Patelco tells customers checks will be honored, but to expect delays

Update, July 2:

Patelco Credit Union announced to customers Tuesday that it is still working on fixing the impacts of a ransomware attack from Saturday. 

While the credit union’s leaders did not announce an expected timeframe for fixing the issue, they clarified some issues for customers. 

Customers can receive checks or payments initiated by other banks (such as ACH or Automated Clearing House transfers) to their Patelco accounts but should expect delays on the funds, Patelco said in an email. 

Customers can also continue to pay with checks from their Patelco checking accounts but should expect delays in debiting them.

Still, the credit union said electronic recurring transfers (including Zelle), direct deposit, and balance inquiries remained unavailable Tuesday, nearly four days after the ransomware attack. 

Debit and credit card transactions were  functioning in “a limited capacity,” the Patelco email noted, telling customers that “ACH transfers or bill payments established with your Patelco account will not be processed.”

Patelco leaders assured customers that the credit union will reimburse late fees resulting from the issue, and they will write letters for customers concerned about late payments impacting their credit scores.

The credit union also said it would waive any Patelco overdraft, late or ATM fees until they have fixed the security breach. 

“Additional details on how to request this support will be available soon,” they noted in the email, directing customers to a website that provides updates on the ransomware attack. 

Original, July 1:

Patelco ransomware attack leaves customers unable to pay bills or access their money

A security breach at one of the Bay Area’s leading credit unions left East Bay residents scrambling, unable to access much of the money in their accounts and unsure whether their scheduled payments would be processed.

Patelco Credit Union, which is based in Dublin and has locations in Oakland and Berkeley, announced over the weekend in an email to customers that a “serious security incident” on Saturday forced the credit union to shut down its online banking and mobile app functions. Customers could not make payments, receive funds through direct deposit or transfer money.

In a statement issued Monday afternoon, Patelco’s vice president of marketing, Rina Johnson, confirmed to Berkeleyside that the security breach was a ransomware attack.

“Unfortunately, this incident has required us to proactively shut down some of our day-to-day banking systems in order to contain and remediate the issue,” Johnson said, adding that members can still access cash from ATMs but not clarifying whether there is a limit to what they can withdraw.

“We have engaged a leading third-party cybersecurity forensic firm to help us to investigate and recover as soon as possible,” Johnson continued. “Please know that our team and third-party partners are working around the clock to get back up and running. We are committed to providing transparent and frequent updates to best of our ability as well as the best possible service that we can, given the disruption.”

Johnson also provided a link to a new site Patelco created to provide security updates, noting it would be live sometime on Monday afternoon.

Patelco customers concerned about bills to pay, income

Basic banking functions were still unavailable around 2 p.m., leaving many Bay Area residents unsure whether they could pay important bills or receive needed income.

“My mortgage payment would have gone through today, but I’m not sure when it will happen,” said Albany resident Marina Bukowski, who banks at the Berkeley location of Patelco on Kala Bagai Way, on Monday morning. “I’m just waiting and hoping my credit isn’t ruined.”

Meanwhile, an Oakland woman who declined to give her name sat on a bench outside the Berkeley branch after checking in with the credit union. She said she received an email over the weekend informing her of the security breach, just as she was expecting a deposit on Saturday to cover her rent and other bills. Like others, she could not access her account and was told she could only withdraw $500.

The woman said she was “very concerned” and has contacted family and friends to help her until she can access her funds.

In social media posts Sunday evening, Patelco, which has approximately half a million customers and nearly $10 billion in assets, told customers that its teams were still working to resolve the outage but would not provide an estimated time for when it could be fixed. 

Instead, the message advised customers to seek help at Patelco branches, its call center and its “Live Chat” function online on Monday, although it warned the wait times are longer than usual. 

“We’ll answer your questions as best we can, but we cannot provide specific information on your accounts at this time,” the message advised. “We will provide further updates as information becomes available. We know this situation is concerning, and we are committed to keeping you informed as the investigation continues.”

Many commenters on social media reported being able to only withdraw $500 per day from the ATMs or branches. 

However, the lack of information has frustrated many customers.

“I’m frustrated and anxious, and I also understand we’re in crisis mode,” Bukowski said, noting he worries that important bills will not get paid.

“I have a lot of automatic payments. I know the ATMs still work, but it’s more about ‘Will my water bill get paid? Will my PGE get paid?’”

Another Berkeley resident and small business owner who declined to be named publicly for fear of her financial information being vulnerable said she could not access her personal or business accounts.

“Today being the first of the month, I have direct deposit payments coming in, as well as bills due, including a mortgage payment,” she said. 

“As a small business owner, I will have payments coming in this week,” she explained. “I wrote two substantial business-related checks last week and have no idea if they will bounce or clear. Not knowing how this will impact my credit or people I have business or personal relationships with is challenging.”

She said she’s been reaching out to people and businesses who could be impacted by her accounts, but even that feels fraught. 

“I am trying to be proactive, to preserve the integrity of those relationships, but even sharing the information feels like I am potentially making them nervous about our financial relationship,” she explained. Plus, “I am not able to look over my monthly history to check to make sure I contacted all parties who receive automatic payments from me at the end or beginning of the month.”

Across social media, where Patelco has issued its two public announcements, customers have expressed their exasperation.

“The fact that I’m getting more updates in the comments rather than patelco themselves is sad,” said an Instagram commenter.

“Is our money still in our accounts? I’ll stop panicking when I know whatever breach didn’t take all the $$ from us,” wrote another.

The credit union’s media team did not immediately return requests for more information or comment.

Other customers were more optimistic.

“I’ve been with Patelco Credit Union since 1999. I’m not going anywhere,” one customer wrote on Facebook. “Honestly, stuff happens to good people and businesses alike. My money is insured. I’m not worried. I am waiting patiently for answers though.”