Heartland Payment Systems: 100 Million Cards Stolen and the E3 Fix

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Bob Carr co-founded Heartland Payment Systems in Princeton, New Jersey in 1997 to bring enterprise-grade card processing to small and mid-sized merchants. A $40 million private equity investment from Greenhill Capital Partners and LLR Partners came in 2001, and the company listed on the New York Stock Exchange in August 2005. It spread into payroll, campus cards, K-12 lunch systems, mobile payments and lending, and at its peak processed about $80 billion a year. On January 20, 2009 Heartland disclosed that attackers had been inside its network through 2008, using RAM-scraping malware to grab unencrypted magnetic stripe data in the instant it sat in memory, enough to clone physical cards.

An estimated 100 million cards and more than 650 financial services companies were affected. Hacker Albert Gonzalez was sentenced to 20 years in March 2010, and two Russian hackers were sentenced as late as February 2018. Heartland was back on Visa's list of PCI DSS validated providers by May 1, 2009, and on May 24, 2009 it launched E3, hardware-level end-to-end encryption that scrambled card data at the swipe. Gartner analyst Avivah Litan said Heartland was leading the way, and Worldpay US and First Data announced their own encryption efforts. In April 2016 Global Payments acquired Heartland for $4.3 billion.

• In 2014 Heartland had more than 3,700 employees, $2.1 billion in revenue, 275,000 business locations and 11 million transactions a day.
• Heartland Secure, launched in May 2014, combined encryption with EMV chips and tokenization and came with a merchant breach warranty.
• Carr's October 2013 open letter attacked hidden fees and the manipulation of merchant category codes as unethical and illegal pricing.
• In January 2014 Heartland sued Mercury Payment Systems under the Lanham Act over interchange fee advertising.
• Stolen stripe data let thieves encode blank plastic, so a card in an Ohio wallet could be cloned and used in Miami.