Data breach is any incident in which protected information, such as card numbers, credentials or identity documents, is accessed, copied or disclosed by someone with no right to it; in payments the most damaging version is a compromise of cardholder data, which can be monetised within hours. Under the GDPR the term also covers accidental loss, and the controller must notify the supervisory authority within 72 hours. Common causes include point-of-sale malware, web skimming and misconfigured cloud storage. Costs arrive as scheme fines, reissuance charges and regulatory penalties, and a licensed EMI may face onboarding restrictions. Tokenization, hosted payment pages and PCI DSS v4.0.1 controls reduce exposure, while buyers request the breach register and PFI reports.
What is a data breach under the law
Regulators define the term more widely than "hackers stole a database". Under the GDPR, a personal data breach includes accidental loss or destruction, so an unencrypted laptop left on a train counts. The controller must notify the supervisory authority within 72 hours of becoming aware of it, and must tell affected individuals directly when the risk to them is high. The card schemes run a parallel process: a suspected account data compromise triggers a forensic investigation by a PCI Forensic Investigator, paid for by the merchant or its processor.
How do payment data breaches happen
Most payment breaches follow a few repeat patterns. Point-of-sale malware reads card data from terminal memory before it is encrypted; the 2013 Target breach exposed around 40 million cards this way, with attackers entering through credentials stolen from an HVAC contractor. Web skimming, often called Magecart, injects a few lines of JavaScript into a checkout page and copies every card number typed into it. British Airways lost data on roughly 400,000 customers to such a script in 2018 and was fined £20 million by the UK ICO.
The quieter causes are misconfigured cloud storage left publicly readable, API endpoints that return full primary account numbers to anyone holding a valid session, and staff accounts without multi-factor authentication.
What a breach costs a payment business
Scheme fines and fraud reimbursement claims come first, then card reissuance costs passed back by issuers, then regulatory fines. For a licensed EMI or payment institution the larger risk is supervisory: a regulator can restrict new onboarding or demand a remediation plan, which halts growth for months.
How to prevent payment data breaches
The most effective control is not holding the data at all. Replacing card numbers with tokens through tokenization and using a hosted payment page means a compromised merchant server holds nothing a fraudster can use. At the terminal, point-to-point encryption makes captured card data unreadable outside the decryption environment.
PCI DSS v4.0.1 codifies the rest: script integrity monitoring on payment pages (requirement 6.4.3, mandatory since 31 March 2025), MFA for all access into the cardholder data environment, and regular penetration testing.
What a buyer checks
In due diligence on a payment company, buyers ask for the breach register, any PFI reports, the latest Attestation of Compliance and correspondence with the regulator. An undisclosed incident discovered after signing typically becomes an indemnity claim against the seller.