Charter Oak Federal Credit Union pulls online banking offline after attack

Charter Oak Federal Credit Union, a Waterford, Connecticut institution with roughly 80,000 members and about $1.5 billion in assets, shut down its public website and its online banking platform on the afternoon of Friday, July 14, 2023 after detecting unusual activity on its systems.

Chief executive Brian Orenstein said the credit union's IT team and outside security specialists acted immediately to protect member data. With online access unavailable, members were left with branches and telephone banking. The FBI and the National Credit Union Administration were notified.

While the systems were down, fraudulent websites imitating charteroak.org appeared and may have collected login credentials from members who mistook them for the real site. The credit union urged members not to enter credentials anywhere other than its own domain, offered password resets and said it would refund fees caused by the outage.

Online banking was restored on the evening of July 19, ending a five day outage. In a later account, Charter Oak said attackers had exploited a weakness in its domain name service configuration and spoofed emails, activity that led antivirus vendors to blacklist its website. The credit union engaged an incident response firm and said no member funds or member data had been compromised. It subsequently required multifactor authentication and password changes for all members.