New Settlement Agreement in Heartland Breach

And the cash register continues to ring with respect to the Heartland Payment Systems Inc. breach.

Heartland disclosed last week in a filing with the Securities and Exchange Commission that it has agreed to pay a maximum of $60 million to Visa Inc. and Visa card-issuing banks to settle claims arising out of the massive payment card data breach last January.

The proposed settlement is conditioned on 80% of eligible banks accepting the settlement offers. Under the agreement, some $59.2 million of the maximum settlement amount would be available to pay Visa card-issuing banks for their costs associated with the data breach. An additional $780,000 would be used to clear fines related to the breach collected by Visa from banks. According to the agreement, settlement offers will go out to eligible Visa-issuing banks next week and must be accepted by January 29.

More information: The full text of the Settlement Agreement

The real cost of data breaches - Heartland to pay Amex $3.5 million

According to its 8-K filing with the Securities and Exchange Commission (SEC), Heartland Payment Systems Inc. has agreed to pay American Express Travel Related Services Co. Inc. just over $3.5 million to settle any claims arising out of a massive payment card data breach.

This settlement is likely to be only the first over the compromise of tens of millions of debit
and credit card accounts by malicious software planted on Heartland's computers
that the Princeton, N.J.-based payment card processor revealed in January of this year.

On November 12, Heartland filed a Form 8-K with the SEC, stating that it had doubled from $35.6 million to $73.3 million its anticipated breach expenses for 2009, because it expected to settle litigation related to the breach.

Heartland faced a total of 17 consumer class actions and 10 bank and credit union class actions related to the breach, which were consolidated in the U.S. District Court for the Southern District of Texas. According to the Form 8-K filing, the newly announced settlement agreement
would release Heartland from any claims raised by AmEx or its issuing banks. The filing did not indicate whether the settlement is subject to court approval and did not include a copy of the agreement.

More on the real cost of the Heartland breach

Nearly 10 months after disclosing a months-long data breach that affected millions of consumers, the financial impact of the Heartland data breach continues to unfold. InformationWeek reports that Heartland stock prices plunged more than $500 million following the breach, and while shareholder value has rebounded, other breach related costs have thus far totaled $32 million, with numerous lawsuits against the company still pending.

Security Bits and Bytes

• The Wall Street Journal reports that the CEO of Heartland Payment Systems "gets religion" on security. You'll recall that Heartland reported what has been called the "largest security breach ever" earlier in the year.
• Researchers have uncovered a new platform used by cybercriminals to buy and sell batches of zombie PCs and other tools used to carry out attacks. The scheme is exposed in detail by Elinor Mills here and Robert Westervelt here.
• Reports from Illinois state auditors indicate that the Department of Financial and Professional Regulation cannot account for 52 computers. The department is responsible for regulating the banking and insurance industries as well as several professions, including accounting, medicine, and engineering. The agency cannot say if the missing computers held confidential information. The machines may have been transferred to other agencies, but there are no records indicating such transfers.