridge between banks and retailers. Security consultants mentioned that criminals are focusing on this specific part of the credit card system due to the lower levels of security compared to banks [10724]. This highlights that the contributing factors leading to the failure came from outside the system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident at Global Payments was due to a data security breach that exposed private customer information, including credit card details [10724]. - Hackers targeted the payment processors, such as Global Payments, which act as a bridge between banks and retailers, aiming to obtain high concentrations of credit card numbers [10724]. - The breach involved unauthorized access into a portion of Global Payments' processing system, indicating a breach in the software security infrastructure [10724]. (b) The software failure incident occurring due to human actions: - The breach at Global Payments was a result of hackers exploiting vulnerabilities in the payment processor system, indicating a failure in implementing robust security measures by the company [10724]. - Banks expressed frustration with the pace of disclosure by Global Payments regarding the breach, suggesting potential human errors in communication and transparency during the incident response process [10724]. - The breach highlighted concerns about the vulnerability of electronic financial data, indicating a need for improved security measures and potentially human errors in ensuring data protection [10724].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is not attributed to hardware issues. Instead, it is primarily related to a data security breach at Global Payments, a company that processes transactions for Visa and MasterCard. The breach exposed private customer information, including credit card details such as names, card numbers, validation codes, and customer addresses [10724]. (b) The software failure incident is directly linked to software vulnerabilities and security breaches. Hackers targeted the payment processors, such as Global Payments, which act as a bridge between banks and retailers. The breach involved unauthorized access into a portion of Global Payments' processing system, leading to the exposure of sensitive data. This incident highlights concerns about the vulnerability of electronic financial data and the increasing sophistication of cyber attacks targeting payment processors [10724].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involved a data security breach at Global Payments, a company that processes transactions for Visa and MasterCard. Hackers gained unauthorized access to a portion of Global Payments' processing system, leading to the exposure of private customer information, including names, card numbers, validation codes, and customer addresses [10724]. The breach was described as a targeted attack on the payment processing system, which acts as a bridge between banks and retailers. Security experts highlighted that hackers specifically target payment processors due to the high concentrations of credit card numbers they handle, making them vulnerable to such attacks [10724]. Additionally, the incident was not an isolated case, as it was mentioned that this was the second breach at Global Payments in the last 12 months. Similar attacks on other companies, like Heartland Payment Systems in 2009, were also referenced, indicating a pattern of malicious activities targeting payment processors [10724].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the data security breach at Global Payments was primarily due to poor decisions made by the company in handling the breach. The article mentions that Global Payments provided little information on where the breaches took place, how accounts were hacked, and other crucial details that could indicate which customers might be vulnerable. This lack of transparency frustrated banks, and there were concerns about the pace of disclosure by Global Payments [10724]. (b) Additionally, the incident could also be attributed to accidental decisions or mistakes made by Global Payments in terms of their security measures and protocols. The breach highlighted a crucial vulnerability in the system that could affect millions of credit card holders, indicating potential oversights or gaps in their security practices [10724].
Capability (Incompetence/Accidental) accidental (a) The software failure incident at Global Payments was not directly attributed to development incompetence but rather to a data security breach that exposed private customer information [10724]. (b) The software failure incident at Global Payments was accidental in nature, as it was caused by unauthorized access into a portion of its processing system, leading to the exposure of credit card data [10724].
Duration temporary (a) The software failure incident in this case appears to be temporary rather than permanent. The breach at Global Payments was identified as an "unauthorized access into a portion of its processing system" [10724]. The incident was reported on a Friday morning, and trading in Global Payments shares was halted around noon on the same day [10724]. The company also mentioned that they had asked for help from external experts in computer security and contacted federal law enforcement, including the Secret Service [10724]. These actions indicate that the breach was seen as a temporary issue that needed immediate attention and resolution. (b) The incident was not described as a permanent failure, as the company took steps to address the breach and investigate the unauthorized access into their system. The breach was detected, and actions were taken to mitigate the impact and prevent further unauthorized access.
Behaviour crash, omission, timing, value, byzantine, other (a) crash: The incident at Global Payments involved unauthorized access into a portion of its processing system, leading to a system failure due to the breach. The system lost its state and was not performing its intended functions as it should have been [10724]. (b) omission: The breach at Global Payments resulted in the exposure of credit card information, indicating a failure of the system to protect and secure sensitive customer data. This omission to perform its intended function of safeguarding data led to the vulnerability of millions of credit card holders [10724]. (c) timing: The breach occurred over a period from late January to late February, indicating a timing failure in the system's security measures. The system failed to detect and prevent the unauthorized access during this timeframe, leading to the exposure of customer information [10724]. (d) value: The breach at Global Payments resulted in the exposure of sensitive credit card details such as names, card numbers, validation codes, and customer addresses. This indicates a failure of the system to handle and process this information correctly, leading to potential misuse by unauthorized individuals [10724]. (e) byzantine: The incident involved hackers gaining unauthorized access into the payment processor system, indicating a level of sophistication in their attack. The inconsistent responses and interactions of the system with the hackers, as well as the lack of detailed information provided by Global Payments on the breach, suggest a level of byzantine behavior in the system's response to the security breach [10724]. (f) other: The breach at Global Payments highlighted a crucial vulnerability in the system that could affect millions of credit card holders. The incident underscored concerns about the vulnerability of electronic financial data and the specific targeting of payment processors by criminals due to perceived weaknesses in their security measures. This behavior of being a prime target for hackers due to lower security levels compared to banks represents another aspect of the system's failure [10724].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at Global Payments resulted in the exposure of credit card information of potentially millions of customers. This breach included sensitive details like names, card numbers, validation codes, and in some cases, customer addresses [10724]. The breach raised concerns about the vulnerability of electronic financial data, highlighting the impact on people's financial security and the potential risk of fraud [10724]. Additionally, the breach led to a drop in Global Payments' share price by 9.1 percent to $47.50, indicating a financial impact on the company [10724].
Domain finance (a) The failed system in this incident is related to the finance industry. The breach occurred at Global Payments, a company that helps Visa and MasterCard process transactions for merchants [10724]. The incident involved the exposure of private customer information, including credit card details like names, card numbers, validation codes, and customer addresses [10724]. The breach raised concerns about the vulnerability of electronic financial data and highlighted the specific targeting of payment processors by criminals [10724]. The breach also led to trading in Global Payments shares being halted, with the share price dropping significantly [10724]. (h) The failed system was specifically related to the finance industry, as it involved the processing of credit card transactions for merchants by Global Payments, impacting millions of credit card holders [10724]. The breach exposed sensitive financial information, such as credit card numbers and validation codes, emphasizing the importance of securing financial data [10724]. The incident also prompted investigations by major banks, federal authorities, and card companies, underlining the critical role of secure financial transactions in the industry [10724].

Sources

Back to List