A breach affecting Visa and MasterCard has been laid at the feet of payment processor Global Payments.
In a statement, Global Payments announced that it identified and reported unauthorised access to a portion of its processing system.
“In early March, the company determined card data may have been accessed. It immediately engaged external experts in information technology forensics and contacted federal law enforcement," Chairman and CEO Paul R. Garcia said.
“The company promptly notified appropriate industry parties to allow them to minimise potential cardholder impact. The company is continuing its investigation into this matter.
He said it was "crucial to understand" the incident did not involve merchants.
Avivah Litan, vice-president and distinguished analyst at Gartner, told SC Magazine US that her sources within the payment industry have told her the breach was sustained by a New York City-based taxi cab and garage parking company, and was the work of a Central American gang.
A city Taxi and Limousine Commission spokesman, Allan Fromberg, told SC Magazine US that he wasn't aware of any breach, but said there were 65 so-called "medallion agents" who lease taxi cabs to drivers. They serve as merchants and contract with third parties to process cab fares that are paid with credit cards.
Visa, in its statement, said it was contacting "payment card issuers" with information about card numbers that may have been compromised.
Visa also pulled its seal of approval for the taxi cab company, saying that the breach has affected at least 1.5 million accounts and that the incident is "contained".