MasterCard made the announcement on Friday 17 June 2005. An intruder had got into the network of CardSystems Solutions, which processed merchants' card payments on computers in Tucson, Arizona, and had exposed some 40 million card accounts of every brand to fraud — about 13.9 million of them MasterCard's; Visa put its own at about 22 million. A script placed on the network could extract data that should not have been there: MasterCard said CardSystems had been storing account numbers and security codes against its rules. “They were in violation of our rules,” said a MasterCard spokeswoman, Jessica Antle; Visa said the processor had not been following its security requirements. CardSystems said it had found the intrusion in late May and reported it to the FBI.
The rest came out slowly. Since 1998, the Federal Trade Commission later alleged, CardSystems had kept authorisation responses, magnetic-stripe contents and security codes included, for up to thirty days; its chief executive, John M. Perry, said the data had been kept for “research purposes”, to look into transactions that had not been authorised or completed. In September 2004, by the commission's account, a hacker used an SQL injection attack on the company's website to plant common hacking programs, set from November to gather stripe data and send it out every four days; by early 2005 banks were finding counterfeit cards that passed as genuine. Forty million was exposure, not theft: the cards known to have been taken numbered about 263,000, some 68,000 of them MasterCard's.
The card networks moved next. On Monday 18 July Visa told the banks that used CardSystems that it would no longer accept the company as a processor, giving them until the end of October; the next day American Express said it would end its relationship too. On 21 July Perry told a House subcommittee that the company regretted the theft, said it had been certified by a security assessor that Visa approved, and warned that CardSystems was being driven out of business. That certificate, Perry had said in June, rested on an audit by an independent assessor in December 2003.
In October Pay By Touch, which sold payment by fingerprint, agreed to buy CardSystems' business; the sale closed in December. On 23 February 2006 the FTC settled with CardSystems and its successor, Solidus Networks, over what it called “the largest known compromise of financial data to date”. The order required a security programme and independent audits every two years for twenty years. “CardSystems kept information it had no reason to keep,” said the commission's chairman, Deborah Platt Majoras. The buyer did not last: Solidus ended up in bankruptcy court at the end of 2007, and on 19 March 2008 Pay By Touch shut down.
The Day Before
On 16 June 2005, the day before MasterCard spoke, the Federal Trade Commission announced that BJ's Wholesale Club of Natick, Massachusetts, had agreed to settle charges over its customers' card data. The commission alleged that BJ's had not encrypted the data in transit or on its store computers, had kept it for up to thirty days after it no longer needed it, had left it in files that opened with commonly known default user IDs and passwords, and had not used readily available measures to stop unauthorised wireless connections to its networks. Counterfeit copies of customers' cards, carrying the same magnetic-stripe data, had paid for millions of dollars of purchases elsewhere; by May, BJ's filings put outstanding claims at about $13 million. The settlement required a security programme and independent audits every other year for twenty years. The novelty was the theory. Earlier cases had held companies to security promises they had made; this one called weak security itself unfair, the first time the commission had alleged that inadequate data security could on its own be an unfair business practice. CardSystems was charged on the same ground.
Written for the Reader
On 16 June 2005 Britain's National Infrastructure Security Co-ordination Centre published a briefing on emailed trojan attacks against government departments, companies and other organisations, which it said had gone on for some time and had lately grown more sophisticated. Each message carried a trojan as an attachment, or a link to a website that hosted one, under a subject line drawn from recent news to appeal to recipients, mostly people who handled commercially or economically sensitive information. Once opened, the program could collect information and give someone outside control of the machine. Anti-virus software and firewalls, the centre warned, would not fully protect against it; it advised training staff and checking firewall and mail-server logs for unusual IP addresses. It named no victim and did not say whether anything had been taken. Nor did it name anyone responsible: subject headers and IP addresses, it said, suggested the mail had been sent from the Far East. On 8 July the US Computer Emergency Readiness Team published its own alert on targeted trojan email.
A Thousand Names on a Disc
On 23 June 2005 The Sun reported that one of its reporters had bought the details of 1,000 British bank customers from an IT worker in Delhi for a few pounds a record: account details, passwords, and credit-card and passport numbers. The seller, the paper said, boasted that he could supply as many as 200,000 account details a month; a security expert it hired said the data was genuine. Each was a claim, and testing them proved harder than printing them. The City of London Police took the paper's dossier but said it had no jurisdiction to prosecute in Britain, and passed the information to the Indian authorities through Interpol.
The worker, 24, denied the claims in a BBC radio interview. His employer, a web-design firm, sacked him but said it had never held the kind of information the paper described; Barclays, named as a bank that might have been affected, said it was taking the allegations very seriously and investigating. Nasscom, the industry association, said it was building a central database of the industry's employees to keep criminals out, the registry it announced in January 2006. In Britain an Amicus union official said companies with offshore jobs needed to reflect on their decision.
Blue Brain and the pedestrian detector
On 6 June 2005 IBM and the École Polytechnique Fédérale de Lausanne announced the Blue Brain Project: a Blue Gene supercomputer with a peak speed of at least 22.8 teraflops would run a software replica of one neocortical column, a first step towards modelling the whole brain. Henry Markram, its leader, called it “the equivalent of going to the moon”. At the Conference on Computer Vision and Pattern Recognition in San Diego later that month, Navneet Dalal and Bill Triggs of France's INRIA presented histograms of oriented gradients — tallies of gradient directions over a dense grid of small cells — to feed a support vector machine that picked out people in still images. The method all but solved the MIT pedestrian database, so they built a harder set of 1,805 images of people. Blue Brain modelled its first column in 2006, Markram called IBM's claim of a cat-scale cortex a hoax in November 2009, and the project closed in December 2024; the San Diego paper won the Longuet-Higgins Prize, for decade-old CVPR papers of lasting influence, in 2015.
Reputation, Wi-Fi and a firewall change hands
On 14 June 2005 Trend Micro announced its purchase of Kelkea, which until mid-2004 had been the Mail Abuse Prevention System, the non-profit where Paul Vixie and Dave Rand had begun listing the IP addresses that sent spam and distributing the list through the domain name system. Kelkea held profiles of some 1.5 billion addresses; terms were not disclosed, and Rand became Trend Micro's chief technologist of internet content security. McAfee had opened the month by buying Wireless Security Corporation, which secured the Wi-Fi networks of homes and small businesses, for about $20 million in cash, planning a consumer product for the third quarter. On 27 June Computer Associates said it had bought Tiny Software of Santa Clara, a personal-firewall maker with fewer than twenty staff, in an all-cash deal closed in late May; the firewall was to join CA's anti-virus and anti-spyware under one console. Judging the sender rather than the message anticipated the Smart Protection Network, the cloud service Trend Micro introduced in June 2008, which reduced reliance on pattern files downloaded to every machine.
⏳ Time capsule — June 2005
- On 5 June, at the 59th Tony Awards at Radio City Music Hall in New York, Monty Python's Spamalot, directed by Mike Nichols, was named best musical and John Patrick Shanley's Doubt best play; The Light in the Piazza took the most awards, six.
- On 6 June Coldplay released X&Y in Britain, a day before its American release; it went on to sell 8.3 million copies by the year's end, the best-selling album of 2005 worldwide in the count of the International Federation of the Phonographic Industry.
- On 21 June Cosmos 1, a $4 million solar-sail project of the Planetary Society and Cosmos Studios, was launched on a Volna rocket from the Russian submarine Borisoglebsk, submerged in the Barents Sea. The rocket failed, and the craft never reached orbit.
- On 28 June Google released Google Earth, built on EarthViewer, the software of Keyhole, the company it had bought in October 2004.
What Was Kept
The card industry's rulebook was already written when MasterCard spoke. Version 1.0 of the Payment Card Industry Data Security Standard, bringing Visa's Cardholder Information Security Program together with the other brands' programmes, had been released on 15 December 2004; the networks set up a council to maintain it in September 2006, and in version 4.0.1, the only one now active, the third of twelve requirements still reads “Protect stored account data”. A certificate proved a thinner shield than an empty database. A Visa alert found TJX keeping cardholder data against the standard (January 2007); Hannaford passed its assessment with the intruders already inside (March 2008); and the crew indicted in August 2009 went in, as CardSystems' intruder had, by SQL injection.
The emailed trojan the British centre described, with a subject line chosen to interest its recipient, recurs through this archive: a congressional speech in an attachment at the State Department (July 2006), mail that seemed to come from colleagues behind GhostNet (March 2009), a “2011 Recruitment plan” at RSA (March 2011). Indian law now speaks to data like that on the disc The Sun said it bought: section 17 of the Digital Personal Data Protection Act of 2023, whose obligations on companies take effect in May 2027, lifts most of them from the processing in India, under contract with someone abroad, of data about people outside India — but not the duty to protect it with reasonable security safeguards, a breach of which can cost up to ₹250 crore.