| Visa: Heartland, RBS WorldPay
no longer PCI compliant
March 13 2009
Updated on Friday,
March 13 at 2:31 p.m. EST
announced on Friday that it has removed Heartland
Payment Systems and RBS WorldPay -- two payment
processors that have announced massive data breaches
in recent months -- from its list of service providers
compliant with payment industry guidelines.
could be a pretty significant event because retailers
are obligated to use PCI compliant service providers,"
Avivah Litan, a distinguished analyst at Gartner, told
SCMagazineUS.com on Friday. "It's almost like saying
all their customers have to leave them."
a processor is not compliant, then their merchant customers,
in turn, may be violating their terms of the guidelines,
potentially opening themselves up to fines, Litan said.
had been listed as under review -- but still compliant
--prior to Friday's announcement, but now Visa has removed
the Princeton, N.J.-based company from its lengthy list
of service providers compliant with the Payment Card
Industry Data Security Standard (PCI DSS). It
was unclear whether RBS also had been under review.
and RBS WorldPay are actively working on revalidation
of PCI DSS compliance using a qualified security assessor
(QSA)," said a Visa statement. "Visa will
consider relisting both organizations following their
submissions of their PCI DSS reports on compliance."
DSS requires companies that process more than six million
credit card transactions each year must undergo annual
on-site reviews from an approved QSA, as defined
by the PCI Security Standards Council, which manages
the PCI guidelines.
When informed by SCMagazineUS.com on Friday that Visa
had removed Heartland from its list of compliant vendors,
a spokesman for the company said he was unaware of the
company later issued a statement that said it currently
is undergoing a PCI assessment and hopes to be recertified
as compliant by May.
is cooperating fully with Visa and other card brands
and we are committed to having a safe and secure processing
environment," the statement said. "Heartland
was certified as PCI DSS compliant in April 2008 and
expects to continue to be assessed as PCI DSS compliant
in the future."
Heartland, RBS WorldPay no longer PCI compliant -Print
Article -SC Magazine US
statement on Friday from RBS said the processor was
planning to be recertified by April.
has asked us to obtain a new certification of PCI compliance
because of the recent data-security compromise,"
the statement said. "Visa has removed us from its
list of approved PCI-compliant processors until the
new certification is complete. There have been no material
system changes that would have negatively altered this
certification and we have, in fact, enhanced the security
of our systems in the interim. Because of the criminal
intrusion, we need to be recertified earlier than the
-- which disclosed earlier this year that it
may have exposed tens of millions of records to hackers
-passed a PCI assessment last April, according to Visa.
RBS previously had said it was compliant with
PCI; however, the company made no mention of the standard
when it announced its data breach, which involved
some 1.5 million victims, in December.
essential that every business that handles payment card
information adhere to the highest standards to protect
the security and privacy of their customers' financial
information," Visa's statement said. "The
PCI DSS remains an effective security tool when implemented
properly -- and remains the best defense for businesses
against the loss of sensitive data."
Heartland and RBS WorldPay said they still were processing
Visa transactions. A spokeperson at MasterCard could
not be reached for comment.
Mogull, founder of IT security consultancy Securosis,
said in an email Friday to SCMagazineUS.com that the
PCI assessment process needs revamping.
"What we see is that although no
PCI-compliant company seems to ever get breached, many
are certified and then found non-compliant after the
breach," he said. "Thus, it's clear the certification
process is flawed. While I don't expect certification
to impart immunity from attack, decertifying all these
companies seems disingenuous."