Archive Links

Consumer Archive
CU System Archive
Market Archive
Products Archive
Washington Archive

News Now

CU System
Data breach suit targets CardSystems auditor
NEW YORK (6/3/09)--In what may be a first in the field of data-breach litigation, a bank has sued the security auditor of CardSystems Solutions for liability in the 2004 data breach of the now-defunct card payment processor. Merrick Bank, based in Utah, sued the processor's security auditor, Savvis Inc., which had just given CardSystems Solutions an all-secure clearance three months before the hacking was discovered, according to Wired.com (June 2). The hacking compromised thousands of credit and debit cards, including those of credit union members. Hundreds of credit unions ended up closing accounts and reissuing cards and some saw losses due to fraudulent activity on the compromised accounts. The case will test the card industry's primary security standard, which was known in 2004 as Cardholder Information Security Program (CISP). CISP was the predecessor of today's current card industry standard, the Payment Card Industry Data Security Standard (PCI DSS). It will also test the liability of security auditing firms that deem companies as compliant with the standards. Merrick Bank, in its suit filed last year in Missouri, alleges that Savvis was negligent in certifying that CardSystems was complaint with industry standards. The compliance certification issue came to the forefront after Heartland Payment Systems and RBS WorldPay experienced large breaches even thought they had been certified as compliant with PCI standards. Another breached company, Hannaford Bros.,was certified in February 2008--while its customers' data were compromised in an ongoing breach process. The case moved to an Arizona court five months ago but only recently was assigned a judge, which means the case can move forward, said Wired.com. Arizona has a law that allows an entity that isn't a direct party to a contract to seek recovery if it is an "intended beneficiary" of the contract. In this case, even though Merrick didn't contract directly with Savvis to certify CardSystems, it relied on that certification being trustworthy, said the publication.


RSS print
News Now LiveWire
.@SenatorBegich says @TheNCUA risk-based cap. plan attempts 2 solve problem that does not exist, at expense of those served by CUs. Watch NN
9 minutes ago
Target wants stay of discovery in class action suits in data security breach; plaintiffs disagree that it's needed http://t.co/GHqz2S4u5g
28 minutes ago
New HUD Sec'y Julian Castro gets warm send-off from San Antonio's @alamofcu MT Thanks for all the hard work. http://t.co/peb8x4GSRq
53 minutes ago
.@CUANYtweets initiates call to action to Gov. Cuomo to sign state-chartered #creditunion FOM bill
1 hours ago
.@MountainAmerica #creditunion CEO helps TV audience understand credit scores #NewsNow http://t.co/makbsIIdzn
1 hours ago