Heartland Data: Compliant, but Breached

Heartland Payment Systems was PCI compliant while attackers were inside its network. When it disclosed the breach in January 2009, the theft was described as possibly the largest credit card crime in history.

Based on public reporting and published analysis; sources are linked inline. Analysts' inference is flagged as such.

Overview

In 2008, Heartland payment processor suffered a hack that resulted in malicious persistent access to its systems for over a year, including about eight months inside its payment processing network. This event led to a data leak affecting well over 100 million payment cards (Security Magazine cites 134 million) and more than 650 financial institutions.

What happened to cause the breach?

Hackers exploited a web application vulnerability via an SQL injection in a login form that was about eight years old at the time. Over the following months, hackers used malicious software to maintain access and continue to exfiltrate data. The malware included a network sniffer that captured card data as it moved through the payment network, and one analysis says that data crossed the network unencrypted.

During this period, Heartland's security audits missed the breach while third-party auditors, including Trustwave in April 2008, certified them as PCI compliant. Months passed as the breach went undetected, before Visa and MasterCard finally notified Heartland of suspicious activity, leading them to involve the U.S. Secret Service and two breach forensics teams, who discovered the malicious access program in January 2009. While Heartland says no Social Security numbers, unencrypted PINs, addresses, phone numbers, or merchant data were stolen in the breach, the hackers were able to steal the information that resides on a credit card's magnetic strip, including card numbers and expiration dates, which allowed the fabrication of fake cards.

Could it have been prevented? If so, how?

The vulnerability could have been discovered through web application vulnerability scanning/testing, including penetration testing. In the case of SQL injection specifically, the login form should sanitize or prevent SQL commands from reaching the server on the back-end. Parameterized queries are the standard way to do that.

By one published analysis, the injected command that allowed the hackers to run server commands was most likely xp_cmdshell, a SQL Server procedure that runs operating system commands with the permissions of the account running the database. Microsoft turned it off by default starting with SQL Server 2005, so it appears they were running an older version (2000 most likely), though nothing public confirms that. A timely server upgrade would have raised the bar for this attack, but it wouldn't have fixed the injection flaw itself. Least privilege and encryption in transit would have limited the damage.

How did the company handle it and how many people were affected?

In the end, Heartland learned a hard lesson, paying a reported $145 million to cover fraudulent payments, suffering reputational damage with customers and financial industry partners alike. They also temporarily lost PCI DSS compliance: Visa removed Heartland from its list of compliant providers in March 2009, and it was relisted within about six weeks. The company hired a new CSO, John R. South, about nine months after the attack.

Albert Gonzalez was indicted in 2009 for SQL injection attacks on Heartland and others, and in March 2010 was sentenced to 20 years and one day.

What did the company (and by extension the cyber world) learn after this incident?

In a 2015 Security Magazine interview, South acknowledged the importance of web application security, secure coding, webapp vulnerability testing/pentesting and remediation before apps go to production. He also noted that the company had a renewed focus on intelligence gathering, secure data lifecycle, and cooperation on security with industry partners to address threats before they become a problem. South argued that if Heartland had seen threat data from other victims sooner, it might have stopped the attack. CEO Robert Carr also spoke publicly about the breach and co-founded the Payments Processor Information Sharing Council to encourage information sharing across the industry.

The takeaway

The lesson that lasts is that compliance is a floor, not a finish line. The ResearchGate analysis argues that Heartland's biggest mistake was treating PCI DSS as a complete security program.

Sources

• Acohido, B. (2009, January 20). Hackers breach Heartland Payment credit card system. ABC News (originally USA Today).
• Cingolani, A., & Zamparini, M. (2020, February 13). Heartland data breach analysis. ResearchGate.
• Ritchey, D. (2015, February 1). Data breach directions: What to do after an attack. Security Magazine.
• U.S. Department of Justice. Alleged international hacker indicted for massive attack on U.S. retail and banking networks.
• U.S. Department of Justice. Leader of hacking ring sentenced for massive identity thefts from payment processor and U.S. retail networks.
• Privacy Rights Clearinghouse. Heartland Payment Systems data breach.
• Microsoft. xp_cmdshell option (SQL Server 2005).