QSAs 'of no value at all' with Heartland data breach

2009-08-13

Chief executive officer of Heartland Payment Systems Robert Carr has said that audits done by the firm's Qualified Security Assessors (QSAs) were "of no value" at all in preventing the data breach that hit the company.

He told CSO that it was a "major problem" that the QSAs were telling Heartland it was secure before the data breach incident and that they were PCI compliant.

"The QSAs in our shop didn't even know this was a common attack vector being used against other companies," Mr Carr commented.

Heartland discovered that 300 other companies had been hit by the same malware that affected it.

He added that he could not resolve the fact that "people would know the exact attack vector and not tell major players".

Earlier this month, Mr Carr claimed that the company has been working hard to reduce the impact of the data breach that hit it and had gained recertification of its PCI compliant status because of the efforts of the IT team.

Read more security news.