How the Heartland breach happened: 130 million cards and an informant

While his crew was breaking into one of America's biggest card processors, Albert Gonzalez was on the U.S. Secret Service payroll as an informant, earning about $75,000 a year.^[3] This case file covers how the Heartland Payment Systems breach worked, how it became what prosecutors called the largest card data breach ever charged in the United States, and the one control that would have made the stolen data useless.

What happened

How they got in

According to the indictment, the group got past the companies' firewalls using SQL injection, a well-known type of attack where a website accepts malicious input and passes it straight to the database behind it.^[1] At Heartland, the underlying flaw had been sitting in the system for several years before it was used.^[4]

Once inside, they installed sniffer programs, software that watches traffic on a network and copies whatever passes by.^[2] At Heartland, card numbers, expiration dates and some cardholder names flowed between internal systems without encryption, so the sniffers could read them as they went past.^[4][5] Heartland's chief executive said afterward that the malware could collect unencrypted data in motion.^[5] Prosecutors said the stolen data was sent to servers the group ran in California, Illinois, Latvia, the Netherlands and Ukraine.^[1]

Heartland had passed its payment card industry security assessment in April 2008, while the intruders were inside.^[5] Passing a checklist did not mean the data was protected on every internal hop.

What it cost

Gonzalez pleaded guilty. On March 25 and 26, 2010, he was sentenced to 20 years, and then 20 years and 1 day, in federal prison, to run concurrently, for the Heartland case and the earlier retail breaches.^[2] Agents had also recovered more than $1 million in cash that he directed them to, buried in a barrel in his parents' backyard.^[3]

Heartland's market value fell by half after the announcement, and it had spent more than $32 million on legal, forensic and settlement costs by August 2009.^[4] It later agreed to pay $60 million to settle with Visa and up to $41.4 million with MasterCard to cover card-issuer losses and costs.^[6]

The missing control

The missing control: encrypting card data as it moves inside the network. Heartland protected the perimeter and passed its audit, but inside the network card numbers traveled in plain text.

If card data had been encrypted from the moment it was captured until it reached the card networks, the sniffers would have collected scrambled records worth nothing to the buyers. The break-in might still have happened, but the payoff would not. Heartland's own answer after the breach was exactly this: it championed end-to-end encryption and built terminals that encrypt data at the point of swipe.^[4][5]

What to do in your business

• Ask your card processor about point-to-point encryption. Many processors offer terminals that encrypt the card the moment it is tapped or swiped. Ask whether yours does, and switch if it does not.
• Keep card numbers off your own systems. Use hosted payment pages and tokenization, which replaces the card number with a stand-in value, so your network never holds real card data.
• Do not treat a passed audit as the finish line. A compliance questionnaire is a minimum. Ask your IT provider where customer data travels unencrypted inside your network.
• Keep web software patched. Update your website, plugins and online forms promptly, since web-facing flaws were the front door here.
• Listen when outsiders flag fraud. If your bank or processor reports suspicious card activity tied to you, treat it as a possible breach and bring in help the same day.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.