More than half of surveyed companies report a security or data breach involving payment data, digital security firm Gemalto says

More than half (54%) of surveyed companies said their organization had a security or data breach involving payment data, four times in the past two years on average, digital security firm Gemalto said last week.

The survey was conducted by the Ponemon Institute on behalf of Gemalto. It involved a survey of 3,773 IT security practitioners from more than a dozen major industry sectors in the United States, United Kingdom, Germany, France, Belgium, Netherlands, Japan, India, Russian Federation, Middle East and South Africa. Industries represented include communications, entertainment & media, financial services, government, healthcare, hospitality, IT Services, retail, technology, transportation and utilities.

According to the independent study, 55% said they did not know where all their payment data is stored or located. As well, ownership for payment data security is not centralized, with 28% of respondents saying responsibility is with the chief information officer, 26% saying it is with the business unit, 19% with the compliance department, 15% with the chief information security officer and 14% with other departments.

The survey also found that 54% said that payment data security is not a top five security priority for their company, with only one third (31%) feeling their company allocates enough resources to protecting payment data. Fifty-nine percent said their company permits third party access to payment data and of these, only 34% utilize multi-factor authentication to secure access. Less than half of respondents (44%) said their companies use end-to-end encryption to protect payment data from the point of sale to when it is stored and/or sent to the financial institution.

“These independent research findings should be a wakeup call for business leaders,” said Jean-Francois Schreiber, senior vice president for identity, data and software services at Gemalto. “Given what was found with traditional payment methods and data security, companies involved with payment data must realize compliance is not enough and fully rethink their security practices. The financial fallouts from data breaches, and the damages to corporate reputation and customer relationships will carry even greater potential risk as newer payment methods gain adoption,” added Schreiber.

According to the study, acceptance of new payment methods such as mobile, contactless and e-wallets will double over the next two years. While respondents say mobile payments account for just 9% of all payments today, in two years they expect this ratio to increase to 18% of all payments.

The study suggested that companies are likely to face even more difficulties in securing new payment methods. In fact, the study found that nearly three quarters (72%) of those surveyed believe these new payment methods are putting payment data at risk and 54% do not believe or are unsure their organization’s existing security protocols are capable of supporting these platforms.

“Looking forward, as companies move to accept newer payment methods, their own confidence in their ability to protect that data is not strong,” Schreiber said. “The majority of respondents felt protection of payment data wasn’t a top priority at their companies, and that the resources, technologies and personnel in place are insufficient. Despite the trend to implement newer payment methods, those in the ‘IT security trenches’ don’t feel their organizations are ready. It is clearly critical for companies to look for and invest in solutions to close these data protection gaps, expeditiously,” concluded Schreiber.