A credit union’s first report of a vendor breach may come from the attacker

The week

On November 15, 2023, the ALPHV ransomware group, also known as BlackCat, said it had filed a complaint with the Securities and Exchange Commission alleging that MeridianLink had failed to disclose a breach. MeridianLink is a publicly traded provider of digital lending and account opening software used by many banks and credit unions. ALPHV claimed it had stolen company data. MeridianLink said it had identified and contained a cybersecurity incident around November 10 and had found no evidence of unauthorized access to its production platforms. The complaint cited the SEC’s new incident disclosure requirement, which did not take effect until December 18. The episode was widely reported as the first known case of a ransomware group reporting its own victim to a regulator.

An earlier article in this series, on the SEC’s July 2023 cyber rule, looked at how a public company governs its own materiality determination. The MeridianLink episode raised the question one step down the supply chain. Many of MeridianLink’s customers were community banks and credit unions, which are not SEC registrants but have their own short notification clocks. Since September 1, 2023, federally insured credit unions had been required to notify the NCUA within 72 hours of reasonably believing a reportable cyber incident had occurred. The rule expressly reaches some incidents at third parties. Banks had been under the interagency 36-hour notification rule since 2022. For these institutions, the first public account of a vendor’s incident came from the attacker. Their work divided into three parts that together cover every audience: establishing the facts, deciding what regulators must hear, and deciding what customers and members must hear.

Establishing the facts

An institution learning of a vendor incident usually has four sources: the attacker’s claims on a leak site or to journalists, the vendor’s public statement, the vendor’s direct communication to customers, and its own logs. Each has a bias. Attackers exaggerate to raise pressure. Vendors understate early, partly because they do not yet know and partly because their own disclosure obligations shape the wording. Neither tells the institution whether its own members’ data was in the affected environment.

A prepared institution can narrow the question within hours. Its vendor inventory should record, for each critical provider, what data the provider holds and in which environment. A claim about the vendor’s corporate network can then be separated from one about the production platform hosting loan applications. Its contract should give it a right to specific answers, such as whether the institution’s tenant or data sets were accessed, with a named security contact rather than an account manager. It can check its own side: unusual activity on integrations with the vendor, service accounts the vendor uses, and file transfers. Each finding, with its time and source, goes into an incident log. That log becomes the basis for both the regulatory and the customer decisions that follow, so it should be kept by one person from the first hour.

Deciding what regulators must hear

The regimes have different triggers. The NCUA’s turns on a reasonable belief that a reportable cyber incident occurred. Its definition includes disruption of business operations, vital member services or member information systems resulting from an attack on a third-party service provider. The banking agencies’ rule turns on a determination that an incident has materially disrupted or degraded, or is reasonably likely to, the bank’s operations or ability to deliver services. That rule separately requires bank service providers to notify their bank customers when an incident disrupts or degrades covered services for four or more hours. None is triggered by an attacker’s claim alone.

That leaves room for judgment, which is exactly why the judgment needs a record. A credit union that decides a vendor incident is not reportable should be able to show what it knew, when, and why it concluded what it did. When uncertain, a short early notice to the supervisor, describing what is known and unknown, is usually cheaper than explaining a late one. The NCUA has described the 72-hour notice as an early alert that does not require a complete assessment, and a follow-up can correct it. Institutions should confirm their approach with counsel, because several institutions using the same vendor may reach different conclusions, and supervisors will compare them.

Deciding what customers and members must hear

Members and customers may see the attacker’s claims in the press before the institution has facts. Silence invites calls to branches and the contact center, where staff have nothing to say. A holding statement, prepared in advance, can acknowledge that a technology provider has reported an incident, say the institution is assessing whether member information is affected, and describe how members will be told. It should not repeat the attacker’s claims or guess at scope.

Formal notice is a separate question governed by state breach notification laws, which generally turn on unauthorized acquisition of specified personal information, and by interagency guidance on response programs for customer information. Contracts often let the vendor send notices on the institution’s behalf, which can help consistency but also means the institution’s name appears on a letter it did not write. Institutions should agree the content in advance, along with who pays for notices and credit monitoring. Contact center scripts should be updated the same day, and fraud teams should watch for phishing that uses the incident as a pretext, because attackers and opportunists often contact members claiming to be the institution.

None of these steps depends on the vendor’s cooperation, and all of them can be prepared now for every critical provider. The attacker in this case aimed its complaint at a public company. Its smaller customers felt the pressure on clocks the attacker never mentioned.

With hindsight

Reporting a victim to a regulator did not become a common extortion tactic, and attacker complaints did not change the legal triggers for disclosure. The SEC’s Item 1.05 requirement took effect on December 18, 2023 as scheduled. ALPHV was disrupted by the FBI that month and collapsed in early 2024 after the Change Healthcare attack, in what appeared to be an exit scam against its own affiliates. Within weeks, a ransomware attack on Ongoing Operations, a cloud services unit of the credit union service organization Trellance, caused outages at about 60 credit unions, and the NCUA confirmed it was working with those affected. Notification regimes kept multiplying, including the federal critical infrastructure incident reporting rule CISA proposed in 2024 under CIRCIA, whose final form and timing have been revisited since. The preparation described here, a vendor data map, a contractual right to answers and a holding statement, applies to each new regime as it arrives.