Heartland to pay up to $60 million after data breach

Heartland Payment Systems and Visa announced a settlement agreement under which issuers of Visa-branded credit and debit cards will have an opportunity to obtain a recovery from Heartland with respect to losses they may have incurred from the 2008 criminal breach of Heartland’s payment system environment.

Heartland will pay up to $60 million to fund the settlement program, which is subject to certain conditions, including a specified level of participation by U.S. Visa issuers. Visa will present details of the settlement to eligible issuers in the coming days.

The Visa/Heartland settlement agreement is contingent upon acceptance by financial institutions representing 80 percent of the eligible issuers’ U.S. accounts that Visa considered to have been placed at risk of compromise during the Heartland intrusion.

The settlement also includes mutual releases between Heartland and its sponsoring bank acquirers, on the one hand, and Visa on the other. Heartland will fund up to $59.22 million of the amounts to be made available to Visa and its issuers under the settlement program. Additionally, Visa will credit the full amount of intrusion-related fines it previously imposed and collected from Heartland’s sponsoring bank acquirers towards the $60 million maximum funding of the program. The settlement amount represents a significant recovery to Visa issuers for losses they may have suffered from the Heartland data security breach.

All U.S. card issuers who participate in the program will be eligible to receive a portion of the specified recovery. The settlement also includes recovery for international issuers of accounts Visa considered to have been placed at risk of compromise.

Participation in the settlement program supplants any other recoveries that may be available to issuers through Visa and requires accepting issuers to release Heartland, its sponsoring bank acquirers and Visa from any legal and financial liability related to the Heartland intrusion.

Visa will be notifying eligible issuers in the coming days with details about the program and how to participate, and Visa will send eligible issuers their formal offers to participate in the program on January 14, 2010. To facilitate payment, eligible issuers will have until 5:00 pm PT on January 29, 2010 to opt-in to the program before the offer expires.