Heartland earns back spot on PCI-approved list

Computerworld - The processing firm Heartland Payment Systems has been reinstated to Visa Inc.'s list of service providers deemed compliant with the Payment Card Industry Data Security Standard (PCI DSS).

The move follows Heartland's successful completion of an annual assessment for compliance with the PCI standard, the company said in a brief statement released on Friday. Heartland had been dropped from the list of compliant vendors by Visa in mid-March following an investigation into the massive data security breach announced by Heartland in January.

Visa's action raised questions about whether merchants and other organizations could continue using Heartland without being penalized for noncompliance themselves.

That's because Visa requires all entities that accept credit and debit cards issued under its name to work only with service providers that comply with the PCI rules, a set of security controls mandated by major credit card companies.

The doubts were heightened Heartland rivals began warning its customers of potential problems they could face if they continued using Heartland after it had been dropped from the list. Those claims led to Heartland sending cease and desist letters threatening legal action against rivals that did not stop scaring its customers.

Though Visa later issued a statement assuring Heartland customers that they could continue using the company without fear of being penalized, today's reinstatement removes any cloud of uncertainty that may have remained. "Heartland has passed its audit. We are excited and delighted," a Visa spokesman said today. The company will reappear on Visa's PCI-compliant list on Monday.

The Heartland breach, which some believe may have compromised as many as 100 million payment cards, also led to Heartland being put under an unprecedented probationary period by Visa. RBS WorldPay, which also processes payments, was also taken off the PCI-compliant list in March of this year after it disclosed a significant data breach in December 2008.

In a statement issued at that time, Visa said it was delisting the two payment processors based on "compromise event findings." The company had noted at that time it would consider putting Heartland and RBS WorldPay back on the compliant list (PDF document), but only after they were recertified by a third-party assessor.

Read more about security hardware and software in Computerworld's Security Hardware and Software Knowledge Center.