Global Payments Processor Breach (2012)

Global Payments Inc. was a US-headquartered payment processor listed on the New York Stock Exchange. Its North American processing environment supported card authorization, clearing and settlement for hundreds of thousands of merchant customers.

The company held Track 2 magnetic-stripe data and PANs in transit across its processing infrastructure. Its PCI-compliant listing was a material element of its ability to retain merchant customers and remain on card-brand approved lists.

Mid-2011 to early 2012. Attackers gained access to Global Payments' North American card processing environment. Investigators subsequently indicated the intrusion involved compromised administrative accounts and lateral movement across processing infrastructure.

March 2012. Global Payments detected unauthorized activity and began investigation.

30 March 2012. Following independent reporting by Brian Krebs, Global Payments publicly confirmed the breach.

April 2012. Visa removed Global Payments from its approved list of PCI-compliant service providers. MasterCard maintained similar posture pending re-assessment.

Late 2012 into 2013. Global Payments disclosed remediation and response costs exceeding $90 million. The company completed re-certification and was restored to card-brand approved lists.

Longer term. The breach contributed to industry acceleration of end-to-end encryption, tokenization and, in the US, EMV chip adoption.

In plain English: attackers used compromised admin accounts inside Global Payments to reach the processing environment and copy card data.

• Compromised administrative credentials created the foothold.
• Insufficient segmentation between administrative infrastructure and card-processing systems allowed lateral movement.
• Track 2 data was accessible in processing memory without adequate protective controls.
• Detection controls did not identify the exfiltration promptly.
• PCI attestation had not required the depth of segmentation that would have prevented the lateral path.

Global Payments was a certified vendor that hundreds of thousands of merchants relied on. Its failure was a shared failure.

• Compliance without architecture. PCI attestation had not translated into effective segmentation.
• Merchant visibility zero. Merchants had no ability to demand or verify processor-side controls.
• Concentration risk unpriced. A single processor breach replayed across a merchant base numbered in the hundreds of thousands.
• Detection dependence on external reporting. Public awareness preceded direct card-brand notification for many issuers.
• Notification asymmetry. Card issuers absorbed downstream cost while the processor rebuilt its compliance posture.

• Approximately 1.5 million card numbers reportedly exposed.
• More than $90 million in disclosed remediation and response costs per Global Payments' SEC filings.
• Temporary removal from card-brand PCI-compliant listings.
• Class-action and shareholder litigation.
• Long-term reputational impact and increased customer scrutiny of processor architecture.

Combined with the earlier Heartland breach, Global Payments reinforced the industry consensus that PCI compliance is a floor, not a ceiling. It accelerated adoption of end-to-end encryption between the merchant terminal and processor, tokenization at the acquirer boundary and, in the US, the migration from magnetic-stripe transactions to EMV chip authentication under the 2015 liability shift.

For TPRM programs, the case became evidence that even publicly traded, audited, certified processors can fail architecturally.

Global Payments' remediation and public communications were disciplined, and the company rebuilt its compliance posture quickly. The lesson is not that the response was inadequate; it is that even a competent response cannot rewind downstream fraud, and merchants relying on the processor had no equivalent path to remediate their own trust deficit with cardholders.

1. Treat PCI attestations as a floor; require evidence of internal segmentation and admin path controls.
2. Require processors to demonstrate protected memory handling of card data during processing.
3. Maintain a documented exit path so processor removal from approved lists does not freeze settlement.
4. Track processor concentration as a board-visible risk metric.
5. Require notification within hours of processor detection, not within the regulatory minimum.
6. Tokenize card data at the merchant boundary so a processor breach contains less to steal.
7. Require processors to share architectural changes made since last assessment, not just the last QSA report.
8. Include processors in periodic tabletop exercises simulating loss of the acquirer relationship.

"When your processor loses its compliance listing, your merchants lose their story with cardholders overnight."