I work in cybersecurity and am a customer of a rival CU in the same region.
I think it’s too early to criticize. In the first 48 hours of a data breach, everything is chaos. Let their IT team get an estimate of how bad the situation is and try to triage as best as possible.
From their business standpoint, it’s better to be a little slow to report what is happening than it is to be quick and inaccurate. It’s better to proactively shut down services early to reduce the possibility of propagation of the breach.
From the customer standpoint, the experience sucks no matter what happens, but it can suck less if the company focuses on stopping the spread and recovery as fast as is reasonably possible.
Also, this appear to have happened over a weekend, so getting all of the employees, vendors, Board of Executives, lawyers awake, on the same calls, and come up with the deliverables is much slower than 10a on a Tuesday.
I'm actually a customer of Patelco and wouldn't say it's too soon to criticize. They've had multiple widespread outages over the past three or four years and still haven't figured out basic communication stuff.
Also, this appear to have happened over a weekend, so getting all of
the employees, vendors, Board of Executives, lawyers awake, on the same
calls, and come up with the deliverables is much slower than 10a on a
Tuesday.
I saw some complaints on reddit that this started on Friday. No matter. Patelco is a financial institution with about $9 billion in assets. They can afford to and should have people on call during the off hours. 3–4 days is an unacceptable response time. This isn't some wanky ChatGPT bullshit, this is folks' money.
Security just isn't Patelco's thing. E.g. I've a "passphrase" set on my account and about 1 in 5 tellers actually verifies it before giving me access to my account in person. So far nobody I've talked to over the phone has ever bothered. Their old PC-24 online banking platform did some pretty obviously insecure things, but they've since switched to a "more modern" banking platform. Welp. It's been so long I don't remember why I had a real dim view of the new product, but again if the reddit peanut gallery is to be believed they were sending out credentials and whatnot in plain text. I'm only a member because their computer glitches worked in my favor.
As sloppy as Patelco is, they still give off an air of being more professionally run than some of the other smaller Bay Area credit unions.
