The Troy Group said it had reported the intrusion to the FBI, and hired a professional forensic analysis firm to aid in the investigation. eCheck Secure allows Internet merchants and financial institutions to accept checks online or in call centers. The eCheck Secure web site runs on Windows 2000 and IIS 5.0.

Little-known third-party service providers have figured in high-profile incidents that have exposed customer data. In June, a security breach at CardSystems Solutions exposed more than 40 million credit card accounts to potential theft, including customers of MasterCard, Visa, Discover and American Express.

Netcraft audits financial web applications for design errors and erroneous functionality. These tests are among a range of security services, including automated vulnerability tests of Internet-connected networks and a suite of anti-phishing measures.