Heartland Payment Systems, which last year suffered a devastating data breach, has been on a mission to secure payment-card processing .
After introducing the E3 terminal for point-of-sale transactions last May, which has gone into use with about 5,000 Heartland merchant customers for encryption of sensitive cardholder data, Heartland Tuesday introduced yet another encryption device, called the E3 magnetic stripe reader wedge, which will be available next month.
According to Heartland, the E3 wedge is a small device designed for PC-based payment applications to protect cardholder data at the point of swipe before the data reaches potentially vulnerable PC-based applications.
The E3 wedge encrypts within a tamper-resistant security module similar to a debit PIN encrypting device using the Advanced Encryption Standard and identity-based encryption and physical protections said to be compliant with the PCI PIN AES 3.0.
The device can plug into a USB port to communicate with a point-of-sale system or can be attached to the side of a monitor or a merchant's countertop. The E3 components could also be embedded into an integrated PC-based POS system.
Like the E3 terminal, the E3 wedge will not be free to merchant customers. According to Heartland CEO Bob Carr, the E3 wedge will cost $100 (the E3 terminal costs $300 to $400). But he notes as part of buying the equipment, merchants receive a warranty that if there's a breach, Heartland will pay for the costs.
About 5,000 Heartland merchant customers are using the E3 terminal today, Carr says, adding the adoption rate is a "little better than expected" for how new the E3 is. However, there is still a ways to go to get broader coverage since up to 100,000 customers could potentially use it.
Carr says Heartland believes that using encryption for payment-card processing in this way should greatly reduce the issues surrounding the scope of the Payment Card Industry audit.
Carr also says that with the industry discussing a move to the EMV standard, it's worth noting that although EMV is great at authenticating a transaction, it would be a good fit to combine EMV with the kind of end-to-end encryption that the E3 equipment is supporting since card data is still sent in the clear using EMV.