System and method for storing data used by breach detection systems

A data breach detection system, comprising:

• an extraction management system for accessing dump sites where dump site data relating to compromised accounts is offered for sale over the Internet, for retrieving extracted data from the dump site data, the extracted data including at least (1) wildcard data that only partially identifies a primary account number (PAN) of a compromised account, and (2) compromise location data identifying the location of the compromise, and for storing the extracted data at an extracted database;
• a breach identifying system for:
• retrieving (1) transaction data pertaining to transactions conducted against accounts maintained at a plurality of financial institutions, the transaction data including merchant name data identifying the name of a merchant associated with the transaction and merchant location data identifying the location of the merchant and (2) extracted data stored at the extracted database, and merging the transaction data and extracted data into two merged data sets, each having a plurality of data records that each correspond to a transaction, the data sets including a first, unique account data set which includes, for each data record, transaction data for the corresponding transaction and extracted data associated with an account that is uniquely identified by the wildcard data and used for the corresponding transaction, and a second, multiple account data set which includes, for each data record, transaction data for the corresponding transaction and extracted data associated with one of multiple different accounts that are all identified the wildcard data;
• storing the first, unique account data set in a unique PAN database;
• storing the second, multiple account data set in a multiple PAN database;
• determining a common-point-of-purchase from the first, unique account data set in the unique PAN database;
• determining a common-point-of-purchase from the second, multiple account data set in the multiple PAN database;
• and
• using the determined common-point-of-purchase from the first, unique account data set in the unique PAN database and the second, multiple account data set in multiple PAN database to identify a merchant where a breach has occurred and accounts that have been compromised.