McLEAN, VA - Global Payments, an Atlanta-based payment card-processing firm, suffered a credit and debit card breach affecting more than 10 million transaction records, USA Today reports.

The processor issued a statement late last week confirming that it discovered the breach last month and reported it to industry officials and the FBI.

Gartner banking security analyst Avivah Litan said reports point to a New York City street gang with Central American ties as taking control of "an administrative account that was not protected sufficiently."

"I've spoken with folks in the card business who are seeing signs of this breach mushroom," Litan said.

Security blogger Brian Krebs said thieves hacked into the Global Payments network between January 21 and February 25. MasterCard issued a statement advising its cardholders to contact the financial institution that issued their cards, while Visa said that no Visa systems were breached.

The breach recalls the Heartland Payment Systems breach in 2008 and 2009, whereby 130 million payment card records were compromised. More recently, hackers stole payment card information from more than 100 million Sony PlayStation customers, while Zappos suffered the theft of account data for 24 million customers.

"Any business that's capturing payment data is a target," said Mark Bower, analyst at Voltage Security.

Retailers face stiff penalties for failing to comply with data breach disclosure laws. Currently, 46 states have enacted legislation that require merchants to notify customers whose card numbers are stolen.

Many impose hefty fines if notifications are not made in a timely manner.

"Merchants are definitely on the hook for these state disclosures, because they are the ones who have the consumer relationship," said Ted Julian, of Co3, a Cambridge, Mass.-based company that helps retailers manage the repercussions of credit card theft.