Heartland's breach stole 130M card numbers — the largest payment card theft ever

In December 2008, Heartland Payment Systems, one of the largest payment processors in the US, disclosed that hackers had stolen approximately 130 million payment card numbers from its systems. The breach, carried out by hacker Albert Gonzalez and accomplices, used SQL injection to install malware on Heartland's payment processing servers.

The stolen card numbers were used for fraudulent transactions, and the breach affected millions of consumers. Heartland paid over $145 million in settlements, legal costs and security upgrades. The breach was the largest payment card theft in history at the time.

The case illustrated how a single vulnerability (SQL injection) in a payment processor can compromise data at a massive scale, and how the payment processing industry's centralized architecture creates a single point of failure that affects every merchant and consumer that uses the processor.