Fiserv says it has fixed security weakness in bank websites

“While this may optically look bad for (Fiserv’s) web platform, it doesn’t appear any money was lost.” David J. Koning Wall Street analyst

Brookfield-based financial technology provider Fiserv Inc. just fixed a weakness in its online banking platform, a widely cited security news blog reported Tuesday.

Brian Krebs, of KrebsOnSecurity.com, wrote that the flaw in a Fiserv web platform some banks and credit unions use to operate online accounts exposed some personal and financial details of customers.

Krebs said Fiserv told him it worked around the clock and developed a security patch for the problem within 24 hours of being notified of it.

Asked about the issue Tuesday, Fiserv spokeswoman Britt Zarling said, “Fiserv recognizes the importance of security, and takes all security concerns seriously.”

“To provide context on the recent blog post, which related to a oneway messaging feature in a limited number of bank websites, our ongoing research and continued monitoring have not identified and we have not received reports of any adverse consumer impact,” Zarling said. “We promptly developed a patch to update the feature, deployed the patch to clients using the feature and completed testing to confirm the issue has been fully resolved.”

In his blog, Krebs said he was told about two weeks ago by a security researcher that he was able to view and edit alerts previously set up by another bank customer by changing by one digit of an “event number,” and could see that customer’s email address, phone number and full bank account number. Krebs checked out the report, and was able to obtain the same type of information, but with only a partial account number.

Wall Street analyst David J. Koning, of Milwaukee’s Robert W. Baird & Co., put out a research note about the incident Tuesday with the title, “Security Weakness Fixed.”

“While this may optically look bad for (Fiserv’s) web platform, it doesn’t appear any money was lost and most security issues that we have seen in recent years have been fixed quickly with limited financial impact to companies,” Koning stated.

Fiserv, which recently bought rights to name the new Milwaukee Bucks arena Fiserv Forum, is one of the world’s leading providers of financial technology to banks, credit unions and other businesses.

Shares of Fiserv stock closed down $1.27 Tuesday at $78.44.