For credit unions the incident is another reminder of the indirect, yet potentially significant, effects on their bottom line, Brian Godwin, interim CEO for Des Moines based PolicyWorks, indicated. "Credit unions end up absorbing a lot of the losses from the fraud that inevitably follows breaches, large and small.” Godwin added regulations protect consumers by limiting their liability. The spirit of these rules is good. “Credit unions want to protect their members. And in many ways, the added security the regulations offer consumers keep products like credit and debit cards attractive to members. It's a double-edged sword."

Paul Love, chief information security officer for Rancho Cucamonga, Calif.-based CO-OP Financial Services, warned this is another breach increasing the number of people with information exposed to criminals. “This means that credit unions may be affected via fraud losses or needing to reissue cards, as some cards may have been compromised.” Breaches of payment card data continues to push the expense of other organizations’ breaches to financial institutions, including credit unions. “Additionally, there is speculation that SSN's may have been part of this breach.”

“There needs to be technical due diligence, just like financial due diligence, whenever one company is acquiring or merging with another. Tom DeSot, EVP, CIO of San Antonio, Texas-based Digital Defense, Inc. noted. “It should be a negotiating point for the buyer in the case of an acquisition because they should have a general idea of what shape the other firm's network is in, and how much it is going to cost them to deal with the security.”

Jake Olcott, VP of Strategic Partnerships at Cambridge, Mass.-based BitSight, and a former legal advisor on cybersecurity issues in Congress, held many levels of due diligence must take place done during an M&A transaction. “While companies primarily focus on financial risk, cyberrisk has emerged as an area that cannot be ignored.” Olcott added one of the biggest challenges is ascertaining the acquiree’s historical controls effectiveness and operational track record within the due diligence period.

“The biggest question here is why this system vulnerability was not discovered PRIOR to the acquisition,” John Kronick Director Cybersecurity Solutions for El Segundo, Calif.-based PCM, Inc. noted. “Considering that TIO Networks processes credit card transactions, and is required to undergo certified annual PCI audits by a Qualified Security Assessor, how was this vulnerability overlooked or not discovered during the PCI audit? The whole security process, from normal PCI credit card security, to patching and monitoring, and pre-acquisition security program, are in question.”

For credit unions, two big takeaways exist, explained Sherri Davidoff, founder/CEO of Missoula, Mont.-based LMG Security. “First, we can no longer rely on knowledge-based authentication, to verify customers’ identities over the phone. Your Social Security number is effectively public. Credit unions should consider deploying phone print or voice recognition technologies. Second, passwords are passé.” Davidoff recommended credit unions offer members the option of using two-factor authentication because of the theft and reuse of many passwords.