![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-81728-100x100.png\")
Huzzah! Big business remains unchanged in this new era of enlightenment!
2 replies
Huzzah! Big business remains unchanged in this new era of enlightenment!
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-188304-100x100.png\")
So they feel no need to say what companies I shop at might have been affected simply because they service alot of companies?
Nice!
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-68654-100x100.png\")
@parad0x360: to be fair, i don't think it's the companies fault at all (other than they chose to contract with this processor) - the source of this breach seems to be entirely on heartland's side.
considering the size of the breach thus far, i think everyone needs to make the assumption that any card they've used within the last year has been compromised. keep an eye on your statements & report any fraudulent activity to your card issuer. you are protected under federal law & thru card policies (such as visa's \"zero tolerance\").
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-14643-100x100.png\")
Great. I'm going to start paying for things with chickens and jam.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-545648-100x100.png\")
@dollywould: Works for me. I'll take layer hens, whole grains & organic produce as payments for my business.
Thus far, no one has taken me up on alternative payment strategies.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-25155-100x100.png\")
@dollywould: Listen, you will need marketing expertise. How about technical support? What about RMA's?
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-21970-100x100.png\")
@FrankenPC: For coming up with a name like \"Jam Cock Enterprises,\" I think lostsynapse already has some marketing experience. Or just a natural gift for names.
![\"user-pic\"](\"/css/images/default.gif\")
@lostsynapse: you can't dooooo that. Cock is slang for rooster, and we all know roosters are animals. And well, I'm sorry but that comes too close to my corporation \"Monster Fables\" (we make overly priced children books) because a Monster is an animal too. Unless of course you are willing to rent a license for the name Jam Cock, in which you will pay us 80% of the revenue and we will donate 1% of it to \"Rehabilitating Criminal Crack Whores Foundation\" or \"The Quadriplegic Dog Fund\" your choice
I got a call 10 days ago from the bank the branded my credit card that a merchant's data was compromised for that particular card. I'm guessing that this is it since I only use this card for restaurants. Nice.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-496332-100x100.png\")
@Kos: I got as letter in the mail talking about the breach. I called to see if I could get some information and they couldn't tell me anything, so it seems the banks are in the dark about what is going on as well... at least their employees are.
My question is, why are companies like Heartland not being held responsible by the banks and issuers of credit/debit cards? How much money are these companies going to have to shell out for new cards for everyone? Then there is the issue of trusting this company once more with our information...
Granted, I have no love for banks, but mine is a small local bank run by good people who use to give loans with a handshake.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-479704-100x100.png\")
They should be required to list EVERY SINGLE BUSINESS that uses their services. If they had to do that, you know they would have been more careful in the first place because every single one of those businesses would now be leaving them due to the public humiliation. Why aren't companies held accountable for this sort of thing??
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-23519-100x100.png\")
I use Heartland at my business, and I found out only because of this article and calls from customers. I can tell you that they are not being forthcoming with their merchants and at at this point I am in a mad dash trying to find a different proccessor and try to figure out if my customers where affected.
@renegadebarista: You should try Mercury Payment Systems, I use them and they're pretty good, definitely the best customer service I've ever received.
@renegadebarista: interesting. let me ask you: 1) are you in contract? 2) have you spoken with a lawyer concerning whether this event constitutes a breach of agreement?
i would think it does, but since heartland services a lot of small & mid-size businesses, i'm going to assume that they're gonna be hardasses about moving on. i'd like to know more if you have the time...
\"It's clear that Heartland is in the business of servicing other businesses, not consumers...\"
Yup.
Heartland is big and has all our data. We individuals have zilch leverage over Heartland directly. There is a remedy in the American legal system for this kind of imbalance of power. It's called \"government regulation.\"
Here's an idea for a new law. If a data aggregator like Heartland has a breach like this and fesses up voluntarily, they have to send everybody who was breached or might have been breached a check for $10. If they don't fess up, and the government finds out, the government sends in a swat team of forensic auditors, and then the aggregator has to pay for the audit, and has to send checks for $100.
I'll bet this nonsense would stop real darn quick.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-48863-100x100.png\")
It sure seems like these breaches are getting bigger each time. IIRC, the TJMaxx breach was the biggest when it happened.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-219008-100x100.png\")
Well, they are sorry. I feel so much more secure now.
If you think its frustrating as a cardholder try being in the shoes of a small business. I truly care about my customers and like I said in an early post I found out from customers and from here about the breach, nothing from Heartland. I have been on the phone for the last hour trying to get answers and am getting nowhere. Its not just consumers they are stonewalling its even their own merchants, and it is WRONG!
@renegadebarista: & frustrating as a card issuer! we reissued our entire debit cardstock - over 1000 cards 2 weeks before christmas b/c fraudulent activity was getting worse each day.
not only did that turn into a huge clusterf*** (mass reorder during the time when cards are most used), but i'm still dealing with the ramifications (reduction in card usage, people forgetting their new PINs, losing their new cards, not activating their new cards, etc.).
i've been working on this since 12/06/08 & it's monopolized my time at work for the last 6 weeks (which means all the other crap i have to do has been building up).
& that's just me - 1 person at 1 institution. think of all the time, energy & money being wasted on their negligence.
i feel your pain - GL!
@renegadebarista: If you get any information from heartland that's worth sharing with our readership, please email us at the tipline or any of us personally. Best of luck.
This is why there should be some sort of mandatory signage on the door or register regarding whom they use for card processing. Most businesses show who they use for check processing. That way consumers could purposely avoid places that use a sketchy processor or just pay cash instead. We do have a right to know this information.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-329214-100x100.png\")
Hmm!! I bet this is why Bank of America sent me a new debit card last week saying \".We have learned that some information from certain Bank of America Check Card accounts may have been compromised at a third party location\"!!
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-395799-100x100.png\")
Does Consumerist have any executive info for this company? I noticed a couple odd transactions on my online account summary today, and I need to be able to fight these charges (which took me into the negative numbers, by the way). How is it possible they can not tell consumers what companies were compromised?
@aliasmisskat: You should contact the issuer of your card. The processor is not gonna talk to a consumer.
@aliasmisskat: Too bad there isn't an \"ignore this poster\" option on consumerist. Somebody already made your inane joke earlier in this thread. In fact you might be the 3rd. Is there some kind of Obama-hating gene that forces you people to make that joke on every frikkin' story?
Also your joke isn't funny because nobody ever claimed that any candidate was going to prevent every bad thing from ever happening again. So it's a straw man joke. Pretty pathetic.
We get it. You think people have pinned too many hopes on the president and you hate him. STFU already.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-371684-100x100.png\")
their CFO says, \"We recognize and feel badly about the inconvenience this is going to cause consumers.\"
Well, that's OK, then. As long as he feels badly. I'll sleep better tonight knowing that he probably felt so horrible he skipped the pâté at lunch today.
Now if he was all smug about it, THAT would be totally unacceptable.
/President Obama, do you have room on your agenda for these world class sphincters?
@nsv: hey, let him be smug. if visa uses the cardsystems breach as precedence, heartland won't be around for very much longer.
to refresh everyone's memories, the cardsystems breach was disclosed in 06/2005 & affected roughly 40 million cardholders. visa & amex quickly \"de-listed\" the company, refusing to honor payments made thru their servers.
i believe the company was eventually bought by another payment processor, but my point is this: whether mr. baldwin feels \"bad\" or \"badly\", he's soon going to feel the affects of not having a job.
@nsv: He can't \"feel badly\" about something. He can feel *something* badly. Like if he's bad at feeling fruit to see if it's ripe. He *can* \"feel bad\" about the inconvenience. But he didn't say that, and I don't really think he does.
Sorry. Pet peeve.
This is so scary and frustrating. I'm just about to graduate college and I'm constantly afraid that my credit is going to be compromised before I even get started! And most people I know in college never ever use cash. We either charge to our student accounts, or we pay with credit/debit because free ATM's for most of our banks are not readily accessible. It is also much easier to keep up with tons of small purchases through your bank statements, and budget that way.
I agree with the chicken and jam guy. Do you think my local restaurants will accept cowrie shells?
Having someone hit my car is an unfortunate incident, having my credit card info stolen is downright negligent.
Because no addresses, SSNs or PINs were stolen, the prospect of full-blown identity theft is pretty small.
The thieves were smart enough to steal 100 million numbers, they just might be smart enough to figure out more with that info.
@dollywould: @lostsynapse: Wow, I read that as Cock Jam at first and... yeah, my brain needs a shower.
\"Baldwin said it would be unfair to mention any one of his company's customers\".
But it's fair to say that you don't give a damn about consumers...cuz hey, we can't touch you anyway.
I found out last week when logging on to my Chase Mastercard to make a payment that my card had been shut down for suspected fraudulent activity. Going by the fact that the person trying to use my card was unable to provide my address, I'm wondering if I am indeed a victim of Heartland (gee, what a wholesome-sounding name) and their crackerjack security systems. Of course, I have no way of knowing for sure since they won't release the names of the companies they are affiliated with.
(The treatment I received from Chase about this is worthy of a Consumerist post all its own...)
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-352008-100x100.png\")
\"40 percent of transactions the company processes are from small to mid-sized restaurants across the country\"
That seems like such a random metric, until you realize that basically puts everyone in the entire country at risk, since they're so unwilling to release actual business names.
I just realized the other day that I need a new credit card, because I still use my first and only one all the time and once it gets lost or stolen, that's quite a few years knocked off my credit history.
@chrisjames: Several years ago, I reported a card on one of my accounts as \"lost\". The agent at the bank changed the account number, confirmed every pending transaction with me and transferred them to the new account number, and sent new cards. The new cards had the new account number, but the same opening date.
Likewise, another card issuer keeps changing my cards -- last year it was swipeless cards (thanks, but no thanks), and a few years ago they converted VISA accounts to MasterCard accounts without asking first (thanks, but no thanks). The account numbers change (twice, actually, because they couldn't reinstate the original account numbers and changed them again to get the type of card I had had before), but the dates do not.
This isn't just what the banks say. When I look at my credit reports from the three major reporting agencies, the history for each of these accounts goes back to when I opened the original account, not when I got the current card number.
Two cards from different banks and of different types is probably a good idea though, especially if you travel.
It'd be nice if they did release business names...
@Ryan Gard: If they released business names, reactionaries & people who don't understand how third party processing works would boycott those businesses. And that's not fair to small business people -- most of them are ethical and care about their customers, they certainly didn't want their card processor to foul up this way.
A bigger problem is that Heartland isn't contacting the businesses directly so that they can contact their customers or give out warnings.
@Ryan Gard: Per my credit union, they said all they could tell me was that Heartland does the processing for a lot of convenience stores in this area. As I only use my affected debit card at one of two gas stations in town, I know it is a gas station in my case.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-21380-100x100.png\")
I'm sure their CFO only \"feels bad\" that anyone found out. I highly doubt he'll gives a rat's ass when fraudulent charges start showing up on everyone's credit cards.
What a lovely attitude.
Maybe a few million of us should get together, form a club and purposely charge things to each other's credit cards and then we'll see how easily this gets shrugged off when the credit-card companies are out a few hundred-million bucks.
Happened to me. Ate out at a local buffet the other night, card got canceled the next day. I'm glad my bank caught the fraud, but pissed these morons are so weak about protecting their systems!
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-101046-100x100.png\")
\"...no one will ever really know.\" ...or be able to (legally) prove any responsibility lies with us.
Wow!! How do I get into this business, where I don't have to fully disclose whose information was stolen FROM MY COMPANY, and where and when because it \"would be unfair to mention\" that kind of information.
I'm another one waiting on a new debit card. It's my credit union's policy to cancel the debit cards as soon as they hear and then issue replacement cards ASAP. Unfortunately, their definition of ASAP isn't the same as mine. So after the Hannaford deal, I added a bank so that we'd have different bank debit cards just in case.
I only use our debit cards at two area gas stations, so I know it was one of them. My banks will only tell me that they canceled the debit cards because of the Heartland breach and that new cards are being issued.
Personally, this is getting to be ridiculous. Two years ago, it was TJ Maxx. Last year, around the same time, I had to wait for a replacement after the Hannaford deal. Now it's Heartland. What's next?
I rarely use debit card anymore because I'm sick to death of having to make it to the bank during their hours to get cash when another company screw up leaves me without a debit card for a couple weeks.
With Hannaford, they said it was malware that was on their computer. Same with Heartland. Do these companies NOT have security measurements? Before any company processes a debit card, credit card or check, they should have to prove they have a quality virus/malware program installed, updating regularly and running properly. There's really no excuse.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-684050-100x100.png\")
Hey Chris, what's with the over-sensationalist headline?
\"May Affect Over 100 Million\" seems misleading when the article specifies 100 million transactions. The headline implies people.
No need for that.
@Rectilinear Propagation:That misses the point. What is the likelihood that 100 million transactions happen to each be for a separate person? My quibble wasn't with \"may\" but with generalizing transactions to people for affect.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-21984-100x100.png\")
@Gtmac: No 100 million separate transactions. Yes, the card number duplicate but the more separate transactions a person has had then the probably higher risk of exposure...
Think the old lady who uses her debit card once or twice a year to eat out versus the younger person who charges items even as small a Starbucks coffee on it each day.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-293158-100x100.png\")
Well, that explains it. Brother, myself, husband, parents and some people at work all had breaches last year. All issued new cards.
I feel so much safer now that the CEO apologized. /s
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-488475-100x100.png\")
Hmmm. I don't think this has affected me, but I'm going to check my statement online tonight anyway.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-131536-100x100.png\")
I stopped using plastic about a year ago (I do have one of those pre-paid visa's for online crap)
I have to say it's nice to have no worries, but when are these companies gonna be held accountable for shit like this??
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-6961-100x100.png\")
I had a message from the Key Bank Debit Card Management Center when I got home yesterday. The flagged a suspicious transaction - someone bought $103 from ITunes. They also attempted a second transaction which was stopped. Now, I'm paying a $5 \"Lost Stolen\" fee, disputing the $103 charge, and waiting for a replacement card.
They sounded very unsurprised, and in a big hurry. I think I'm going to start using CASH again.
Anyway, what idiot actually buys music?
There's website put up by Heartland at www.2008breach.comHere's one of the FAQ's:What is the extent of the breach? We believe the intrusion is contained.
I'm so relieved.
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-357256-100x100.png\")
I did get a new card recently. Just curious, who pays the banks for issuing the new cards? I mean, it wasn't Citi's fault. And with 100 million new cards, that can't be cheap.
I can see that we are going to be getting new credit cards a lot more often now! This is great for getting out of those slimeball companies who make you call them to cancel service. (24 Hour Fitness, Zagats, Sirius / XM, etc, etc)
oh, you better believe that Heartland will be reimbursing the banks for their time & expenses to reissue cards. The consumers might not know who Heartland processes, but the banks definitely do. You won't hear about it in the news, but there will be compensation.
They do not have to legally provide any information, only a confirmation of the security issue. Please understand how the system works before you flip out, cry, and forget all personal responsibility.
If you have a charge on your credit or debit card that you are pretty sure you didn't make, it is between you and your financial institution, not the company who services the merchant hardware and software for the retailer at which you shopped.
Call your bank or credit card, dispute the charges, and get some kleenex.
I had a card get blown out at the start of December. Some nimrod charged $100 at AirCanada which then incured a conversion charge. Luckily we caught it early and didn't loose more money. We had heard there was alot of id theft/card theft at airports but now it is making sense that the theft was probably through the card processor which is used by the small restaurants (with big prices) at the airports.
However the bank rep we dealt with this time was very nice and efficient about the problem. This may or may not be a change due to Regions gobbling up AmSouth. In 2005 when my (now ex)wife's card was blown out in the TJMaxx breach, an AmSouth fraud rep practically accused me of making all the transactions myself. He said \"these transactions required a card to be presented in person\" and I literaly had to tell him : \"No, my ex-wife was not in New York City buying $1400 at the Bananna Republic. I had to find the card in the bottom of the filing cabinet where I put it when we had separated over 9 months ago. Have you ever heard of card cloning?\" before he grudgingly allowed me to report it. Then we both had to go to the bank to sign affidavits about the fraud. This time no problem - entirely handled over the phone.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1491-100x100.png\")
This many card numbers, dumped all at once onto the black market... I wonder if this will depress the value of stolen credit card numbers.
This might have the effect of reducing the pay for scumware authors. Which would be nice.
What I get from this article is that as the technology frontier widens our interest will turn more and more towards digital security to protect our assets and identity. I found this site that pretty much explains where we are technologically today with regards to that:
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-330432-100x100.png\")
*Every single* restaurant or bar I have ever worked in (all non-chain places) have used Heartland to process card transactions. This breach is HUGE.
Citibank (before i fired them in disgust this month) issued me a new debit card (with a new number) about 2 months ago with no explanation. I pressed the person who called on the phone (who sounded like a phisher at first) for a reason. I was all, \"So does this mean somebody lost a laptop that had my card# on it or something?\" But of course he was unable to confirm or deny anything.
I wonder if it was this thing.
I got a call yesterday telling me my card was on the latest compromised list and that visa's already reissued it. So it'll work today but not tomorrow and I may not have a new card until the end of NEXT WEEK.
I'd like to go hold one of the tires on Heartland's CEO's car hostage for a week then just say \"oh sorry for the inconvenience\". I mean if he had locking lugs I wouldn't have gotten the tire the same way if they had had competent security someone wouldn't have gotten my number.
!#@hole.
Wow! This happened way back on January 20th and my bank just notified me today! Thanks Bank of Oklahoma! I'm a college student and I get call from my mom today saying my new debit card has come it. I'm totally confused because I never ordered a new card. She reads me the enclosed letter about the security breach. So now I have to wait for 2 weeks to go home to get the new non-compromised card. Checked online banking and didn't receive any sort of notification from Visa or BOK until today (3/3), that's really being on the ball guys! I think I would have liked to know a little bit earlier!
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-298363-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-52435-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-761932-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-248759-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-6536-100x100.png\")
I wonder if they will not get some type of bailout as well?