MyRecon OSINT← Case Files · The Breach Files
Heartland, 2008: 130 million cards from a company that had just passed its audit
- People affected
- about 130 million card numbers
- When it happened
- December 2007 – 2008
- Made public
- 20 January 2009
- How they got in
- SQL injection into a corporate web application, then lateral movement and a packet sniffer on the payment network
- Attributed to
- Albert Gonzalez and associates
- What it cost
- Around $145 million in settlements and costs
What was exposed: Card numbers · Expiry dates · Magnetic stripe track data
Heartland Payment Systems processed around 100 million card transactions a month for small and medium-sized merchants. It had been assessed as compliant with the card industry's security standard. It was also, at that moment, hosting a packet sniffer that had been quietly copying card data off its own network for months.
What happened
The attackers — the same group behind TJX — got in through SQL injection in a corporate web application in late 2007. SQL injection was the best-understood web vulnerability in existence by then, with a decade of documentation behind it.
That gave them a foothold on the corporate network, not the payment network. It took months of patient lateral movement to bridge the gap. Once across, they installed sniffer software that read card numbers and full magnetic stripe data out of the traffic as it was processed.
Card data was encrypted in transit between merchants and Heartland, and encrypted at rest. Inside the processing environment, in memory and on the wire, it was in the clear — because that is where the processing happened. That gap is what the sniffer harvested.
The compliance lesson, stated bluntly. Heartland had passed its assessment. Nothing in the standard as applied caught an injectable web application or the absence of segmentation between corporate and payment networks. An annual audit tells you the state of a system on the day someone looked; an attacker gets to choose a different day. Both things can be true: the assessment was valid, and the company was not secure.
The disclosure and its timing
Heartland announced the breach on 20 January 2009 — US presidential inauguration day, when the news agenda had room for nothing else. The criticism was immediate and it stuck.
What followed was more unusual. Chief executive Robert Carr went public in a way breached executives generally did not, arguing that the industry's model was structurally inadequate and that card data should be encrypted end to end so that processors like his own never held it in a readable form. Heartland invested in exactly that. It was a rare instance of a breached company making a technical argument in public and then funding it.
The timeline
- December 2007 — SQL injection provides initial access to the corporate network.
- Through 2008 — Lateral movement into the payment processing environment; sniffer software is installed.
- Mid–late 2008 — Card data is captured and exfiltrated.
- October 2008 — Card networks alert Heartland to suspicious activity traced to its processing.
- January 2009 — The sniffer is found; public disclosure on 20 January.
- 2009–2010 — Settlements with card networks and issuers total roughly $145 million; Gonzalez is indicted and sentenced.
What it changed
"Compliant" and "secure" separated in the industry's vocabulary. This is the case people cite, still, when a security programme is being run as an audit calendar. The standard itself moved towards continuous monitoring and more rigorous scoping as a direct result.
Point-to-point encryption and tokenisation gained momentum. If the processor never holds readable card data, a sniffer in its network captures nothing of value. Heartland's push after the breach helped normalise architectures where sensitive data is encrypted at the point of capture and replaced with tokens everywhere else.
Processors joined merchants as recognised targets. Attention had focused on retailers. Heartland demonstrated that the intermediaries aggregate far more data than any individual merchant, which is the same structural insight that made Change Healthcare so damaging fifteen years later.
What to take from it
- If you are responsible for a compliance programme, ask what it does not cover. The gap between the audit scope and the real system is where breaches live.
- Segment networks by sensitivity, not by convenience. The months the attackers spent bridging corporate to payment were months of opportunity to detect them.
- Reduce where sensitive data exists in readable form. Encryption at rest and in transit is table stakes; the interesting question is what happens in between.
- As a cardholder: this is why chip cards and tokenised mobile payments exist. Both remove the reusable secret that sniffers of this era were harvesting.
Questions people ask
How can a company be PCI compliant and still be breached?
Because compliance is a point-in-time assessment against a checklist, and security is a continuous property of a live system. Heartland had been assessed as compliant shortly before the breach. The assessment did not find the SQL injection flaw in a web application, and nothing in a passed audit stops an attacker who arrives the following week.
What is a packet sniffer and why was it so effective here?
Software that captures network traffic as it passes. Card data was encrypted in transit to and from merchants but was processed in the clear inside Heartland's own network. A sniffer placed there could read card numbers and full magnetic stripe data from a stream carrying around 100 million transactions a month.
Did the breach kill the company?
No. Heartland disclosed publicly, absorbed roughly $145 million in costs, and its chief executive became an unusually vocal advocate for end-to-end encryption of card data — arguing publicly that the industry's approach was inadequate. The company was later acquired. Candour after a breach turned out to be survivable.
Why did disclosure happen on inauguration day?
Heartland announced on 20 January 2009, the day of the US presidential inauguration, and was widely criticised for choosing a day when the news agenda was full. It is one of the earliest and most-cited examples of disclosure timing being treated as a communications decision — which is exactly why the timing of any breach announcement is now scrutinised.
Sources
- Heartland Payment Systems public statements and SEC filings, 2009
- US Department of Justice — indictment and prosecution of Albert Gonzalez, 2009–2010
- Payment Card Industry Security Standards Council guidance updates following the breach
Read next
Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.