SecurityMetrics published its second annual Payment Card Threat Report revealing unencrypted PAN (Primary Account Number) storage remains alarmingly high.

Virtually no change occurred between 2011 and 2012, with card data storage on corporate systems declining less than one quarter of a percent (.24%).


The study exposed that greater than 10% of merchants store magnetic stripe track data, essential for the illegal reproduction of credit and debit cards. Financial, hospitality, and retail industries accounted for 55% of the total unencrypted payment card data storage among businesses tested.

"Hackers proactively search for unencrypted card data because it takes less effort to steal," said Director of Security Assessment, Gary Glover. "Whether a business stores unencrypted card data because of an improperly configured payment application, or because employees handle data improperly, storing card data without encryption is against industry regulation."


Businesses that store unencrypted payment card data directly violate Payment Card Industry Data Security Standard (PCI DSS) requirements and are more likely to be exploited and suffer severe financial repercussions.

Credit card fraud costs U.S. establishments $52.6 billion per year, and unencrypted card data storage financially plagues both businesses and consumers when discovered by criminals.

The complete report is available as a PDF.