The vast majority of UK businesses hold consumer credit card data unwittingly, risking PCI DSS breaches and ICO fines. That’s according to research carried out by identity protection specialists Ground Labs.

A random survey of security experts who use Ground Labs software across more than 100 consumer-facing businesses found that every one of them had credit card details unwittingly stored on IT equipment. On average more than 1,000 credit card records were found by the company’s software within each business sampled.

Even businesses that claim to be compliant with agreed global standards for credit card data security hold rogue details, the survey found. There are various possible reasons for this, all linked to standard computer processes such as browser caches or email duplications. Amongst the worst examples uncovered was a company that firmly believed it had no records. It was found that the business actually held more than 20 million credit card numbers on servers throughout its network.

“We have more than 1,000 businesses across the UK and Europe that have used our software and every single business found erroneous card records in its IT systems,” says European director at Ground Labs, Mohamed Zouine. “What we have found is that even those businesses that believe that their systems are clean are carrying records that could be easily acquired by hackers.”

The company is advocating the use of a software programme called Card Recon as part of the standard systems maintenance routine to detect and remove credit card details. Zouine adds: “We believe a routine check should be as frequent as anti-virus checks. There are many ways in which card details can remain on business’s IT infrastructure unwittingly. Transaction logs sent back from banks, browser caches, email duplications and more can hold sensitive data that has a black market value in the wrong hands and can be used to defraud consumers. The issue for small businesses is that they are far less protected than large corporations. It is relatively easy for an entrepreneurial thief to steal IT equipment or hack in to a business and retrieve valuable credit card data.”

Share Story: