ARLINGTON, Va.—Merchant data breaches remain the top concern among credit unions, according to NAFCU’s latest Economic & CU Monitor survey.
“Based on NAFCU’s monthly survey, merchant data breaches are the cyber threat of greatest concern to respondents, followed by third-party vendor breaches,” the association stated. “Notably, no respondents said they are ‘not concerned’ about their credit union’s risk from merchant data breaches.”
Cyber criminals are becoming more vigilant, sophisticated, and dangerous, but credit unions have made appropriate adjustments in their budgets and hiring to address the heightened risk and sophistication of attackers, NAFCU said. NAFCU’s survey shows that the percentage of respondents’ overall operating budget devoted to IT/cybersecurity has nearly doubled over the past five years.
“In addition, to address growing cybersecurity risks, a quarter of all respondents have hired a chief information security officer to manage cybersecurity-related activities. Meanwhile, half of all respondents have a committee specifically devoted to cybersecurity oversight,” NAFCU stated.
NAFCU’s survey results also indicate that the vast majority of respondents (87.5%) hold some form of cybersecurity insurance. However, at a recent board meeting, NCUA staff remarked that the cybersecurity insurance market has “turned out to be not as sound a solution as everybody would have expected,” NAFCU explained, saying it continues to monitor the evolving cybersecurity insurance market and remains optimistic that a mature cybersecurity insurance market can provide incentives for financial institutions to voluntarily adopt data security best practices.
Many credit unions have already taken meaningful steps to enhance their cybersecurity understanding and capabilities. Nearly all survey respondents (93.7%) reported that their credit union participates in some form of information sharing to keep pace with cybersecurity threats. NAFCU said it has long held that cyber threats could be mitigated with a greater level of collaboration between financial institutions, and also between the public and private sectors. Furthermore, 87.5% of respondents have used either FFIEC’s Cybersecurity Assessment Tool (CAT) or NAFCU’s easy-to-use, shareable version.
Other highlights from the survey:
- Member and loan growth are still near their highest levels, respectively, in over a decade, regulatory burden continues to stress the industry.
- The economy continues to perform unevenly. The labor market has been an area of strength, and is the primary reason that NAFCU expects the Federal Reserve to raise rates later this year.