Approaches for determining a potential merchant breach are described. A system can acquire card transaction data from one or more sources such as merchants or financial institutions, in some instances at a predetermined time interval. Cards associated with the card transaction data can be analyzed to determine the health of a particular card, including the likelihood that the particular card has been compromised. A set of cards are accumulated, and their associated health data is stored. Based on the information obtained from a source, and the health associated with a set of cards, a potential date where a merchant was breached can be determined and fraudulent purchases can be prevented.