Breach may put cardholders at risk

NEW YORK — A security breach of customer information at a credit card transaction company could expose to fraud up to 40 million cardholders of multiple brands, MasterCard International Inc. said Friday.

The credit card giant said its security division detected multiple instances of fraud that tracked back to CardSystems Solutions Inc., which processes credit card and other payments for banks and merchants.

The compromised data included names, banks and account numbers — not addresses or Social Security numbers, said MasterCard spokeswoman Sharon Gamsin. Such data could be used to steal funds but not identities.

It was the latest in a series of security breaches affecting valuable consumer data at major financial institutions and data brokers in an increasingly database-driven world.

The breach appears to be the largest yet involving financial data, said David Sobel, general counsel at the Electronic Privacy Information Center.

"The steady stream of these disclosures shows the pressing need for regulation of the industry both in terms of limitation in the amount of personal information that companies collect and also liability when these kinds of disclosures occur," Sobel said.

A flurry of disclosures of breaches affecting high-profile companies including Citigroup Inc., Bank of America Corp. and DSW Shoe Warehouse has prompted federal lawmakers to draw up legislation designed to better protect consumer privacy.

CardSystems was hit by a viruslike computer script that captured customer data for the purpose of fraud, Gamsin said. She said she did not know how the script got into the system. The FBI was investigating.

MasterCard, which said about 14 million of its own cards were exposed, first announced the breach in a news release late Friday afternoon, saying it was notifying its card-issuing banks of the problem.

Under federal law, credit card holders are liable for no more than $50 of unauthorized charges, and many card issuers, including MasterCard, will even waive the $50.

Reached on his cell phone, CardSystems' chief financial officer, Michael A. Brady, said: "We were absolutely blindsided by a press release by the association."

He refused to answer any questions and referred calls to the company's chief executive, John M. Perry, and its senior vice president of marketing, Bill N. Reeves. A message left for Perry and Reeves at the company's Atlanta offices was not immediately returned.