Credit Union Industry Risks Significant Financial Impact Due to Cybersecurity Vulnerabilities, According to Black Kite

BOSTON, March 17, 2021 /PRNewswire/ -- Cybersecurity vulnerabilities among credit unions and their vendors create the potential for large financial impacts to the credit union industry, according to the 2021 Third-Party Risk Pulse: Credit Unions and Vendor Ecosystems report released by Black Kite today.

The research analyzed the cybersecurity posture of 250 NCUA credit unions and 150 vendors commonly used by credit unions. Both credit unions and their vendors averaged a Black Kite cyber grade of "B," which indicates cyber breaches would require the skills of persistent, highly experienced hackers.

However, most credit unions and vendors experienced leaked employee credentials, employed poor software patch management practices, and used insecure email networks. These vulnerabilities create the opportunity for significant financial impacts if credit unions are attacked directly or via a third-party that has access to credit union networks.

Direct attacks to credit unions estimate an annual financial risk ranging from $190,000 for small credit unions to more than $1.2 million for large credit unions. Potential third-party attacks through credit union vendors pose a higher financial risk. Black Kite researchers calculated that the financial impact of an attack on just one vendor could exceed $1 million for large credit unions and $300,000 for small credit unions. Now, multiply that risk across the number of vendors that may have access to credit union information.

"Credit unions are entrusted with the livelihoods of their members. With great trust comes great responsibility to mitigate cybersecurity vulnerabilities, whether they are internal or via a third-party," said Bob Maley, Chief Security Officer of Black Kite. "It is clear that the financial impact of cyber vulnerabilities for both credit unions and their vendors is significant, and resources need to be targeted to protect members and address the most costly areas of risk."

Ultimately, credit unions can reduce financial risk by addressing and remediating critical cybersecurity vulnerabilities. Among the most problematic issues, researchers found at least one new leaked employee credential on the Dark Web from 86% of credit unions and 76% of vendors. Leaked credentials are used to deploy ransomware and other sophisticated cyberattacks.

Furthermore, 48% of credit unions and 58% of their vendors may have possible critical vulnerabilities due to out-of-date systems. The inability to update and patch network software enables hackers to exploit well-known security issues.

For more details, find the full report at: https://blackkitetech.com/whitepaper/2021-third-party-risk-pulse-credit-unions-and-vendor-ecosystems/

Methodology:
Black Kite researchers leveraged the company's platform and open-source intelligence tools that hackers use to provide visibility into the cyber posture of credit unions and their vendors. Black Kite yields the largest digital footprint with unique controls to eliminate false positives and provide relevant data. Simplified letter grades are assigned to every vendor in an organization's supply chain, allowing risk professionals to clearly understand vulnerabilities and make better risk-based business decisions.

About Black Kite:  Black Kite is the only cyber risk rating platform focused on alerting your business to third-party risks. Built on the latest Cloud technology to automate scalability, risk assessment times are reduced from weeks to hours. For the first time, CISOs, CROs, and CFOs have an automated tool to estimate the cost of a cyber breach, communicating risk in qualitative and easy-to-understand business terms. Unlike other cyber rating products, there's no "secret sauce." The process generating every third-party cyber risk assessment is standards-based and fully transparent so that all users understand exactly where their results come from. Why? It's really this simple: you shouldn't be flying blind.

Media Contact:
Danielle Lewan
Director of Marketing
Email: [email protected]

SOURCE Black Kite