Approximately 60 credit unions are grappling with outages following a ransomware attack on Ongoing Operations, a cloud services provider owned by credit union technology firm Trellance. The National Credit Union Administration (NCUA) is actively coordinating with affected credit unions, ensuring federally insured member deposits up to $250,000 are covered. The attack, discovered on November 26, prompted immediate action, with ongoing investigations involving third-party specialists. Trellance has reassured that, at present, there’s no evidence of information misuse. The incident has broader impacts on credit union technology providers, such as FedComp, experiencing a nationwide outage, exemplifying the interconnected risks within the financial sector.
The NCUA’s prior warnings about rising cyberattacks on credit unions have proven prescient, with this incident amplifying concerns. The attack on Ongoing Operations is emblematic of a broader trend, with credit unions, service organizations, and third-party vendors facing escalating cyber threats. The incident underscores the need for robust cybersecurity measures across the financial sector, given the interconnected nature of services. The NCUA’s recent rule requiring prompt reporting of cyberattacks reflects the urgency to address such threats, yet challenges persist due to limited oversight on third-party service providers. Closing this regulatory blind spot is crucial to safeguarding thousands of credit unions and millions of consumers from escalating cyber risks.
NCUA Chairman Todd Harper’s acknowledgment of over 60% of cyber incidents involving third-party service providers emphasizes the systemic vulnerability. Despite credit unions’ proactive engagement with government agencies for cybersecurity assistance, the NCUA’s constrained ability to oversee these entities poses a significant risk. The call to close this regulatory blind spot becomes imperative, as the entire credit union system, encompassing trillions in assets and millions of consumers, remains exposed to heightened cyber threats. The incident highlights the pressing need for comprehensive regulatory measures to fortify the financial sector against evolving cyber risks.
Reference:
