60 CUs Hit With Service Disruption and What This Means to You

Every so often, there is a warning alarm that alerts financial organizations to be aware of an increase in cyberattacks. In August, the NCUA sounded such an alarm. This was as a result of several attacks on the MOVEit file transfer software and attacks from the LockBit ransomware group. Now, attackers have stepped it up a few notches. Approximately 60 credit unions are currently grappling with service disruptions following a ransomware attack on the cloud services provider Ongoing Operations, a subsidiary of credit union technology firm Trellance.

2

The NCUA has been actively involved in addressing the situation, with spokesperson Joseph Adamoli confirming that they received incident reports in November. Upon discovery of the ransomware attack, the NCUA got to work and initiated an investigation, engaging third-party specialists to assess the event's nature and scope.

It’s not just these organizations that are affected by such an attack. There is a ripple effect extending to other credit union technology providers, such as FedComp, a company offering data processing solutions to credit unions. In this case, FedComp acknowledged some technical difficulties, citing a countrywide outage of its data center. Despite the challenges, efforts are underway to resolve the issue including Trellance transitioning to a new server system.

With cyber threats on the rise, the NCUA wasn’t sitting around doing nothing. The organization implemented new rules in February, requiring federally insured credit unions to report cyberattacks within 72 hours. This rule took effect on September 1 and within 30 days, the NCUA received more than 146 incident reports. According to NCUA Chairman Todd Harper, that’s the number that had typically been reported in a year.

However, while this new rule is helpful, there are additional challenges that still need to be addressed. Specifically, regulatory challenges posed by the lack of oversight authority over third-party service providers and credit union service organizations (CUSOs). Over 60% of reported cyber incidents involve these third parties.

2

It’s believed that this attack took advantage of the Citrix Bleed vulnerability (CVE-2023-4966). This is a critical information disclosure bug that affects NetScaler ADC and NetScaler Gateway. Researchers have noted that abusers use this to hijack authentication sessions and steal corporate information. They believe this has been happening since at least August. Citrix warns in a blog that "If you are using affected builds and have configured NetScaler ADC as a gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) or as an AAA?virtual?server, we strongly recommend that you immediately install the recommended builds.” After doing this, it’s recommended to terminate all active sessions.

Of course, it's always a good idea to keep regular, functioning backups of all of the important data at any organization. These should be kept out of reach of the internet. This makes it much easier to recover from a ransomware attack and to avoid paying criminals any ransom money.

2

It’s important to note that this issue is not with the CUs themselves, but with their service providers. However, if you have accounts at any of the affected CUs, according to the NCUA website, “The Share Insurance Fund insures individual accounts at federally insured credit union up to $250,000, and a member’s interest in all joint accounts combined is insured up to $250,000. The Share Insurance Fund also separately protects IRA and KEOGH retirement accounts up to $250,000.” However, you may contact your organization separately to find out what you can expect.

Ongoing Operations communicated to affected credit unions, stating that, as of now, there is no evidence of information misuse, and the company is vigilantly monitoring the situation and working with affected institutions. That said, since the information known is limited, it’s not a bad idea to change your online account login credentials.