Some of the biggest credit card data breaches in history exposed tens of millions of payment cards, disrupted major businesses, and revealed serious weaknesses in payment security. The attacks involving Heartland Payment Systems, TJX, Target, and Home Depot demonstrated that stolen credentials, malicious software, vulnerable networks, and inadequate oversight can have consequences far beyond one checkout counter.
However, the number of affected records tells only part of the story. To understand these incidents, we need to examine what happened, which information attackers accessed, and what businesses can learn from the failures.
I’ve worked in merchant services since co-founding Valued Merchant Services in 2006. During that time, payment technology has changed dramatically. EMV terminals, encryption, tokenization, and improved security standards have helped address important risks. Still, no single technology protects every payment environment from every threat.
What the Biggest Credit Card Data Breaches Teach Us
This guide examines ten historically significant payment-card incidents, distinguishes documented exposure from estimated impact, and explains practical security lessons for merchants.
It also addresses an important misconception: a breach affecting millions of customer records does not necessarily mean millions of credit card numbers were stolen.
Quick Answer: What Were the Biggest Credit Card Data Breaches?
Historically significant payment-card incidents include the Heartland-related hacking conspiracy, Home Depot, TJX, Target, Wawa, Marriott’s Starwood reservation system, Hannaford, Michaels, Staples, and Wyndham. Reported exposure ranges from hundreds of thousands to tens of millions of payment-card records. Because companies used different reporting methods, these figures are not directly comparable and should not be treated as a definitive worldwide ranking.
In This Guide
What Counts as a Credit Card Data Breach?
A credit card data breach generally involves unauthorized access to or exposure of information associated with payment-card accounts.
Despite the common name, many incidents affect both credit and debit cards. Consequently, the more precise term is often payment-card data breach.
Depending on the incident, exposed information may include:
- Credit or debit card account numbers
- Card expiration dates
- Cardholder names
- Payment transaction details
- Other sensitive authentication information
Not every cybersecurity incident involves payment-card information. A company may expose email addresses, passwords, medical records, or other personal information without evidence that card numbers were compromised.
Why Breach Numbers Are Not Always Comparable
Historical breach reports use different measurements. Some count individual customers. Others count cards, transactions, accounts, or database records.
For example, Target reported approximately 40 million affected payment-card accounts during its 2013 breach. Separately, it disclosed possible exposure of additional personal information involving up to 70 million individuals.
Because those groups could overlap, adding the two figures would create a misleading total.
Likewise, a company may report potentially exposed cards even when investigators cannot establish that attackers successfully used them for fraudulent purchases.
Our methodology: The ten cases below represent significant documented payment-card incidents, selected for their historical impact and lessons. They are not presented as a mathematically precise ranking of the largest breaches worldwide.
10 Major Credit Card Data Breaches Compared
The following table summarizes the reported payment-card impact of each incident. Importantly, figures describe different kinds of exposure and should not be added together or compared without the accompanying qualifications.
| Organization | Incident period | Reported impact |
|---|---|---|
| Heartland and related attacks | 2007–2008 | More than 130 million card records alleged across a broader hacking conspiracy |
| Home Depot | 2014 | Approximately 56 million unique payment cards at risk |
| TJX | 2005–2007 | Approximately 45.7 million payment-card records initially reported |
| Target | 2013 | Approximately 40 million credit and debit card accounts |
| Wawa | 2019 | Approximately 30 million card numbers reportedly stolen, according to litigation |
| Marriott / Starwood | Disclosed 2018 | Approximately 8.6 million payment-card records subject to cryptographic protection; protection details clarified in 2024 |
| Hannaford | 2007–2008 | Approximately 4.2 million card numbers exposed |
| Michaels and Aaron Brothers | 2013–2014 | Approximately 3 million payment cards potentially affected across both businesses |
| Staples | 2014 | Approximately 1.16 million payment cards potentially affected |
| Wyndham | 2008–2010 | Payment information for hundreds of thousands of consumers affected across three incidents |
Source notes appear within each case study. Figures may represent alleged theft, estimated exposure, or potentially affected accounts rather than confirmed fraudulent transactions.
1. Heartland Payment Systems: A Major Payment Processing Attack
Incident: 2007–2008, publicly disclosed in 2009.
Reported scale: More than 130 million credit and debit card records alleged across a broader criminal hacking operation.
The Heartland Payment Systems incident remains one of the most significant cases in the history of credit card data breaches.
Federal prosecutors charged Albert Gonzalez and other participants in a hacking conspiracy that targeted major payment-processing and retail networks.
According to the Department of Justice, attackers exploited computer vulnerabilities and used malicious software to obtain sensitive card information.
Heartland was among the affected organizations. However, the widely repeated figure exceeding 130 million records belongs to the broader alleged conspiracy. It should not be described as a separately verified Heartland-only count.
Why the Heartland Breach Matters
A processor handles transactions for multiple merchants. Therefore, a compromise involving payment-processing infrastructure can extend far beyond a single retailer.
The case demonstrated why protecting card information in transit and securing transaction-processing systems are essential.
Merchant lesson: Understand your processor’s responsibilities, available payment security controls, and procedures for responding to suspicious activity.
Source: U.S. Department of Justice: Major Retail and Banking Network Attacks.
2. Home Depot: 56 Million Payment Cards at Risk
Incident: April–September 2014.
Reported scale: Approximately 56 million unique payment cards.
Home Depot’s 2014 incident illustrates how a compromised third-party account can become the starting point for a much larger attack.
According to the company’s investigation, criminals entered its network using a vendor’s stolen username and password.
However, those credentials did not provide direct access to payment terminals. The attackers subsequently obtained elevated privileges and deployed custom malware on certain self-checkout systems.
Home Depot estimated that the attack placed approximately 56 million unique payment cards at risk.
The company separately reported theft of files containing approximately 53 million email addresses. Those records did not constitute another 53 million compromised payment cards.
Why This Retail Payment Data Breach Matters
Vendors sometimes need remote access for maintenance and support. That access can create additional risk unless businesses control permissions carefully.
Furthermore, the Home Depot investigation demonstrated that stolen credentials can become more dangerous when an attacker gains wider privileges inside a network.
Merchant lesson: Restrict third-party access, use appropriate authentication, review administrator privileges, and verify unexpected support requests through trusted channels.
Sources: Home Depot: September 2014 Disclosure and Home Depot: November Investigation Findings.
3. TJX: An Early Warning About Retail Network Security
Incident: Primarily 2005–2007.
Reported scale: Approximately 45.7 million payment-card records initially reported.
TJX, the parent company of retailers including T.J. Maxx and Marshalls, disclosed a major breach in 2007.
Investigators connected the broader criminal operation with weaknesses in wireless networks and unauthorized collection of payment information.
The incident became an important historical example because attackers did not necessarily need to compromise individual card readers directly.
Instead, weaknesses elsewhere in a connected retail environment could create access to sensitive payment information.
What the TJX Breach Revealed
Businesses often operate several networks for payment processing, administration, employee devices, and customer internet access.
Because these environments may connect to one another, poor separation can increase exposure if an attacker compromises one part of the network.
Merchant lesson: Protect business Wi-Fi, review network separation, restrict unnecessary connectivity, and keep payment systems appropriately isolated from guest networks.
Source: U.S. Department of Justice: Retail Network Hacking Case.
4. Target: 40 Million Credit and Debit Card Accounts
Incident: November–December 2013.
Reported scale: Approximately 40 million payment-card accounts.
Target’s 2013 incident remains one of the best-known credit card data breaches in the retail industry.
The company disclosed that attackers had obtained payment-card information associated with transactions in its U.S. stores.
Investigators found malicious software on point-of-sale systems. The software captured information associated with affected payment transactions.
Target also disclosed possible exposure of names, addresses, telephone numbers, or email addresses involving up to 70 million individuals.
However, that additional figure should not be added to the approximately 40 million payment-card accounts because the affected populations may overlap.
What Made Target’s Breach Significant?
The malware affected a large checkout environment during a busy shopping period.
Consequently, the case demonstrated how attackers could expose substantial transaction information within a relatively short time.
Merchant lesson: Maintain payment-system monitoring, investigate suspicious changes, and establish a clear procedure for escalating possible security incidents.
Source: Target: December 2013 Payment Security Disclosure.
5. Wawa: Payment Data Exposure at Stores and Fuel Pumps
Incident: March–December 2019.
Reported scale: Approximately 30 million credit and debit card numbers reportedly stolen, according to litigation associated with the incident.
Wawa disclosed an incident involving payment-card information from transactions at convenience stores and fuel pumps.
The affected information included card numbers, expiration dates, and certain other cardholder details.
Subsequent litigation addressed the incident and related security improvements.
Why the Wawa Breach Matters to Merchants
Payment acceptance does not happen exclusively at staffed checkout counters.
Businesses may also accept cards through fuel dispensers, unattended kiosks, mobile devices, and other payment environments.
For that reason, every payment device and connected system should be included in an appropriate security inventory.
Merchant lesson: Include outdoor and unattended devices in routine inspections, maintenance procedures, and incident-response planning.
Source: Wawa Data Security Litigation Overview.
6. Marriott / Starwood: Payment Records and a Later Security Clarification
Incident: Disclosed in November 2018.
Reported payment-card impact: Approximately 8.6 million payment-card records, according to Marriott’s January 2019 update.
Marriott’s Starwood guest reservation database incident involved substantial quantities of customer information, including travel-related records and payment data.
However, the number of affected guest records was not equivalent to the number of payment cards involved.
In January 2019, Marriott reported approximately 8.6 million payment-card records and stated that roughly 354,000 of those cards were unexpired as of September 2018.
The Important 2024 Clarification
Marriott initially described certain affected payment-card data as protected with AES-128 encryption.
On April 17, 2024, the company updated its disclosure after additional analysis. Marriott stated that the payment-card numbers in the affected database tables instead used a different cryptographic method, SHA-1.
That distinction matters. SHA-1 is a cryptographic hash function, not the same type of encryption as AES-128.
Therefore, the original disclosure should not be repeated without acknowledging Marriott’s correction.
What Merchants Can Learn
Payment information may exist in reservation systems, ecommerce platforms, recurring billing applications, and other databases beyond a physical terminal.
As a result, businesses need to understand where sensitive data resides and which protections apply.
Merchant lesson: Minimize unnecessary card-data storage and verify how providers protect retained information. Do not assume all stored records have the same security controls.
Source: Marriott: January 2019 Incident Update and April 2024 Clarification.
7. Hannaford: Payment Data Compromised During Authorization
Incident: December 2007–March 2008.
Reported scale: Approximately 4.2 million credit and debit card numbers.
Hannaford disclosed a payment-card incident affecting transactions at its supermarkets and associated operations.
Attackers obtained access to payment information during transaction authorization activity.
This case demonstrated that card information can face exposure while moving through payment systems, not only when stored in a database.
Why This Payment-Card Breach Was Significant
Payment security involves multiple stages: collection, transmission, processing, and any permitted storage.
Consequently, protecting stored information alone is not enough.
Merchant lesson: Ask your payment provider how transaction data is protected during transmission and processing, and use appropriately configured, approved payment technologies.
Source: Hannaford Breach Reporting.
8. Michaels and Aaron Brothers: Checkout Malware
Incident: 2013–2014.
Reported scale: Approximately 2.6 million potentially affected payment cards at Michaels and approximately 400,000 at Aaron Brothers.
Michaels and its subsidiary Aaron Brothers experienced attacks involving malicious software installed on certain point-of-sale systems.
The investigations identified possible exposure of payment-card numbers and expiration dates.
Not every register had to be compromised for the attack to affect a substantial number of transactions.
What This Retail Breach Demonstrated
A business may operate multiple checkout lanes, terminals, or locations.
Even a limited number of compromised systems can produce extensive exposure when they handle substantial transaction volume over time.
Merchant lesson: Keep an accurate inventory of payment equipment, monitor changes, and apply necessary maintenance procedures across every device, not only the primary checkout.
Source: Michaels SEC Filing: Payment Security Incident.
9. Staples: Approximately 1.16 Million Payment Cards
Incident: 2014.
Reported scale: Approximately 1.16 million payment cards potentially affected.
Staples reported that criminals deployed malware on point-of-sale systems at 115 of its more than 1,400 U.S. stores.
According to the company’s SEC disclosures, potentially affected information included cardholder names, card numbers, expiration dates, and card verification codes.
Why the Staples Breach Matters
Payment-card information has different levels of sensitivity, and certain authentication details require especially careful treatment.
For example, PCI DSS prohibits retaining sensitive authentication data such as card verification codes after authorization.
Merchant lesson: Avoid collecting or storing unnecessary payment details. Use approved payment applications and prohibit employees from saving card information in unapproved spreadsheets, notes, photographs, or messaging systems.
Source: Staples SEC Filing: Point-of-Sale Security Incident.
10. Wyndham: Multiple Breaches and Network Security Failures
Incident: 2008–2010.
Reported impact: Payment-card information belonging to hundreds of thousands of consumers affected across three incidents.
Wyndham became the subject of a Federal Trade Commission case involving payment-card information security practices.
The FTC alleged that inadequate security controls exposed customer information to unauthorized access.
The case addressed weaknesses involving network security, access management, and interconnected hotel systems.
In December 2015, Wyndham agreed to settle the FTC’s charges. The settlement required an information security program, independent assessments, and additional measures.
What This Case Revealed
Multiple business locations and third-party relationships can create complicated security responsibilities.
Furthermore, organizations may face regulatory and contractual consequences following an incident.
Merchant lesson: Review vendor access, network controls, security responsibilities, and procedures for monitoring connected business systems.
Source: Federal Trade Commission: Wyndham Settlement.
Why Other Famous Data Breaches Are Not Included
Some of the largest data breaches in history affected millions of people but did not necessarily involve a comparable number of compromised payment cards.
Examples include incidents involving Anthem, Epsilon, Evernote, and other organizations.
These cases may involve email addresses, passwords, medical records, or other personal information.
They remain important cybersecurity events. However, combining those records with payment-card counts would create a misleading comparison.
This article therefore focuses on documented payment-related incidents and the security lessons they provide.
7 Lessons From Major Credit Card Data Breaches
These credit card data breaches happened in different industries and under different circumstances. Nevertheless, several lessons apply across payment environments.
1. Protect the Entire Payment Environment
Security extends beyond the credit card terminal.
Businesses must consider connected networks, software, administrative accounts, and payment-processing systems.
For example, an attacker who compromises an unrelated business computer may attempt to reach other systems if network protections are inadequate.
Review which devices and users can access the payment environment.
2. Restrict Third-Party Access
Vendors may need access to provide support, maintenance, or software updates.
However, that access should be appropriately authorized, restricted, and monitored.
Businesses should also remove unnecessary accounts and verify unexpected support requests independently.
3. Use Supported Payment Technology
EMV chip technology, encryption, tokenization, and approved payment applications can reduce certain risks.
Still, these technologies provide different protections and do not eliminate every possible vulnerability.
For information about equipment options, review our credit card terminal solutions.
4. Understand PCI DSS Requirements
The Payment Card Industry Data Security Standard, commonly known as PCI DSS, establishes security requirements for environments that store, process, or transmit payment account data.
Merchants of all sizes have relevant responsibilities, although validation requirements depend on their processing arrangements and applicable card-brand or acquiring-institution programs.
Using a third-party payment provider does not automatically eliminate every merchant obligation.
For authoritative guidance, see the PCI Security Standards Council’s merchant resources.
5. Store Less Sensitive Payment Information
Businesses should avoid retaining card information unnecessarily.
Instead, use approved card-on-file or tokenization solutions when appropriate.
Furthermore, do not retain sensitive authentication data, including card verification codes, after authorization in violation of PCI DSS requirements.
Reducing unnecessary storage can help limit the information exposed during an incident.
6. Monitor Warning Signs
Unexpected software changes, unfamiliar logins, unusual account activity, and altered payment equipment may require investigation.
Employees should understand how to report suspicious activity.
Businesses should also know which providers or technical contacts can assist when a potential payment security issue arises.
7. Establish an Incident-Response Plan
Waiting until a breach occurs can create unnecessary confusion.
A practical response plan should identify contacts, responsibilities, escalation procedures, and steps for preserving evidence.
It should also address how the business may continue operating safely if a payment system becomes unavailable.
For more preventative measures, read our small business payment security guide.
What Should a Business Do After Suspecting a Payment Data Breach?
A suspected payment-card breach requires prompt and appropriate action.
The exact requirements depend on the incident, merchant agreement, card-network rules, applicable laws, and instructions from the acquiring institution.
Immediate Actions
- Identify the concern. Record suspicious activity, relevant dates, affected systems, and how the issue was discovered.
- Contact authorized providers. Notify your processor, acquiring institution, or designated security contact through verified channels.
- Contain the issue. Coordinate appropriate containment measures with qualified technical personnel. Stop using potentially compromised systems when necessary.
- Preserve evidence. Avoid unnecessary log deletion, system resets, or equipment changes before receiving appropriate guidance.
Investigation and Recovery
- Determine investigation requirements. Depending on the circumstances, an approved forensic investigation may be necessary.
- Review notification obligations. Obtain appropriate guidance on applicable contractual, payment-network, and legal reporting requirements.
- Restore operations safely. Address identified weaknesses and follow authorized recovery procedures before returning affected systems to service.
The PCI Security Standards Council also provides guidance on responding to cardholder data breaches.
Importantly, the absence of reported fraudulent transactions does not prove that an incident is insignificant.
Are Small Businesses Vulnerable to Credit Card Data Breaches?
Yes. Although national retailers typically operate much larger payment environments, small businesses also face security risks.
A business may rely on a single administrator account, one connected POS system, a hosted ecommerce checkout, or a small number of employees.
Those arrangements may be easier to oversee than a national retail network, but they can also create important dependencies.
For example, a compromised administrative account may disrupt payment acceptance even when the business processes relatively few transactions.
Therefore, the goal isn’t to buy every available cybersecurity product. It’s to understand the environment, apply appropriate protections, and work with qualified providers.
Can Modern Payment Technology Prevent Credit Card Data Breaches?
Modern technology can reduce specific vulnerabilities, but it cannot guarantee that a business will never experience a breach.
Depending on the environment, useful controls may include:
- EMV chip and contactless payment technology
- Appropriate payment-data encryption
- Tokenization
- Validated point-to-point encryption solutions
- Secure hosted ecommerce checkout systems
- Restricted administrator privileges
- Multifactor authentication
- Monitoring and incident-response procedures
Each measure serves a different purpose.
For instance, tokenization may reduce the need for certain systems to retain actual card numbers. Meanwhile, multifactor authentication can help protect access to administrative accounts.
Neither safeguard prevents every form of malware, unauthorized transaction, or network compromise.
Therefore, merchants should evaluate payment equipment, software, gateways, and security responsibilities together.
Our guide to choosing the right credit card processor explains additional factors involving security, compatibility, pricing, and support.
Frequently Asked Questions About Credit Card Data Breaches
What was the biggest credit card data breach in history?
One of the largest documented payment-card hacking conspiracies involved Heartland Payment Systems and other organizations. U.S. federal prosecutors alleged theft of information involving more than 130 million credit and debit cards. That figure concerns the broader alleged operation, not a separately verified count for Heartland alone.
How many credit cards were affected by the Target breach?
Target reported approximately 40 million affected credit and debit card accounts in 2013. It separately disclosed possible exposure of other customer information involving up to 70 million people. Those figures should not automatically be added together.
How many cards were affected by the Home Depot breach?
Home Depot estimated that its 2014 attack placed approximately 56 million unique payment cards at risk. The attackers initially entered its network using stolen third-party vendor credentials and subsequently deployed malware.
Does a payment-card breach always cause fraud?
No. An incident may involve potentially exposed cards without evidence that every card was used fraudulently. Exposure, confirmed theft, and fraudulent transactions are different measurements.
Are credit card data breaches the same as identity theft?
No. A credit card data breach involves unauthorized exposure of payment-related information. Identity theft involves using someone’s personal information to impersonate them or commit fraud. The two may be connected, but they are not equivalent.
Do EMV chip cards prevent payment data breaches?
EMV chip technology reduces certain counterfeit-card risks. However, it does not eliminate malware, account takeover, ecommerce attacks, or other cybersecurity vulnerabilities.
Can a PCI-compliant business still experience a breach?
Yes. PCI DSS compliance is an important security responsibility, but no control or compliance program guarantees complete protection against every threat.
Do small businesses need to follow PCI DSS?
PCI DSS applies to payment-card environments regardless of merchant size. Specific validation requirements vary based on the merchant’s circumstances and applicable acquiring-institution or payment-brand programs.
What should a business do after discovering suspicious payment activity?
Follow the incident-response plan, contact authorized payment providers through verified channels, preserve evidence, and obtain qualified technical guidance. Depending on the incident, additional investigation or reporting may be required.
How can merchants improve cardholder data security?
Useful improvements may include supported payment technology, limited system access, appropriate authentication, software maintenance, reduced sensitive-data storage, employee training, and established response procedures.
Final Thoughts: Learning From Major Credit Card Data Breaches
The biggest credit card data breaches in history demonstrate that payment security involves much more than protecting a physical card reader.
Retailers, payment processors, hotels, supermarkets, and other businesses have experienced incidents involving stolen credentials, malicious software, vulnerable networks, and inadequate controls.
Although the attacks differed, several lessons remain consistent.
Understand your payment environment. Protect sensitive information. Control access. Maintain equipment and software. Monitor suspicious activity. Prepare to respond.
Since co-founding Valued Merchant Services in 2006, I’ve believed that businesses deserve more than competitive processing rates. They also deserve reliable payment technology, honest explanations, and support they can depend on.
Not every business needs new equipment, and switching providers is not always the right decision.
However, every merchant should understand the security responsibilities associated with accepting customer payments.
The goal is to create a payment environment that supports customers, reduces avoidable risks, and helps the business operate confidently.
Questions About Your Payment Processing Security?
Valued Merchant Services helps businesses evaluate payment equipment, processing technology, ecommerce solutions, and available security features. Whether you’re opening a business or reviewing an existing setup, we’ll help explain your options and identify what makes sense for your operation.
Talk With Valued Merchant Services
Call 800-531-8575 or email support@valuedmerchants.com. Existing merchants can also request a free processing rate review. Available services, equipment compatibility, security features, and account approval depend on the selected provider. A payment consultation is not a formal cybersecurity assessment or PCI DSS certification.
Updated November 2026. This article consolidates the original two-part VMS series published in 2015. Historical figures reflect identified company disclosures, government records, filings, and litigation-related reporting. Some figures represent estimates or potentially affected accounts rather than confirmed fraudulent transactions. This article is for general educational purposes and does not constitute individualized cybersecurity or legal advice.
