Visa and MasterCard have begun to warn financial institutions, includingcredit unions and credit union payment CUSOs, that there has beenyet another major breach at a card payments processor, according toBrian Krebs, a former Washington Post reporter who now publishes ablog, KrebsonSecurity, focusing on online security issues.

News Update, March 30, 2012: PSCUConfirms Card Breach
News Update, April 2, 2012: Global Payments Inc. Says Breach Contained

Citing unnamed sources, Krebs reported that the breach could be“massive,” that it appears to have taken place between Jan. 21 andFeb. 25, that it could involve tens of millions of cards and thatthe hackers appear to have obtained both track 1 and track 2 carddata.

Having data from both card tracks enables thieves to createcounterfeit cards more easily.

Krebs cited PSCU as one of the CUSOs that has alerted creditunions to the breach, but PSCU had not yet confirmed it onFriday.

“While the scope and details of the attack are not yet known, itshows that three years after the Heartland Payment Systems breach of 130 million credit cardnumbers, credit card data is still vulnerable,” wrote Neil Roiter,research director at Corero Network Security, about the breach.

“The Payment Card Industry Data Security Standard (PCI DSS) ishighly prescriptive in nature, but simply complying does not ensurecredit card security. Companies that rely on PCI DSS to solelydictate their security measures will continue to remain vulnerableto attack,” he added.