HARTFORD, Conn.—The $39-million Cencap FCU has filed a lawsuit against Fiserv, one of the nation’s largest providers of core processing and digital banking services, alleging significant deficiencies in the company’s data security practices.
The complaint also references NCUA’s lack of third-party vendor authority, noting that places additional demands on credit unions to manage third-parties.
Fiserv is challenging the suit.
The complaint, filed Thursday in federal court, asserts that Fiserv’s Virtual Branch online banking platform provided to financial institutions and the Client360 portal used by financial institutions to open support tickets with Fiserv lack basic security controls that make them vulnerable to hackers.
“Fiserv promised world-class cybersecurity but delivered insecurity and dangerous deception,” the complaint states. “Rather than safeguarding sensitive financial data, Fiserv’s flawed online banking platform and ticketing system routinely exposed over 9,000 credit union members to fraud, identify theft, and compromise. Despite knowing its platforms were insecure, Fiserv chose profits over protection. This action holds Fiserv accountable for breaching its fundamental duties to safeguard the extraordinarily sensitive information entrusted by its financial institution customers, and seeks redress for those harmed by its misconduct.”
The credit union is also challenging Fiserv’s “multi-million-dollar” early termination fee, alleging it functions as an “unlawful penalty designed to punish institutions that seek to leave when problems arise, the complaint states.
“Given NCUA’s lack of authority over third-party vendors, credit unions themselves play a vital role in maintaining public trust, reducing third-party risks, and holding vendors to appropriate standards. We hope this case contributes to broader conversations across the credit union movement about vendor oversight, accountability, and fair contracts,” said Charles Nerko, who leads the Data Security Litigation team at Barclay Damon, which is representing Cencap.
Responding to a CUToday.info request for comment, Fiserv stated it believes the allegations are "unfounded," adding it will defend itself "vigorously" in the lawsuit.