First we learned of a breach at RBS WorldPay detected on November 10th that resulted in fraud on at least 100 accounts.
Yesterday we learned of a breach at Heartland Payment Systems that presumably was going on during the fall and that has already been blamed for fraud in approximately 85 cases.
And in-between, we learned of mysterious micro-charges on thousands or millions of debit card and credit card statements that began in mid-November.
Are they all connected? Is there one large cybercrime outfit hitting the payment processors, or is there more than one group responsible for the two large breaches and the micro-charges incident?
Whether Heartland turns out to be the single biggest breach of all times is almost secondary to the larger issue of the state of security or lack thereof. In a recent analysis of 2008 breach data, I disagreed with any suggestion that the financial sector was the most proactive and raised the concern that the financial sector was not keeping pace with threats. It seems somewhat prophetic now. By the end of 2009, what will the figures for the financial sector look like if we could actually get the numbers on number of accounts accessed, etc.? Will 2009 be to the financial sector what 2006 was to the government sector or 2007 and 2008 to the business sector?