Dive Brief:

• Dozens of credit unions caught in a ransomware attack against a third-party vendor last month have resumed normal operations, the National Credit Union Administration said Wednesday.
• Ongoing Operations, a subsidiary of Trellance that provides IT services to the industry, was hit by a cyberattack isolated to a segment of its network on Nov. 26, the company said last week in an incident update.
• “As of Dec. 13, and based on our outreach to affected credit unions regarding their operating status, the affected credit unions are fully operational and serving member needs,” Joseph Adamoli, acting director and media relations manager at the National Credit Union Administration, said in an email.

Dive Insight:

About 60 credit unions have recovered and brought systems back online after they experienced outages linked to the ransomware attack against Ongoing Operations, which provides disaster recovery and cloud services to credit unions.

While Ongoing Operations said some data was compromised and notified impacted customers, credit unions have yet to disclose damages downstream.

“We have received no credit union incident reports regarding data theft,” Adamoli said.

Yet, Ongoing Operations signaled some credit unions’ members may be impacted, noting it will assist the organizations with member notification and provide credit monitoring and identity restoration services to individuals impacted.

“The nature of this ongoing investigation takes a substantial amount of time as the process of reviewing the files to determine what information may have been involved is lengthy and complex,” Ongoing Operations said in the incident report. “We have made significant progress as we continue to reestablish services for customers.”

A growing number of credit unions experienced ransomware attacks this year, including multiple organizations hit by the spree of attacks against MOVEit file-transfer service environments in late May.

NCUA earlier this year issued a rule requiring federally insured credit unions to report cybersecurity incidents within 72 days. The agency received 146 incidents the first month the rule was in effect, roughly the number of reports it previously received in an entire year, NCUA Chair Todd Harper said in October.

Despite the outages, NCUA said credit unions’ members' funds are safe. “The credit unions have sufficient liquidity to meet the cash and payment needs of their members,” Adamoli said. “Members have access to their funds and to ATMs.”