IMGCAP(1)]
After Heartland Payment Systems Inc. announced a massive data breach in January, its CEO, Robert O. Carr, issued a call to action, suggesting that payments players use encryption throughout the entire transaction and share breach forensics among themselves (CardLine, 4/27). About 30 representatives from 19 companies attended the inaugural meeting of the Payments Processing Information Sharing Council in early May. The malicious software used in the Heartland breach, which has cost the company nearly $13 million to date, reportedly has been used against other transaction processors. Given this, the group's first order of business was to distribute copies of the 14 pieces of malware that Heartland uncovered on its systems after it realized it had been breached, along with software from the forensics-investigative company Mandiant Inc. that can detect the malware. The council is open only to executives from transaction processors. The group is a subsidiary of the Financial Services Information Sharing and Analysis Center, which formed in 1999 to help financial companies fight Internet fraud. William B. Nelson, the analysis center's president and CEO, says he would like to conduct a mock breach so council members can get some practice in dealing with a cyberattack. "We want to test the ability of everybody to get on a call quickly and how they would respond to the circumstances," Nelson says. Carr called the council's first meeting a success. "I was concerned there would be jockeying by some of the companies to get a competitive edge," says Carr. "But there seemed to be genuine interest in doing what's best for each other and the industry." Analysts have applauded the effort, comparing the information-sharing concept to one that has an established track record in fighting other types of financial fraud, such as pump-and-dump stock schemes. "One of the problems in the U.S. is that companies don't share enough information about fraud, and fraudsters don't restrict their attacks to one company," says Avivah Litan, a vice president and research director at Gartner Inc., a market research firm in Stamford, Conn.
