FUJITSU DENIES SOFTWARE CHARGE

MICHAEL GARRY

FRISCO, Texas - Fujitsu Transaction Solutions here has denied that certain versions of its GlobalStore and RAFT POS software are capable of storing private consumer data from debit or credit transactions such as PINs.

According to an article in the Wall Street Journal, that software was cited in a recent alert that Visa USA, San Francisco, sent to some of its "acquirer" financial institutions, which process electronic credit and debit transactions for retailers. In a press statement that did not refer to Fujitsu, Visa said that it had found that "a particular configuration of certain software could cause it to store cardholder data," adding that a "software upgrade" was available "to address the problem."

A POS system that captured private security codes would be vulnerable to a security breach. Thus, storage of such codes is prohibited by Visa and would prevent a retailer from being in compliance with the Payment Card Industry (PCI) data security standard. Visa did not mention any security breach in its alert.

However, Ed Soladay, chief operating officer, Fujitsu, denied that its POS software captures PIN or other security data. The software "is mentioned in the Visa alert, but we're not sure of the reasons for it," he said. "We've had no reports of a security breach." Fujitsu's POS software is PCI-compliant, Soladay said, adding that it is also being certified as such.

Fujitsu is aware of only one deployment of the particular version of GlobalStore or RAFT (an older form of GlobalStore) mentioned in the alert, said Neil McGlone, spokesman for Fujitsu, who did not name the deployment. The software is typically used by specialty and general merchandise retailers; it is not employed by supermarkets, except outside North America. Fujitsu markets other POS software to U.S. food retailers via StoreNext Retail Technologies, Plano, Texas, a joint venture of Fujitsu and Retalix.

Soladay noted that the GloalStore/RAFT software could only store data in concert with a "tracing utility" used for troubleshooting. "You should only use a tracing utility in a test environment and even there be certain of turning it off," he said.