Ransomware and credit unions: Before, during & after an attack

It’s no secret that ransomware attacks are on the rise, with an attack occurring every 10 seconds since the beginning of 2020. The U.S. Treasury has tied $5.2 billion in Bitcoin transactions to ransomware payments and the average ransomware payment climbed 82% to a record $570,000 in the first half of 2021 from $312,000 in 2020.

Credit unions continue to be prime targets due to the highly confidential nature of the data they possess, the breaching of which can result in millions of dollars in fines and penalties. As bad actors continue to evolve their methods — and victims continue to pay up — credit unions must be proactive and prepared regarding their cybersecurity strategy.

The following tips can help you prepare and respond before, during, and after a ransomware attack.

Before an Attack

Have an incident response plan (IRP) in place

This is foundational as the IRP provides instructions to help your cyber team detect, respond to, and recover from a security incident by covering specific response actions based on the type of security incident.

Build an incident response (IR) team

Build your internal CIRT (cyber incident response team) and define clear rules and responsibilities to execute your IRP. If you do not have the internal staff to manage a ransomware attack, consider identifying an IR partner to keep on retainer.

Capture the forensics chain

Credit unions are heavily regulated, so it’s even more imperative to ensure you have the technology and process in place to maintain a sound cyber incident forensics chain that will help to determine notification requirements and the impact of the incident.

Conduct tabletop exercises

Conduct incident response tabletop exercises at least annually to test your plan and support a seamless response.

Maintain a modern backup strategy

There is a big difference between having backups and having a backup strategy supported by modern technology that enables rapid recovery as well as prevents ransomware from encrypting the backups.

During an Attack


Ransomware is built to spread quickly from machine to machine, so it’s critical to stop the spread as soon as possible.


Although instinct may say “pull the power cord,” ensure your employees know not to do this. Instead, isolate the machine(s) to prevent communication on the network. Once the attacker’s access is lost, it prevents them from executing anti-forensic actions to cover their tracks and destroy evidence.

Eradicate and recover

Forensic investigation and business restoration generally are conducted simultaneously. Backups are critical here, as they allow organizations to easily recover valuable data and avoid paying the ransom.

After an Attack

Reconnect and restore

Having a Business Continuity and Disaster Recovery (BCDR) strategy in place, informed by a Business Impact Analysis (BIA), helps provide an understanding of the impacts an event like a ransomware attack can have on your credit union and provide an action plan on how to reconnect and restore critical services based on priority.

Document lessons learned

You will likely learn a lot from responding to a ransomware attack, so it’s important to incorporate these lessons to inform updates to and refine organization policies, plans, and procedures for the future.

How prepared is your credit union for a ransomware attack?

70% of financial firms have experienced a cybersecurity incident within the past year. Cybersecurity has officially escalated to the boardroom and become a critical element to the survivability of every credit union, yet most cybersecurity programs are merely a collection of policies and software.

Download our CIO’s Ransomware Checklist for more guidance on preparing for and responding to a ransomware attack, including a bonus incident response tabletop exercise for you to conduct with your team to determine where your organization really stands.

Mary Beth Hamilton

Mary Beth Hamilton

Mary Beth Hamilton is Chief Marketing Officer at Dataprise, the premier strategic managed service and security provider to credit unions and other financial institutions across the United States. Mary Beth ... Web: https://www.dataprise.com Details