Lorenzo's Security Blog

Heartland Payment Systems Inc., a New Jersey-based payments processor, has agreed to pay up to roughly $60 million to cover losses caused to Visa Inc. credit and debit cardholders as a result of a huge 2008 security breach, the companies have announced.

The settlement agreement is contingent upon acceptance by financial institutions representing 80 percent of the eligible issuers’ U.S. accounts that Visa says were put at risk during the Heartland intrusion, which Heartland disclosed in January 2009 had exposed more than 130 million credit and debit card numbers.

Heartland last month settled with American Express Co. for nearly $3.6 million, and settlements with other card issuers are expected.

Albert Gonzalez, a hacker federal prosecutors say was behind the Heartland and other big card breaches in recent years, has pleaded guilty in the case and is awaiting sentencing.