Credit unions committed to 'enhancing cybersecurity' after attack

Personal data of members may now be on the dark web

Blackpool Credit Union logo

The Irish League of Credit Unions (ILCU) has said credit unions are committed to enhancing their capabilities to respond effectively to cyber threats following the recent attack on Blackpool Credit Union, where it is believed personal customer information was accessed and shared on the dark web.

following the recent attack on Blackpool Credit Union, where it is believed personal customer information was accessed and shared on the dark web. 

Members of one of Cork’s largest credit unions were warned to be vigilant against financial scams after a major cyberattack saw the personal details of thousands of members, including their names, addresses, dates of birth, and account information stolen and possibly shared with online fraudsters. 

Blackpool Credit Union, on the city’s northside, said technical experts were called in to perform a forensic investigation of the hack as soon as they became aware of it, adding that the matter has been reported to the Central Bank, the Data Protection Commission (DPC), and An Garda Síochána.

The lender confirmed that its main banking system was not impacted by the attack, and that no money was removed from any member accounts.

It also confirmed that no PINs were compromised.

However, the credit union said it believed that some of the files accessed did include personal data, including the names of members, addresses, contact numbers, dates of birth, and credit union account information.

Blackpool Credit Union is one of the city’s largest, with around 6,500 members.

In a statement, the credit union confirmed details of the cyberattack to the Irish Examiner, saying :“We take our data protection responsibilities very seriously, and it is a matter of great regret to us that this has happened."

"We will also be directly contacting affected individuals where necessary following this incident,” it said.

The credit union said there is also a risk that members’ information could be disclosed on the dark web.

The dark web is a part of the internet that cannot be accessed by standard search engines, and it can only be visited using highly specialised computer programs.

Information shared on the dark web is often used for criminal purposes, including financial scams.

In a statement to the Irish Examiner, the ILCU said it does not comment on matters pertaining to individual credit unions. 

However, the ILCU said cybersecurity was a "critical area" of focus, adding: " Credit unions are acutely aware of their responsibilities in managing and securing members data and are committed to maintaining strong systems and processes to mitigate against cyber threats.

"Protecting our members' data is not just a regulatory requirement. It is a core responsibility that underpins the values of the credit union movement.

"Credit unions recognise the evolving nature of cyber threats and are committed to continuously enhancing their capabilities to respond effectively and protect the trust our members place in us."

It comes as the ILCU publishes its financial results for the three months from April to June, in which it recorded "continued positive momentum" across the sector.

The representative body welcomed the credit union loan book reaching its highest level ever, with mortgage lending continuing on a strong upward trajectory. 

Credit unions issued more than 104,000 loans in the three month period, representing a 17% increase on the previous quarter. In total, €734m in new lending was issued during the period. 

The ILCU said this strong performance drove the total credit union loan book to €6.24bn, surpassing the previous record of €6.21bn set in 2008 and marking a significant milestone for the sector.

The total mortgage loan book among ILCU-affiliated credit unions reached €663m by the end of June, representing a 5% increase on the previous quarter and a 28% rise year-on-year. Mortgages now represent 10.6% of the overall loan portfolio, up from 9% in June 2024.