That means that, more than two years after the breach was closed and the first arrests were made in the Heartland case, the thieves are still working their way through the trove of stolen card numbers. Holding onto the numbers that long is a gamble for the thieves, of course, because many of the cards could expire or be canceled over that much time. Then again, after two years without any fraudulent activity, banks and retailers will almost always assume that a card number hasn't been stolen. That assumption may not be safe again for a long time.
Old breaches never die, they just—well, they never die. A small bank in Illinois on April 1 announced that some customers' payment card information had been compromised at card processor Heartland Payment Systems. Yes, that Heartland. And yes, that breach—the one in 2008. "MasterCard and Visa, along with the FBI and Secret Service, have been investigating the incident for several years, and although the security breach is reported to have occurred between May 2008 and November 2008, the compromised information is only now being used to conduct fraudulent transactions," Freestar Bank President Scott Bauknecht told a local newspaper.