SCU probes security breach

Hey there, time traveller!
This article was published 16/11/2024 (505 days ago), so information in it may no longer be current.

WINNIPEG — Tuesday morning was so quiet at Steinbach Credit Union that workers knew something was wrong.

Hours later staff learned that calls to its contact centre were being rerouted — it’s still unclear where — to an unauthorized third party.

Chief executive Glenn Friesen said it had been silent for nearly 24 hours.

“We take this incredibly seriously,” Friesen said. “Our member security is very, very paramount to us.”

Members’ names, phone numbers and call dates may have been compromised, the credit union stressed. It’s unclear whether there has been more damage; the investigation is ongoing.

“If a member called and spoke to the individual, they may have provided more information. We’re looking into all of those circumstances right now,” Friesen said, noting there’s a possibility callers gave sensitive banking information.

Steinbach Credit Union, which has 110,000 members, had kept its branches and member contact centre closed Monday for Remembrance Day.

An internal investigation found that a “bad actor” had likely got SCU’s telephone provider to change its member contact centre phone number, Friesen said. He declined to reveal the name of the provider.

Beginning Monday around 10:15 a.m., customers who called the centre did not reach a SCU representative; instead, they reached an unauthorized third party, Friesen explained.

The phone number was changed back and re-secured around 10 a.m. on Tuesday.

Friesen said SCU is working with its supplier to determine the cause of the incident. It’s most likely human error, he stated.

Friesen wouldn’t reveal how many members’ calls were affected by the incident. Since it was a holiday, the number was “very low” compared to a typical Monday.

Friesen wouldn’t give a firm date regarding how long the investigation by SCU and its telephone service provider would last. It’s “too early” to determine whether SCU will keep using its telephone service company, he said.

“We’re doing everything in our power to … fix (this) and make sure it never happens again.”

Friesen said SCU has filed a police report. Neither the Winnipeg Police Service nor the Steinbach RCMP received a report of the kind, spokespeople said.

When asked again, SCU communication director Stephanie West said the credit union couldn’t comment further due to the active investigation.

Bell MTS confirmed it is not the credit union’s service provider.

RCMP Sgt. Paul Manaigre said SCU customers may have inadvertently given their banking information to a fraudster.

Manaigre encouraged people who’ve been victimized by financial fraud to contact police. He wasn’t aware of recent reports similar to SCU’s case.

Winnipeg police have marked a year-over-year increase in fraud reports for the past three years. Police clocked 4,368 cases in 12 months, ending in August 2024.

“It always comes down to process and procedure,” said Jason Kolaski, owner of computer support company Constant C Technology Group.

If an organization wants to change its phone number, it’s a good idea to get confirmation with several staffers before taking action. Security is increasingly difficult for companies because of interdependence and the digital age, Kolaski explained.

“Even though … the business itself is doing a good job with security … it could be one of their vendors that’s having the issue,” he said. “Your vendors that you use, their security is becoming your problem.”

Scams change quickly and it’s difficult to keep up, Kolaski said.

For example, voice recognition is no longer useful because criminals can mimic their target’s voice through artificial intelligence.

Kolaski recommended two-factor authentication. Financial services customers who feel uncomfortable while on a banking phone call can give a wrong PIN or password — if the banker says it’s wrong, it’s a sign the institution is legitimate, Kolaski said.

» Winnipeg Free Press