Card-data theft puts legislation in spotlight

Debie Keesee got the bad news four days before it hit the financial press Tuesday: Sophisticated hackers had intercepted vast streams of unencrypted data sent by one of the nation's largest bank-card processors, potentially exposing millions of consumers to fraud.

As CEO of Spokane Media Federal Credit Union — "a membership of 1,269, exactly" — Keesee knew the data breach included more than half of her institution's debit cards.

"We have a base of 650 cards — on Friday I got notification that 330 of those cards had been compromised," she told a state House committee hearing on Thursday. She added in a later interview, "We will continue to get alerts every day. It's not over."

She and her staff of three began notifying customers, freezing and reissuing their cards, and "explaining to angry members that we weren't the ones who lost their data."

It's not just "an administrative nightmare," as Keesee puts it — the costs quickly add up. And with data breaches proliferating, Keesee and other credit-union managers worry they can't always afford to take the safest route and replace customers' cards at the slightest hint of trouble.

The massive break-in disclosed last week was at Heartland Payment Systems, which handles 100 million transactions a month for about 250,000 merchants.

Heartland is the only processor recommended by the Washington Restaurant Association to its members, chosen because "they had some of the highest standard of computer protection," says group president Anthony Anton.

News of the breach put a spotlight on legislation the Washington Credit Union League is pushing in Olympia that under some circumstances would allow financial institutions to collect reimbursement from merchants or processors that let customers' card data slip out.

The state House passed a similar bill last year but it ran aground in the Senate; this year's version, HB 1149, got its first hearing Thursday.

Bruce Cramer, president of the small and quaintly named O Bee Credit Union in Tumwater, Thurston County, told the committee that in the Heartland breach, "we estimate our cost at this point for reissuing the cards at $10 per card, and we don't know how much the fraud is going to be."

Financial institutions typically have insurance to cover some losses from card fraud, but deductibles and coverage limits mean they can still take a hit.

Cramer sounded angry at Heartland's breach, and others like it. "These guys are not amateurs. We entrust them with this data and they should take steps to protect it."

The biggest breach of bank-card data was in 2007 at TJX Cos., owner of discount-retail chains TJMaxx and Marshalls, where hackers got information on a reported 45 million credit and debit cards.

Financial institutions don't get automatically reimbursed for their costs in such a case, says credit-union lobbyist Mark Minickiello, and there's no law that lets them sue to collect.

Although Visa and MasterCard negotiated a settlement with TJX, "what we got was basically pennies on the dollar for the fraud, but we were never reimbursed for the cost of reissuing the cards," Minickiello said.

Restaurateurs and retailers don't like HB 1149 because they worry they'll be held responsible for someone else's lapses.

The restaurant group's Anton says the measure "shifts responsibilities away from the banks and credit unions to mom-and-pop restaurants. ... If somebody's processor — that a restaurateur has never seen — is criminally broken into, how is that the restaurateur's fault?"

Community Bankers of Washington, which represents banks headquartered in the state, was against last year's measure and has concerns about the new version as well, says President John Collins.

Tech companies are watching the current bill closely, though they haven't taken a position, Washington Technology Industry Association lobbyist Lewis McMurran told legislators.

"It's a global problem. Those that are creating data breaches are generally organized-crime groups from overseas, and this problem is not going to go away," he said.

Outrage over the big Heartland breach may not be relevant for the bill being pushed by the credit unions, however. The measure requires merchants and processors to dispose of a bank card's details within 48 hours after a transaction is authorized, and lets financial institutions recover costs only if that requirement is violated.

According to news reports, the Heartland breach occurred when the hackers implanted "sniffer" software to grab unencrypted card data as it was traveling to banks for processing. If that's the case, acknowledges the credit unions' Minickiello, "then the answer is no, we can't sue them."

Hiring plans

hinted at future

Maybe if we'd ignored the soaring home values and robust jobs reports a couple years back, and paid more attention to companies' actual hiring plans, the current economic slump wouldn't have come as such a shock.

Job openings — ones that employers in the state are actively trying to fill — began falling as far back as the spring 2007, and the decline accelerated through 2008, according to the latest Job Vacancy Survey issued by the state Employment Security Department (ESD).

"It's an early warning of sorts," said David Wallace, the ESD economist who compiles the vacancy survey. When companies start to get worried about their futures, Wallace noted, they usually pull back on hiring long before they start laying people off.

Ever since the department started the twice-a-year survey in 2003, total employment and reported vacancies had risen more or less in tandem. When they diverged dramatically nearly two years ago, that should have been a warning that Washington's jobs engine was starting to misfire.

Whether the survey will foreshadow any eventual recovery is unknown, since this is the first business cycle it's going through.

The most recent survey of job openings — though fall 2008 seems so long ago — suggests that it might be a good idea to learn how to insert an IV line or take a pulse.

Health and personal-care jobs were again the biggest opportunities: a total of 13,205 out of the 50,593 openings reported. And, while many of the openings cited in the survey may since have slammed shut (such as the 1,667 in "business and financial operations"), health services and social assistance remains one of the state's stronger sectors: It added 6,600 jobs in 2008.

— Drew DeSilver

Comments? Send them to Rami Grunbaum: rgrunbaum@-

seattletimes.com or 206-464-8541