Cornerstone Clarifies Next Steps Regarding TruStage Cyber Incident
This week, TruStage announced that it shut down its network after detecting a cybersecurity incident. The insurer told business partners it took the systems offline as a precaution while it works with outside cybersecurity experts to investigate, contain, and remediate the attack.
Cory Phariss, regional director of NCUA's southern division, confirmed our regulatory compliance department's position that for now, credit unions should wait until they receive a notice from TruStage whether the credit union's data was compromised in the breach (this excludes the general announcement TruStage circulated).
“Under NCUA rule 748.1, each federally insured credit union must notify NCUA of a reportable cyber incident via email, telephone, or other prescribed method with 72 hours," said Cornerstone League Regulatory Compliance Counsel Suzanne Yashewski.
She added: "That 72-hour reporting deadline will be triggered if and when TruStage notifies your credit union that your own credit union’s data was compromised in the cyber incident. Details on how to file the report can be found here."
Questions can be directed to Information Central at compliance@cornerstoneleague.coop.
Subscribe
Sign up to receive the weekly Leaguer email. Existing subscribers can manage their subscription.
Share Your Stories
Have a story you'd like to see in the Leaguer? Be sure to share it with us.
