Heartland CEO says data breach was 'devastating'

Computerworld - Heartland Payment Systems chief executive Robert Carr remembers what it felt like when he first heard about the massive data breach at his company earlier this year.

"I wanted to throw up. It was devastating," says Carr, recalling how he felt upon realizing that one of his worst fears had come true. "People had asked me for years 'what keeps you awake at night' and I would keep telling them it was the fear of a data breach," he told Computerworld.

Five months after Heartland announced what some think may be the biggest data breach ever, Carr is working over-time to limit the fallout from the incident, and the damage to the company's reputation.

Since the incident was disclosed, Heartland has accelerated an end-to-end encryption program for protecting card data that it aims to complete in the third-quarter. The company is simultaneously pushing a broader effort to develop an industry-wide standard for encrypting data white it's being transmitted over networks.

The company has also co-founded a group called the Payment Processor Information Sharing Council to give organizations in the payments industry a forum for sharing information about security threats, vulnerabilities and fraud. At the group's first meeting in May, Heartland handed out a USB drive containing the malicious code that it had discovered on its networks as a sign of its willingness to share details of the attack with others in the industry. Carr has also been reaching out personally to customers, industry groups, security analysts and media to explain what the company has been doing in response to the breach. When rival firms tried to scare Heartland customers over the possible repercussions of using Heartland as a processor, Carr quickly fired out cease and desist letters.

The efforts have been noticed. Though Heartland still faces a flurry of lawsuits, and potentially big fines from card companies, customer attrition has been minimal, and so too has the damage to the company's reputation within the industry. Now, some analysts are beginning to give the company high marks for trying. Gartner analyst Avivah Litan said Carr's responses have been very different from those adopted by most CEO's in similar situations. "Generally when something like this happens, the CEOs hide," Litan said. In this case, Carr has been out in the forefront of his company's response to the crisis and has appeared willing to spend what it takes to restore a sense of confidence in the company.

"Some might question his real motives. But bottom line [is that] he is doing some good work. He is elevating the debate around card security and even got the card companies to speak about end-to-end encryption," Littan said.