1. Data Breach Overview Mike Schenk, VP Research and Policy Analysis
Credit Union National Association

2. MERCHANT DATA BREACHES
Merchants do not follow strong data security requirements like credit unions
Financial institutions, including credit unions, are subject to strict data security standards under the Graham-Leach-Bliley Act (GLBA). Retailers are not.
All who hold personal data should be subject to strong federal security requirements.
Congress should pass legislation that would impose data security standards on merchants to protect consumers and reduce criminal access to financial information.
Nearly 60% of consumers expect to be a victim of data breach at some point

3. AMERICAN CONSUMERS NEED PROTECTION
STRONG NATIONAL DATA PROTECTION
STRONG NATIONAL DATA PROTECTION
and consumer notification standards with effective enforcement provisions are needed to ensure sensitive data is protected.
RECOGNITION OF ROBUST PROTECTION
and notification standards that credit unions and banks are already subject to.
PREEMPTION OF INCONSISTENT STATE LAWS
and regulations in favor of strong federal data protection and notification standards.
ABILITY OF CREDIT UNIONS AND BANKS TO INFORM
members and customers about a breach, including where it occurred.
SHARED RESPONSIBILITY
for all those involved in the payments system for protecting consumer data. The costs of a data breach should ultimately be borne by the entity that incurs the breach.

6. Data exposed in 2017 breaches:
53% exposed SSNs
19% exposed Debit card/Credit card
37% exposed unknown records

7. CREDIT UNIONS HIT HARD: TWO EXAMPLES
Target Data Breach
12/19/13: Target data breach announced (~41 million cardholders)
CUNA survey: 1,112 responding credit unions by 2/5/14
Estimated 5.4 million CU debit and credit cards affected
$30.6 million total costs in first 2.5 months
Primarily card reissuance & administrative expenses
Call volumes up by 25%+ at 37% of credit unions
Nearly 40% report increasing staffing as a result
Excludes any fraud losses after initial 2/5/14
Home Depot Data Breach
9/18/14: Home Depot data breach announced (~50 million cardholders)
CUNA survey: 544 responding credit unions by 10/29/14
Estimated 7.2 million CU debit and credit cards affected
$57.4 million total costs in first 1.5 months
Primarily fraud and card reissuance expenses
Call volumes up by 25%+ at 21% of credit unions
Excludes any fraud losses after initial 10/29/14