Heartland and Visa Agree To $60 Million Settlement

After Heartland Payment Systems and American Express agreed to a $3.6 million settlement in December, earlier this month Heartland and Visa agreed to a $60 million settlement. Bank Info Security reported that Heartland:

"... will pay Visa-branded credit and debit card issuers up to $60 million to cover losses incurred from the Heartland data breach. It is the largest known settlement amount ever paid to Visa as a result of a breach, eclipsing the TJX settlement of $40.9 million in November 2007."

Issuers are the banks and credit unions that administer Visa-branded debit- and credit-cards to consumers. Those issuers incurred costs to replace their consumers' stolen cards with secure new cards, and to replace their customers' stolen money. Industry experts estimated that the cost to replace a card is about $20 per consumer. Heartland never disclosed exactly how many consumer accounts were affected by its breach, but experts estimated that the identity thieves stole about $50 million. Heartland processes about 100 million card transactions monthly and more than 330 banks reported that their cardholders were affected.

"The settlement also includes mutual releases between Heartland and its sponsoring bank acquirers on the one hand, and Visa on the other. Heartland will fund up to $59.22 million of the amounts to be made available to Visa and its issuers under the settlement program. Additionally, Visa will credit the full amount of intrusion-related fines it previously imposed and collected from Heartland's sponsoring bank acquirers toward the $60 million maximum funding of the program."