CREDIT CARD SECURITY COMPROMISED FOR MTS RIDERS

East County News Service

March 1, 2016 (San Diego) - If you’ve used your credit or debit card to purchase monthly trolley or bus passes through the Metropolitan Transit System’s Compass Card fare collection system, your security may be compromised.

A KPBS investigation resulted in an admission by MTS that its system is not in compliance with industry best practices for preventing fraud, such as having data encrypted, maintaining firewalls and testing security systems regularly. All credit card merchants are supposed to comply with such requirements.  

A public records request turned up a contract between MTS and AppliedTrust, a data security firm in Colorado, to identify security gaps and make recommendations to fix those gaps.  MTS has indicated full compliance will take a couple of years and cost $7 million or more – leaving riders potentially vulnerable to security breaches in the short run, though some improvements should be in place by mid-summer.

San Diego City Councilmembers Todd Gloria and David Alvarez, both board members of MTS, have told KPBS that the security concerns were never brought before board members.  Alvarez indicated he will seek information from MTS staff.

Failure to comply with security standards can be costly, as Target discovered when its security breach led the retail giant to pay out over $100 million in settlements with customers and banks, and hundreds of millions more to fix the problems. T-Mobile, E-Bay, Home Depot and other large companies have also suffered credit security breaches in recent years.

Besides credit card or debit card holders seeking reparations should they suffer damages, MTS could potentially also face fines from lenders that process its transactions for its failure to secure users’ confidential data.

Since MTS operates as a public entity, taxpayers and transit riders could ultimately be stuck with the bills for any damage resulting from negligence on the part of MTS.