• PC World
• »Networking

A hacker was able to access potentially 40 million credit card numbers by infiltrating the network of a company that processed payment data for MasterCard International and other companies, MasterCard said late last week.

MasterCard has notified banks that issue its credit cards about the security breach, which victimized CardSystems Solutions, a Tucson, Arizona, back-office processing company, says Jessica Antle, a MasterCard spokesperson. Those banks will then take steps to notify their customers as they see fit, she says.

The network at CardSystems had certain vulnerabilities that allowed an outsider to access the card numbers, 13.9 million of which were connected to MasterCard cards, Antle says. MasterCard's fraud detection system first became aware of the infiltration in May, and the company promptly launched an investigation into the breach.

Under Investigation

However, the complicated investigation was not completed until earlier this week, when MasterCard was able to determine which credit card numbers were exposed and notify the banks that issued those cards, Antle says. Ubizen handled the initial forensic investigation, and the case has also been turned over to the U.S. Federal Bureau of Investigation. As far as MasterCard is aware, the person who infiltrated the CardSystems network has not yet been identified, she says.

Companies such as CardSystems process payment data for multiple credit card companies, which is why MasterCard numbers only accounted for 13.9 million of the numbers, Antle says. No other types of personal information, such as Social Security numbers, were compromised in the breach, she says.

Cardholders can dispute purchases that were not made by them with the bank that issued their card, and card holders will not be held liable for any purchases determined to have been made fraudulently, Antle says.

Security breaches don't always happen through hacking into a company's network. Citigroup recently notified customers that the credit information of 3.9 million customers was inside a package that disappeared while in transit from New Jersey to Texas in the care of United Parcel Service.