The data breach experienced by Visa and MasterCard last week is now known to have originated from a third-party payment processor — Global Payments Inc. Fewer accounts were affected compared to earlier projections of 10 million compromised card accounts.
“The company believes that the affected portion of its processing system is confined to North America and less than 1.5 million card numbers may have been exported,” Global Payments said in a press statement.
Visa and MasterCard have notified card issuers about the breach, reported Krebs on Security, a security blog that broke the story.
There is a suspicion that the breach may be connected to a taxi and parking garage company in New York City. Global Payments said that the data theft involved Track 2 data, which generally consists of the account number, card expiration date and other discretionary information. Cardholder names, address and Social Security numbers were not stolen. However, the hackers obtained enough information to replicate cards that can be used to make unauthorized purchases.
“Based on the forensic analysis to date, network monitoring and additional security measures, the company believes that this incident is contained,” the company said in the statement.
Visa and MasterCard says that there were no breaches to their systems.
Card issuers have already issued warnings to impacted customers. Anyone who has used a debit or credit card to pay for a cab in New York City is advised to review their statements for fraudulent activity.
“It is reassuring that our security processes detected an intrusion. It is crucial to understand that this incident does not involve our merchants or their relationships with their customers,” said Paul R. Garcia, chairman and CEO of Global Payments Inc. The U.S. Secret Service confirmed that it is investigating the data breach.
Visa has removed Global Payments from its list of approved service providers.