PALM SPRINGS, Calif.—NCUA has confirmed that one of its examiners lost an external flash drive that included personal data on members of Palm Springs FCU here.
That data included names, addresses, account numbers and even Social Security numbers, the agency has confirmed. The flash drive was apparently lost during the credit union’s most recent exam. Members have been notified of the threat to their data.
“NCUA confirms the loss of a thumb drive during an exam, which did not include passwords or PINs,” the agency said in a statement to CUToday.info. “NCUA has received no indication of any unauthorized access to members’ accounts or attempts to gain improper access. NCUA is working closely with the credit union. Consistent with Office of Management and Budget guidance, the notice to members about the lost data came from the credit union. This notice is also consistent with California law, as well as NCUA’s rules and instructions.”
The agency added, "Since 2008, NCUA has had in place policies and procedures governing the proper handling of electronic data received as part of the examination process. These procedures require NCUA examiners at all times to properly secure and control electronic devices containing sensitive or confidential information. We take this situation very seriously and we are committed to ensuring that the data shared in exams are protected."
NCUA declined to comment further.
In response, NAFCU CEO Dan Berger called the incident “unacceptable. NCUA is a steward of credit unions’ sensitive information and must be held to the highest standard for safeguarding such data. These types of errors have the ability to do great harm to credit unions’ reputations and their members’ financial well-being. We charge NCUA with taking all steps necessary to review their processes in a transparent way to ensure this type of mistake does not happen again.”