Tom Wills, a senior analyst at Javelin Strategy & Research, recently compared Carr's response to the crisis with that adopted by Israeli airline El Al in the wake of a series of hijackings in the 1970s. "El Al redesigned its security from the ground up and went on to build a reputation, one that it holds to this day, as the world's most secure airline," Wills wrote in an alert released earlier this month.

He said that based on Carr's moves so far, "it's clear that Heartland intends to take the El Al route."

Princeton, N.J.-based Heartland is one of the largest payment-processing companies in the country, with about 250,000 customers. It announced on Jan. 20 that intruders had broken into its systems several months earlier and potentially compromised data on an undisclosed number of individuals.

The breach is thought to be the biggest ever involving payment card data with some analysts saying that over 100 million cards may well have been exposed in the intrusion. Heartland's breach disclosure came just weeks after another major payment processor, RBS WorldPay announced a data breach involving 1.5 million payment cards.

According to Carr, Heartland's responses to the incident have been driven simply by the need to protect itself from future compromises and the need for broader collaboration in dealing with increasingly sophisticated attackers. "The attacks on Heartland and RBS WorldPay were incredibly sophisticated," he said.

In Heartland's case, the attacks happened even though the company had had been certified six times previously as being fully compliant with the requirements of the Payment Card Industry (PCI) Data Security Standard mandated by the major credit card companies.

What the incident highlighted was both the technical acumen of the attackers and the dangers in assuming that compliance alone is enough to keep a company safe, Carr said. "Just because you have a certificate of compliance doesn't mean that you can't get breached. If a processor thinks they are bullet proof on these kinds of problems they shouldn't feel that way," Carr said.

"I think everyone would agree the PCI standard is necessary, but it is also the lowest common denominator and the bad guys have figured out how to get around some of the weaknesses," he said.

In the future, credit card companies need to consider using technologies such as Chip and PIN, tokenization and end-to-end encryption to build on the baseline security offered by PCI, Carr said. In Heartland's case the company's has decided to go with the encryption option because it currently offers the quickest and safest way to secure card data in a manner that goes beyond that prescribed by PCI he said.