Retailer Sues Visa Over PCI Fines

A Tennessee sportswear company is suing Visa over PCI fines, maintaining hackers did not steal any stored payment card information on its computer network, but tried to access data it was transmitting to credit card processors.

March 14, 2013

NEW YORK - A Tennessee-based sportswear company filed a lawsuit last week against Visa seeking to recoup more than $13 million in fines imposed on it after a 2010 breach, SC Magazine reports.

Genesco is challenging the penalties levied against it for noncompliance of PCI security standards, during which the company??s computer system was hacked, potentially exposing customer credit and debit card details.

In the complaint, Genesco said that Visa "had no reasonable basis for concluding that Genesco was non-compliant with the PCI DSS requirement at the time of the intrusion or at any other relevant time." The PCI standards in question involve safety requirements for the storing of card data.

Genesco maintains that during the data breach, hackers did not steal any stored payment card information on its computer network, but tried to access data it was transmitting to credit card processors. The company also said that many of the accounts Visa flagged as being potentially compromised were not accessed in the breach due to Genesco rebooting its servers.

According to Genesco, attackers used "packet sniffer technology," which captures and analyzes information as it passes through a network.

"The criminals did this by inserting into Genesco's computer network malicious software that employed 'packet sniffer' technology custom designed to acquire account data while the data was in transit through Genesco's computer network [and] on its way to Fifth Third Bank or Wells Fargo for transaction approval," said the complaint.

After the 2010 breach, Visa accused Gensco and its banks of violating the Payment Card Industry standards, and fined the banks $5,000 each for noncompliance, later assessing a $13.3 million fine against them for operating expenses incurred over the breach and to recover the cost of fraudulent charges made to the accounts.

Advertisement
Advertisement
Advertisement