Erste Card Club helps ensure secure payment processing with Thales payShield HSMs

Balancing high-volume transactions with growing security expectations

In today’s digital payments landscape, financial institutions face the challenge of delivering seamless transaction experiences while ensuring the highest levels of data security. As consumer expectations grow and regulatory requirements tighten, payment service providers must continually adapt to meet these demands.

As a transaction acquirer, ECC faced the dual challenge of ensuring stringent security compliance while processing high volumes of transactions efficiently. The organization needed to adhere to PCI DSS standards and prepare for future PCI PIN certification requirements. Additionally, the increasing threat of quantum computing necessitated forward-looking cryptographic strategy.

“The core challenge was maintaining the highest level of security without compromising transaction speed. We needed a solution that could scale with our operations while meeting evolving industry standards.” said Mario Ožvald, Head of System Support at ECC.

Seamless migration to Thales payShield 10K with expert regional support from Alfatec

ECC implemented Thales payShield 10K Hardware Security Modules (HSMs) to address these challenges. The organization had already been using Thales HSMs for nearly two decades, starting with the Thales HSM 8000, for critical operations such as PIN generation, transaction authorization, and card issuance.

payShield 10K, the fifth generation of payment HSMs from Thales, delivers a suite of payment security functionality proven in critical environments including transaction processing, sensitive data protection, payment credential issuing, mobile card acceptance and payment tokenization. Like its predecessors over the past 30+ years, payShield 10K can be used throughout the global payment ecosystem by issuers, service providers, acquirers, processors and payment networks.

The migration to payShield 10K was seamless, requiring no changes to existing applications. The process involved configuring network interfaces, transferring security settings from legacy systems, and loading necessary cryptographic keys.

“Transitioning to payShield 10K was remarkably straightforward. The compatibility with our existing infrastructure allowed us to upgrade without operational disruptions,” said Mario Ožvald, Head of System Support at ECC.

Alfatec, a trusted regional distributor of Thales, specializing in cybersecurity and IT infrastructure solutions provide ongoing support which includes quarterly audits. Also, 24/7 monitoring and reporting on the status of HSM devices is enabled for ECC employees, which ensures uninterrupted operations.

“Alfatec’s long-standing partnership with Thales and deep local expertise played a vital role in the successful deployment at Erste Card Club. Our team ensured a smooth migration by providing support, ongoing system monitoring, and regular security audits to help ECC meet compliance standards,” said Azur Šaćiragić, IT Security Department Director at Alfatec.

Improved compliance, visibility, and a future-focused cryptographic strategy

The deployment of Thales payShield 10K HSMs delivered measurable improvements in security and operational performance. ECC successfully extended its PCI DSS certification through November 2025 and is currently preparing for PCI PIN certification with support from Thales and Alfatec.

The new HSMs enabled 24/7 monitoring capabilities that were previously unavailable, providing ECC with greater visibility into cryptographic operations. Transaction processing speeds were optimized thanks to the efficient execution of HSM commands. These enhancements have strengthened ECC’s ability to safeguard sensitive data while maintaining the rapid transaction processing that merchants and cardholders expect.

“Thales HSMs have been instrumental in securing our operations for over twenty years”, said Mario Ožvald, Head of System Support at ECC. “Their reliability and the expert support from Alfatec give us confidence in our ability to protect sensitive data now and in the future.”

Looking ahead, ECC is exploring additional Thales solutions to further enhance data security within its infrastructure, such as potential advanced cryptographic solutions designed to address upcoming challenges, including Thales technologies specifically developed to meet the security requirements of the post-quantum era.