June 23, 2005
Attorneys general from 48 states are asking CardSystems Solutions, Inc. to notify the 40 million Americans whose credit card numbers were put at risk in a security breach.
The National Association of Attorneys General joined an action initiated by Washington Attorney General Rob McKenna, who said, "Remedial steps must be taken immediately to minimize risk to consumers."
In a letter, the attorneys general gave CardSystems until July 25 to inform state AGs about how the company is notifying consumers or helping consumers who were victimized by the breach.
Meanwhile, at least one lawsuit seeking class-action status has been filed against CardSystems. The suit was filed in California Superior Court in San Francisco. It also names MasterCard International and Visa USA, Merrick Bank Corp. and 200 other unnamed defendants.
CardSystems discovered the breach at the end of May but consumers didn't learn about it until MasterCard announced about a week ago that millions of account numbers and names had been stolen. Atlanta-based CardSystems processes credit card and other payments for banks and merchants.
Hackers installed a rogue computer program that extracts data, potentially compromising 40 million accounts from MasterCard, Visa and other card issuers. Records on roughly 200,000 accounts were apparently stolen, according to news reports, but not social security numbers or birth dates.
McKenna sent a letter to CardSystems seeking details about how the breach occurred and how many Washington consumers were affected. The letter also asks what steps the company is taking to notify consumers and how it plans to prevent future security breaches. McKenna asked that the information be provided by June 30.
The breach that occurred at CardSystems is the latest in a disturbing series of cases affecting valuable consumer financial data, McKenna said. These events have pushed privacy matters to the top of the public policy agenda. I look forward to working with the financial industry, consumer advocates and law enforcement to determine what, if any, legal and regulatory changes are needed to protect consumer information and reduce the risk of fraud.
McKenna said consumers should examine their account statements for suspicious activity. They can also request an annual free copy of their credit report online at www.annualcreditreport.com or by calling (877) 322-8228.
