Heartland Payment Systems card breach

On 20 January 2009, the New Jersey payment processor Heartland Payment Systems disclosed that criminals had breached the systems it used to process card transactions for some 175,000 merchants. The exposure — estimated at up to 130 million card numbers — made it, at the time, the largest payment-card breach ever publicly disclosed, surpassing even the TJX intrusion by the same crew.

What happened

The attack began with a familiar weakness: a SQL-injection vulnerability in a Heartland corporate web application, exploited as early as 2007. SQL injection lets an attacker smuggle database commands through an input field, and here it gave the intruders an initial foothold on Heartland's corporate network.

From there the crew worked patiently — for months — to pivot into the payment-processing environment itself. Once inside, they deployed sniffer malware that read card-track data as it traversed Heartland's internal network unencrypted during the brief window between receipt and forwarding to the card brands. Because the data was captured in transit at the processor, the haul spanned a vast number of merchants and cardholders.

How it was run

The intrusion was orchestrated by Albert Gonzalez, the same operator behind the TJX breach, working with two co-conspirators the U.S. Department of Justice located in Russia. The 2009 indictment described a coordinated campaign — informally branded "Operation Get Rich or Die Tryin'" — that also hit Hannaford Brothers and 7-Eleven. Stolen track data was sold or encoded onto counterfeit cards.

Impact

• An estimated 130 million card numbers were exposed across roughly 175,000 merchants.
• Heartland's total costs, including settlements and fraud reimbursement, exceeded $200 million; the company reported paying out well over $140 million in compensation.
• Heartland settled with Visa (up to roughly $60 million) and MasterCard (around $41 million) issuers, among other agreements.
• Albert Gonzalez was sentenced in 2010 to 20 years in federal prison.

Why it matters

Heartland reshaped how the payments industry thought about data-in-transit. The card numbers were technically protected at rest and in storage, but they crossed the internal network in the clear — and that was enough. In the breach's wake, Heartland's CEO became a vocal champion of end-to-end encryption for card data, helping push the industry toward point-to-point encryption and, eventually, tokenization and EMV chip adoption. The case remains a defining lesson that a payment processor is a single point of failure for millions of merchants, and that PCI-DSS compliance at a point in time does not guarantee security against a determined intruder.