Vendor management

Many banks can't say what software their IT provider runs. Only 58% of community and midsize banks even hold the right to audit that vendor, a survey found.

The company, which says it serves 93% of credit unions, expects most key processes to run by mid-August. Its status page still said "Investigating" Wednesday.

The banking regulator is in early discussions with trade groups to build an organization for certifying tech providers that pass voluntary due diligence checks.

The class action is an early test of whether credit unions can hold their vendors liable for the cybersecurity they promise.

Verizon's 2026 Data Breach Investigations Report finds attackers now break in most often through unpatched software and third-party vendors, not stolen passwords.

The case exposes a systemic risk for banks: incident-response and ransomware-negotiation firms receive sensitive breach details that a corrupted insider can sell back to the attackers.

Both banks deny their networks were breached. Experts say the data likely points to a single vendor that was compromised.

Union Bank and Trust is resolving claims from a 2023 software exploit that exposed customer data to cybercriminals.

Cybercriminals say they stole sensitive records by exploiting an unpatched vulnerability known as React2Shell and using the password Lexis1234.

Threat group ShinyHunters claimed responsibility for the attack, which reportedly targeted third-party platforms rather than Betterment's own systems.

Supply chain attacks have doubled since 2021, with professional services firms increasingly acting as "stepping stones" to access bank data.

New disclosures show the ransomware attack on the marketing vendor affected far more community banks and credit unions than initially estimated.

A service outage on Friday at Fiserv affected multiple banks and crippled at least 60 applications for some Fiserv customers, including Early Warning's peer-to-peer money transfer app Zelle. The issue, while resolved, reiterates the importance of bank redundancies.

A power outage and hardware failure at fintech FIS last week delayed deposits and payments at 27 banks, including Capital One.

Automatic updates and data encryption have their advantages. As many CrowdStrike customers learned on July 19, they also have disadvantages.

Criminals breached a third-party database storing Santander customer and employee information, a type of intrusion that banks are increasingly facing.

The recent leadership turmoil at OpenAI underscored the importance of the due diligence banks must conduct before working with a generative artificial intelligence vendor.

Financial services companies are still in the early days of utilizing artificial intelligence, meaning they must closely examine any partnership with a third party. This includes demanding evidence to back up any performance claims these outside companies make.

The move by the company's new CEO is designed to promote greater network effects and benefits for paying members. Bank CEOs say the network helps smaller banks compete.

Some banks are gravitating toward API connectivity to build an "ecosystem of applications." Others like a one-stop-shop or ready access to executives.