Our organisation has validated compliance with PCI DSS.
What are the consequences to us if we had been breached by a security incident related to credit card information, considering we have validated PCI DSS compliance?
Would any fine apply to us?

  • No breached organization is PCI compliant, ever. No matter what you were 5 minutes before the breach. There is no immunity based on your prior status.
    – gowenfawr
    Jul 6, 2015 at 14:19

5 Answers 5


Card companies have contracts in place with processors to force them to both be PCI compliant and to force them to make their merchants compliant. I guarantee you any bank or processor you contract with as a merchant will stipulate PCI compliance. To the degree of verification is on there part.

If a breach occurs, the card companies can go after the banks, and intern the banks could go after you if they feel you've broken your agreement. Card companies also have the right to sue you for lack of security or improper management, or some other legal speak.

This as also mentioned this doesn't cover the cost of investigations, etc.

I believe the last average was $225/ record. The Verizon Data Breach Investigation Report usually has some good figures.


Other answerers have made lots of good points about the consequences of a data breach. Let me just make a couple about why it's modestly better to be in PCI compliance and have a breach than being out of compliance and having one.

  1. If you're out of compliance and you're sued, you'll be a bad position. If you're out of compliance and the way you were out of compliance can be tied as a cause to the breach, you are in bad, bad, bad trouble. Either way, you have fallen short of what the merchant community has deemed the customary minimum standard of protection for card data. On the other hand, if you do have a PCI audit that says you were compatible before the breach and that audit appears to have been conducted independently and thoroughly conducted ... well, you're still in a vulnerable place, litigation-wise, but at least you can argue that you did what you reasonably could.

  2. I guarantee you that the payment brands will go easier on you in terms of letting take credit and debit cards again if you can show you did a legitimately through compliance audit. (After you can show you've secured your network/s after the breach discovery, of course.) On the other hand, if you were clearly not in compliance before the breach you will face an unpleasant range of possible consequences, going from withdrawl of your ability to take credit & debit cards if you're a small business to more financial consequences and future security compliance scrutiny from the majors (Visa & MasterCard)than you would get if you had been compliant pre-breach if you are a large retailer. (Is it fair that a small business could very well have it's ability to take payments revoked but big boys like Target, Kmart, Home Depot, etc. who were all horribly negligent about security and exposed almost 100 million card numbers between them never faced that possibility? Maybe not, but that's how it is.)


Regarding the lost of customers issue, despite the the previous answers and what it make sense to think i have a different stand on this one. Unless a consumer suffers identity theft or a loss of money, a breach does not create an incentive for customers to leave a retailer permanently.

I back it with with a survey conducted at January 26, 2016 read further at the folowing link https://macmember.org/library/public/Consumer%20Attitudes%20Toward%20Breaches_FINAL.pdf

  • Could you please summarize the results of the survey in your post? Stack Exchange strives to eschew dependence on external resources which may vanish into thin air at any time. Feb 29, 2016 at 7:14
  • as i wrote in my answer : "Unless a consumer suffers identity theft or a loss of money, a breach does not create an incentive for customers to leave a retailer permanently."
    – BokerTov
    Feb 29, 2016 at 7:58

There are no real consequences from the PCI DSS side itself, except possibly losing certification. But you should prepare for:

  • lawsuits

  • cancelled accounts and lost customers

  • insurance claims (not related strictly to PCI DSS, but for real compensation paid to victims of leak)

  • payment card issuer fines

  • government fines, possibly including also losing license required to work in some country

  • would it be worse if we weren't certified? Talking about fines specifically.
    – Ree
    Jul 6, 2015 at 13:44
  • No, because if you weren't certified, you wouldn't also be permitted access to data, which is subject to leak. Jul 6, 2015 at 13:57

Everything Tomasz listed, plus a few more:

  • Significant costs to your organization (other than fines) such as the costs of audits or forensic investigations, costs associated with notifying affected clients/customers of the breach, etc.
  • Any or all of the payment card brands could bar your organization from accepting their cards.
  • Long lasting damage to your organization's reputation.

All of these outcomes could happen whether or not an organization has validated compliance in the past. As gowenfawr alluded to, the position of the PCI Council is that you cannot have been in compliance if you were breached.

That said, I'm sure the situation would be even worse for an organization that has never validated compliance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .