DUBLIN, Calif.—The California Department of Financial Protection and Innovation (DFPI) has issued a consent order against $9.5-billlion Patelco Credit Union for cybersecurity violations, the DFPI announced.
As CUToday.info reported, Patelco was hit by the ransomware attack in late June, shutting down its online and mobile banking platforms, and even making it impossible for branch staff to provide balances and other services to members.
The consent order, which includes a $100,000 penalty, follows an investigation prompted by a June 2024 ransomware attack affecting Patelco’s approximately 500,000 members, the DFPI said.
The ransomware attack caused essential computer functions at Patelco to shut down from June 29, 2024, to July 15, 2024, and disrupted services to Patelco’s members, including the inability to conduct any online banking functions. At that time, ransomware attackers were also able to access a significant number of members’ personally identifiable information (PII), the DFPI noted.
Affected Hundreds Of Thousands Of Members
“Last summer’s cybersecurity breach at Patelco adversely affected hundreds of thousands of credit union members. They were locked out of their accounts for weeks and their personal information was compromised,” said Acting DFPI Commissioner KC Mohseni. “This Department is committed to holding accountable companies that do not adequately protect their customers’ data.”
The DFPI order directs Patelco to correct failures in their cybersecurity programs to comply with state and federal cybersecurity requirements. The company is also ordered to retain an independent compliance consultant to oversee remediation, report to the DFPI on the company’s cybersecurity programs, and pay a penalty of $100,000.
As CUToday.info reported, numerous lawsuits have been filed against Patelco following the ransomware attack that knocked many of its systems offline for weeks.
Patelco Response
Erin Mendez, Patelco president and CEO, said that following the cybersecurity incident the organization experienced in June 2024, the credit union worked closely with the California Department of Financial Protection and Innovation to "understand and address their questions and achieve a resolution. As part of this resolution, we are implementing enhanced measures to further strengthen our cybersecurity program—many of which are already underway. These proactive steps underscore our unwavering commitment to transparency, protecting our members’ information and privacy, and continuously improving our systems to prevent future incidents. By investing in these improvements, we reaffirm our dedication to resilience and the trust our members and community place in us."