The financial impact of cybersecurity vulnerabilities on credit unions

Cybersecurity vulnerabilities among credit unions and their vendors create the potential for large financial impacts to the credit union industry, according to a Black Kite report.

The research analyzed the cybersecurity posture of 250 NCUA credit unions and 150 vendors commonly used by credit unions. Both credit unions and their vendors averaged a cyber grade of “B,” which indicates cyber breaches would require the skills of persistent, highly experienced hackers.

However, most credit unions and vendors experienced leaked employee credentials, employed poor software patch management practices, and used insecure email networks. These vulnerabilities create the opportunity for significant financial impacts if credit unions are attacked directly or via a third-party that has access to credit union networks.

The high risk of third-party attacks

Direct attacks to credit unions estimate an annual financial risk ranging from $190,000 for small credit unions to more than $1.2 million for large credit unions. Potential third-party attacks through credit union vendors pose a higher financial risk.

Researchers calculated that the financial impact of an attack on just one vendor could exceed $1 million for large credit unions and $300,000 for small credit unions. Now, multiply that risk across the number of vendors that may have access to credit union information.

“Credit unions are entrusted with the livelihoods of their members. With great trust comes great responsibility to mitigate cybersecurity vulnerabilities, whether they are internal or via a third-party,” said Bob Maley, CSO of Black Kite.

“It is clear that the financial impact of cyber vulnerabilities for both credit unions and their vendors is significant, and resources need to be targeted to protect members and address the most costly areas of risk.”

Reducing financial risk by addressing vulnerabilities

Ultimately, credit unions can reduce financial risk by addressing and remediating critical cybersecurity vulnerabilities. Among the most problematic issues, researchers found at least one new leaked employee credential on the Dark Web from 86% of credit unions and 76% of vendors. Leaked credentials are used to deploy ransomware and other sophisticated cyber attacks.

Furthermore, 48% of credit unions and 58% of their vendors may have possible critical vulnerabilities due to out-of-date systems. The inability to update and patch network software enables hackers to exploit well-known security issues.