Update, July 2:
Patelco Credit Union told customers Tuesday it is still working to repair the impacts of a ransomware attack on Saturday.
While credit union officials have not announced an expected timeline for resolving the issue, they have clarified some points for customers.
Customers can receive checks or payments initiated by other banks (such as ACH or Automated Clearing House transfers) into their Patelco accounts, but should expect delays on funds, Patelco said in an email.
Customers can also continue to pay by check from their Patelco checking account, but should expect delays in their debit.
However, the credit union said recurring electronic transfers (including Zelle), direct deposits and balance inquiries remained unavailable Tuesday, nearly four days after the ransomware attack.
Debit and credit card transactions were working on a “limited” basis, Patelco’s email noted, telling customers that “ACH transfers or bill payments made with your Patelco account will not be processed.”
Patelco executives assured customers that the credit union would refund late fees resulting from the problem and that they would write letters to customers concerned about late payments affecting their credit rating.
The credit union also said it would waive all overdraft, late or ATM fees from Patelco until it fixes the security breach.
“Additional details on how to request this assistance will be available soon,” they noted in the email, directing customers to a website that provides updates on the ransomware attack.
Original, July 1:
Patelco ransomware attack prevents customers from paying bills or accessing their money
A security breach at one of the San Francisco Bay Area’s major credit unions has left East Bay residents stranded, unable to access much of the money in their accounts and uncertain whether their scheduled payments will be processed.
Patelco Credit Union, a Dublin-based credit union with offices in Oakland and Berkeley, announced in an email to customers over the weekend that a “serious security incident” Saturday forced the credit union to shut down its online banking and mobile apps. Customers could no longer make payments, receive funds via direct deposit or transfer money.
In a statement released Monday afternoon, Patelco’s vice president of marketing, Rina Johnson, confirmed to Berkeleyside that the security breach was a ransomware attack.
“Unfortunately, this incident has required us to proactively shut down some of our day-to-day banking systems in order to contain and resolve the issue,” Johnson said, adding that members can still access cash at ATMs, but did not specify whether there is a limit to how much they can withdraw.
“We have engaged a leading cybersecurity firm to help us investigate and recover as quickly as possible,” Johnson continued. “Please know that our team and third-party partners are working around the clock to get us back on our feet. We are committed to providing transparent and frequent updates to the best of our ability and the best service possible given the disruption.”
Johnson also provided a link to a new site Patelco has created to provide security updates, saying it would be live Monday afternoon.
Patelco customers concerned about bills and income
Basic banking functions were still unavailable as of 2 p.m., leaving many Bay Area residents uncertain about whether they will be able to pay important bills or receive needed income.
“I should have paid my mortgage today, but I don’t know when it’s going to happen,” Marina Bukowski, an Albany resident who has her bank account at Patelco’s Berkeley branch on Kala Bagai Way, said Monday morning. “I’m just waiting and hoping my credit doesn’t get ruined.”
Meanwhile, an Oakland woman who declined to give her name sat on a bench outside the Berkeley branch after registering with the credit union. She said she received an email over the weekend informing her of the security breach as she waited for a deposit Saturday to cover her rent and other bills. Like others, she was unable to access her account and was told she could only withdraw $500.
The woman said she was “very worried” and had contacted family and friends to help her until she could access her funds.
In social media posts Sunday night, Patelco, which has about half a million customers and nearly $10 billion in assets, told customers its teams were still working to resolve the outage but would not provide an estimate of how long it would take to resolve.
Instead, the message advised customers to seek help at Patelco branches, its call center and its online “Live Chat” feature on Monday, although it warned that wait times are longer than usual.
“We will answer your questions to the best of our ability, but we cannot provide specific information about your accounts at this time,” the message said. “We will provide further updates as information becomes available. We know this is a concerning situation and are committed to keeping you informed as the investigation continues.”
Many commenters on social media reported that they could only withdraw $500 per day from ATMs or branches.
However, the lack of information has frustrated many customers.
“I’m frustrated and anxious, and I also understand that we’re in crisis mode,” Bukowski said, noting that he fears important bills won’t be paid.
“I have a lot of automatic payments. I know the vending machines are still working, but the question is: Will my water bill be paid? Will my PGE be paid?”
Another Berkeley resident and small business owner who declined to be named publicly out of concern her financial information was vulnerable said she could not access her personal or business accounts.
“Today is the first of the month, and I have direct deposit payments coming in, as well as bills to pay, including a mortgage payment,” she said.
“As a small business owner, I’m going to have to make payments this week,” she explained. “I wrote two large checks related to my business last week and I don’t know if they’ll bounce or clear. Not knowing how this will impact my credit or the people I have business or personal relationships with is a challenge.”
She said she has reached out to people and businesses who might be affected by her accounts, but even that seems fraught with consequences.
“I have a lot of automatic payments. I know the vending machines are still working, but the question is: Will my water bill be paid? Will my PGE be paid?”
Marina Bukowski, Berkeley Patelco client
“I try to be proactive, to maintain the integrity of those relationships, but even by sharing the information, I feel like I might make them nervous about our financial relationship,” she explained. Plus, “I can’t look at my monthly history to make sure I’ve contacted all the parties who are getting automatic payments from me at the end or beginning of the month.”
On social media, where Patelco posted its two public announcements, customers expressed their exasperation.
“The fact that I get more updates in the comments rather than Patelco themselves is sad,” one Instagram commenter said.
“Is our money still in our accounts? I will stop panicking when I know the breach didn’t take all our money,” wrote another.
The credit union’s media team did not immediately respond to requests for additional information or comment.
Other customers were more optimistic.
“I have been with Patelco Credit Union since 1999. I am not leaving,” one customer wrote on Facebook. “Honestly, things happen to good people and businesses alike. My money is safe. I am not worried. I am patiently waiting for answers.”