A vast majority of credit unions surveyed for NAFCU's October Economic & CU Monitor said local data breaches have affected their operations.
According to survey respondents, large national merchant breaches such as those that occurred at Target and The Home Depot, have exposed 20.6% of member payment cards, on average, according to NAFCU's report released Oct. 9.
NAFCU said it does not release the number of credit unions that responds to its Economic & CU Monitor surveys.
"Small, local breaches may not garner the same headlines, but they can be just as damaging for smaller financial institutions like credit unions," the report read. "A wide majority of respondents (84.4%) were impacted by a local data breach during the last two years."
According to the report, most of the credit union respondents expected to spend more money on data breach costs in 2015 compared to 2014.
Approximately 85% of the survey's respondents have fielded inquiries from members regarding the recent Home Depot breach, which affected over 50 million debit and credit cards, the report read.
NAFCU said that percentage is even larger than the Target breach, which the trade group estimated has cost credit unions nearly $30 million.
Most of the credit unions surveyed by NAFCU indicted they have started to put the appropriate safeguards in place.
"Our survey results found that nearly every credit union voluntarily implements NCUA's best practices on IT security, such as conducting penetration tests to identify vulnerabilities that an attacker could exploit," NAFCU's report read.
In terms of mobile technologies, nearly every respondent that offered mobile banking services also notified their members when funds become available through email or text alerts, according to the report.
Meanwhile, the NCUA said it is placing more emphasis on cybersecurity in the exam process.
"NCUA field staff will evaluate credit unions' ability to assess and mitigate cyber-security risk and respond to cyber-attacks," NCUA Board Chairman Debbie Matz wrote in a supervisory letter.
She added, "Credit unions of all sizes will be expected to implement appropriate risk-mitigation controls, including vendor due diligence, strong password processes, proper patch management and networking monitoring, to better prevent, detect and recover from cyber-attacks."
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
