US card brands have dumped breached processor Global Payments from their approved list of Payment Card Industry (PCI)-compliant service providers.
The Atlanta-based firm continued to process transactions for major card brands as it seeks rejoin those lists, it said in an update.
Global Payments stood by its initial estimate that fewer than 1.5 million cards were impacted by the March breach.
But it declined to provide any further details or a timeline of the attack.
"We identified and self-reported the incident in early March, and we will continue to provide information to the appropriate parties as revealed by the investigation," the company said.
A Visa spokesman on Wednesday told SC Magazine it asked Global Payments to re-validate its compliance to PCI by using a qualified security assessor.
Visa dumped Global Payments from its approved list of payments providers in April.
Retailers that used the company's services would not be liable for penalties during that time.
A MasterCard spokesman did not respond to a request for comment.
