Protecting Payment Data: What Recent Breaches Teach Us

Data breaches aren’t a new problem, but they continue to expose businesses and their customers to financial loss and reputational damage. Many of these attacks exploit preventable vulnerabilities, highlighting the need for proactive security measures. 

Below, we examine some notable payment data breaches from the last year, what went wrong, and how businesses can improve their defenses.

‍

LoanDepot: Ransomware Disrupts Operations (January 2024)

LoanDepot, a major mortgage lender, suffered a significant ransomware attack that disrupted operations and exposed sensitive customer data. The breach impacted loan application details, Social Security numbers, and financial account information—making it a severe incident from both a compliance and reputational standpoint.

Key Takeaway: Ransomware remains a top threat to businesses handling financial data. Implementing strong endpoint detection, network segmentation, and offline backups can help prevent and mitigate attacks.

(Source 1) (Source 2) (Source 3)

‍

Change Healthcare: A Healthcare Giant’s Security Lapse (February 2024)

Change Healthcare, a leading healthcare payment processor was hit by a cyberattack disrupting payment processing and exposing sensitive medical and financial data. The breach highlighted vulnerabilities in healthcare payment infrastructures and compliance gaps.

Key Takeaway: Protecting payment data in healthcare requires more than just compliance. Businesses should deploy tokenization, encryption, and a zero-trust approach to limit unauthorized access.

(Source 1) (Source 2) (Source 3)

‍

Snowflake: A Supply Chain Catastrophe (May 2024)

The Snowflake attack affected multiple companies, including Ticketmaster and AT&T, by exploiting a vulnerability in third-party cloud storage. This breach exposed massive amounts of customer data, including payment details used for ticket purchases and telecom services, as well as cellular customers’ calls and texts.

Key Takeaway: Third-party risk management is crucial for payment security. Businesses relying on cloud storage and third-party services must conduct regular security assessments, enforce strong access control, and monitor for unusual activity in their cloud environments.

(Source 1) (Source 2) (Source 3)

‍

Dell: Phishing and Customer Data Exposure (June 2024)

Dell confirmed a security breach that exposed customer records, including purchase history and contact information. While financial data may not have been directly impacted this time, attackers often use the stolen information for phishing scams aimed at stealing payment credentials.

Key Takeaway: Payment processors and merchants should enforce multi-factor authentication (MFA) and educate customers on recognizing phishing attempts. A layered security approach ensures that even if one defense fails, others can still prevent fraud.

(Source 1) (Source 2) (Source 3)

‍

Strengthening Payment Security: Best Practices

1. Adopt PCI DSS Compliance: Ensure adherence to the Payment Card Industry Data Security Standard (PCI DSS) to protect cardholder data.
   
   
2. Utilize Tokenization and Encryption: Replace sensitive payment information with tokens and encrypt data to minimize exposure in case of a breach.
   
   
3. Implement Zero-Trust Security: Restrict access to payment data, continuously verify users, and segment networks to limit attack impact.
   
   
4. Monitor Transactions in Real-Time: Use AI-driven fraud detection to identify suspicious payment activities before damage occurs.
   
   
5. Educate Employees and Customers: Human error is a major risk factor. Training staff and customers to recognize phishing attempts and social engineering tactics is essential.

‍

Final Thoughts

Cybersecurity might not always feel like the most pressing business priority, but every company, regardless of size, is a potential target. Safeguarding your customer’s data is a responsibility that builds trust and protects against costly breaches. By proactively strengthening security measures and learning from past attacks, you can significantly reduce your overall risk.

At Propelr, we take security seriously. Our payment solutions are backed by  PCI-valided point-to-point  encryption, tokenization, and fraud prevention tools to help you protect your transactions and your customer’s sensitive data. Want to learn more? Contact us today to discuss how we can enhance your payment security strategy.