Pop culture has made cybercrime seem like quantum physics: It is nearly impossible for the average person to understand how data and money are easily stolen with some computer keystrokes. Maybe that's why cyber thieves make such compelling figures in movies and television shows. You want to understand just what the heck they're doing.
On the surface, there seems to be a lot of mystery about real life data breaches at credit unions, banks and other financial institutions. Yet when one looks past the "elaborate" techniques and technologies used by hackers, the data breaches themselves are surprisingly simple. In fact, the vast majority result from three relatable scenarios:
-
An unknown hacker obtains an employee's credentials and proceeds to steal funds and/or data.
-
An employee or trusted third party knowingly steals funds and/or data.
-
An employee or trusted third party unknowingly releases sensitive data for profit.
The common factor in each of these scenarios is the insider: An employee, privileged user or trusted third party. Whether intentional or accidental, these are the people who make data breaches possible.
Recommended For You
Breaches caused by insiders occur with amazing regularity in the real world. So to better answer the important questions about insider threats at credit unions, consider some recent real world examples from this very publication.
-
A breach at a credit union in Hawaii is likely to have involved hackers obtaining access to an employee's email account, which was later used to obtain members' Social Security and account numbers.
-
None other than a credit union CEO (with the help of her husband, a Baltimore County police sergeant) allegedly used her privileged access to falsify loan documents and embezzle more than $100,000.
-
And finally, a duo allegedly preyed on unsuspecting credit union employees, flying across the country and using fake IDs and credit cards in order to get employees to issue funds.
In each case, whether employees knew of the fraud or were duped, they played a significant role in obtaining money and sensitive data. Had these credit unions gone to greater lengths to monitor insiders, damages would not have been as severe nor would the breaches have lasted as long. These stories and others are prompting credit union leaders to give user activity monitoring serious consideration, but not without first asking themselves some critical questions.
Who should we look at?
The short answer: Everyone. Anyone with insider access to sensitive data. This includes rank-and-file employees (tellers and managers) as well as third-party vendors such as managed service providers and IT consultants. You'll need to monitor their digital activities, not because you suspect them of actual wrongdoing, but because their accounts and credentials can and will probably someday be used to steal sensitive information.
What should we look for?
The short answer: Everything. Not all activity warrants active monitoring, but since the origins of a breach can occur with a simple email click or website visit, all activity must be at least monitored passively.
How can we prevent future breaches?
The short answer: You can't. You can never completely remove the human element from your IT security, but you can mitigate the negative effects of a data breach by monitoring insiders' digital actions. This ensures that hackers have less time to steal sensitive data, compliance violations are less severe and members are notified as quickly as possible.
Fifty-nine percent of information security professionals say the most effective way to combat insider threats is user activity monitoring. Being aware of the many threats that exist and deploying an innovative solution will give your credit union a measurable security advantage and the freedom to concentrate on serving members.
Paul Brady is CEO for Observe IT. He can be reached at 800-687-0137 or [email protected].
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
