Incident: Title: Data Breach at Global Payments Inc Compromises 50,000 Card Accounts

Published Date: 2012-03-30

Postmortem Analysis
Timeline 1. The software failure incident at Global Payments Inc occurred sometime between Jan. 21 and Feb. 25 [10717]. Therefore, the software failure incident happened in February 2012.
System 1. Global Payments Inc payment processing system [10717]
Responsible Organization 1. Hackers were responsible for causing the software failure incident at Global Payments Inc [10717].
Impacted Organization 1. Global Payments Inc 2. Visa 3. MasterCard 4. Credit union service organization PSCU 5. Banks 6. Customers 7. Financial industry 8. Heartland Payment Systems (mentioned for comparison) ([10717])
Software Causes 1. The software cause of the failure incident was a security vulnerability that allowed hackers to break into Global Payments Inc's system and access card data [10717].
Non-software Causes 1. The breach was caused by hackers breaking into Global Payments Inc, compromising more than 50,000 card accounts [10717]. 2. The breach occurred between Jan. 21 and Feb. 25, with the extent of the breach and damages still unknown [10717]. 3. The breach involved the theft of both Track 1 and Track 2 data, making it easy for criminals to clone the cards and use them for fraudulent activity [10717]. 4. The breach potentially put around 10 million cards at risk of compromise [10717].
Impacts 1. More than 50,000 card accounts were potentially compromised due to the breach by hackers at Global Payments Inc, an Atlanta-based payments processor [10717]. 2. Initially, 46,194 Visa accounts were indicated to have been compromised, but the number was later downgraded to 26,000 after eliminating duplicates and invalid cards [10717]. 3. About 800 accounts were known to have had fraudulent activity on them so far [10717]. 4. Both Track 1 and Track 2 data were taken, making it easy for criminals to clone the cards and use them for fraudulent activity [10717]. 5. Sources in the financial industry suggested that possibly as many as 10 million cards may have been at risk of compromise in the breach [10717]. 6. The breach was considered rather small compared to previous incidents, such as the Heartland Payment Systems breach in 2008, which potentially compromised more than 100 million cards [10717]. 7. The hacker involved in the Heartland Payment Systems breach, Albert Gonzalez, was sentenced to an unprecedented 20 years in prison for his role in connection to that breach [10717].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access by hackers [10717]. 2. Encrypting sensitive data such as card information to make it harder for hackers to steal and misuse the information [10717]. 3. Ensuring proper access controls and authentication mechanisms to limit access to sensitive data only to authorized personnel [10717]. 4. Regularly updating and patching software systems to address known vulnerabilities and prevent exploitation by hackers [10717].
Fixes 1. Implementing enhanced cybersecurity measures to prevent future hacking incidents [10717]. 2. Conducting a thorough security audit of the payment processing software to identify and address vulnerabilities [10717]. 3. Enhancing encryption protocols for sensitive card data to prevent unauthorized access [10717]. 4. Implementing multi-factor authentication for accessing critical systems to add an extra layer of security [10717].
References 1. Wall Street Journal [10717] 2. Visa 3. MasterCard 4. PSCU 5. Brian Krebs

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: - The article mentions a previous significant breach of card processors in 2008 against Heartland Payment Systems, where more than 100 million cards were potentially compromised. This incident resulted in hacker Albert Gonzalez being sentenced to 20 years in prison [10717]. (b) The software failure incident having happened again at multiple_organization: - The article does not provide specific information about similar incidents happening at other organizations.
Phase (Design/Operation) design, operation (a) The software failure incident in Article 10717 was primarily due to a design failure. The breach at Global Payments Inc. was a result of hackers breaking into the system and compromising over 50,000 card accounts. The breach was facilitated by the theft of both Track 1 and Track 2 data, making it easy for criminals to clone the cards and engage in fraudulent activities [10717]. (b) Additionally, the operation of the compromised system also played a role in the failure. The breach was detected after Visa alerted credit union service organization PSCU about potentially compromised Visa accounts. The investigation revealed that about 800 accounts had already experienced fraudulent activity, with the possibility of more accounts being affected as the investigation continued [10717].
Boundary (Internal/External) within_system, outside_system (a) The software failure incident reported in Article 10717 is within_system. The breach at Global Payments Inc, an Atlanta-based payments processor, was due to hackers breaking into the system, compromising more than 50,000 card accounts. The breach involved the theft of Track 1 and Track 2 data, making it easy for criminals to clone the cards and engage in fraudulent activities [10717].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Article 10717 occurred due to non-human actions, specifically a hack by hackers who broke into Global Payments Inc, a payments processor, compromising more than 50,000 card accounts [10717]. (b) The software failure incident in Article 10717 was also influenced by human actions, as the breach was a result of hackers gaining unauthorized access to the system, indicating a security vulnerability that may have been exploited due to potential lapses in security measures or protocols [10717].
Dimension (Hardware/Software) software (a) The software failure incident reported in Article 10717 was not attributed to hardware issues but rather to a breach by hackers. The incident involved hackers breaking into Global Payments Inc., a payments processor, compromising over 50,000 card accounts. The breach involved the theft of Track 1 and Track 2 data, making it easy for criminals to clone the cards and engage in fraudulent activities. The breach was a result of security vulnerabilities in the software systems rather than hardware failures [10717]. (b) The software failure incident in Article 10717 was primarily due to security vulnerabilities in the software systems that allowed hackers to gain unauthorized access to sensitive data. The breach involved the theft of card data, indicating a failure in the software's security mechanisms. The incident was not attributed to hardware issues but rather to weaknesses in the software that were exploited by the hackers [10717].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in Article 10717 was malicious in nature. The incident involved hackers breaking into Global Payments Inc, a payments processor, compromising more than 50,000 card accounts. The breach involved the theft of Track 1 and Track 2 data, making it easy for criminals to clone the cards and engage in fraudulent activities. Security blogger Brian Krebs reported that the breach was a result of malicious activity by hackers, with the potential risk of compromise for as many as 10 million cards [10717]. Additionally, the comparison to a previous breach in 2008 against Heartland Payment Systems, where more than 100 million cards were potentially compromised, further highlights the malicious nature of the incident [10717].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident at Global Payments Inc, where hackers breached the system and compromised over 50,000 card accounts, can be attributed to poor decisions made in terms of cybersecurity measures and system protection. The breach allowed hackers to access sensitive Track 1 and Track 2 data, making it easy for them to clone cards and engage in fraudulent activities [10717]. (b) The software failure incident can also be linked to accidental decisions or mistakes in the implementation of security measures that led to the breach. The fact that only about 800 accounts had shown fraudulent activity initially, but the number could potentially rise as the investigation continues, indicates a potential oversight or mistake in the system's security protocols [10717].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. Therefore, it is unknown whether the failure was due to contributing factors introduced due to lack of professional competence by humans or the development organization. (b) The software failure incident related to accidental factors is evident in the article. The breach at Global Payments Inc. was caused by hackers breaking into the system, compromising more than 50,000 card accounts [10717]. This breach was not intentional but rather accidental, as it was caused by external malicious actors gaining unauthorized access to the system.
Duration temporary (a) The software failure incident in Article 10717 was not permanent as it was a result of a breach by hackers. The breach occurred between Jan. 21 and Feb. 25, indicating a specific timeframe for the incident. The breach led to the compromise of more than 50,000 card accounts, with the potential for more accounts to be affected as the investigation continued [10717]. (b) The software failure incident in Article 10717 was temporary as it was a result of a specific breach by hackers during a defined period. The breach was not a continuous or ongoing failure but rather a specific event that occurred within a limited timeframe, leading to the compromise of card accounts during that period [10717].
Behaviour crash (a) crash: The software failure incident in Article 10717 resulted in a crash as the system lost state and did not perform its intended functions. The breach of Global Payments Inc by hackers led to more than 50,000 card accounts potentially compromised [10717]. (b) omission: The software failure incident did not involve omission as there is no mention of the system omitting to perform its intended functions at any instance in the article. (c) timing: The software failure incident did not involve timing issues as there is no mention of the system performing its intended functions too late or too early in the article. (d) value: The software failure incident did not involve value issues as there is no mention of the system performing its intended functions incorrectly in the article. (e) byzantine: The software failure incident did not involve byzantine behavior as there is no mention of the system behaving erroneously with inconsistent responses and interactions in the article. (f) other: The software failure incident in Article 10717 does not fit into any of the specific categories mentioned.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at Global Payments Inc. involved hackers breaking into the system and compromising more than 50,000 card accounts. The breach resulted in the theft of Track 1 and Track 2 data, making it easy for criminals to clone the cards and use them for fraudulent activity. As a result, about 800 accounts were known to have had fraudulent activity on them, with the potential for more accounts to show fraudulent activity as the investigation continues [10717].
Domain finance (a) The failed system in the incident reported in Article 10717 was related to the finance industry. Global Payments Inc, a payments processor, was breached by hackers, potentially compromising more than 50,000 card accounts [10717]. The breach involved the theft of Track 1 and Track 2 data, making it easy for criminals to clone the cards and engage in fraudulent activities [10717]. Visa and MasterCard sent notices to banks about the breach, indicating the extent of the compromise [10717]. The breach highlighted the vulnerability of financial systems to cyber attacks and the importance of robust security measures in the finance industry.

Sources

Back to List