Blog | centrexIT with 18 Years Experience in Managed IT Services

Empty credit union branch with dark computer screens

Business, Finance, IT CyberSecurityDecember 9, 2025December 9, 2025

60 Credit Unions Went Dark The Sunday After Thanksgiving. Let’s Discuss

November 26, 2023. The Sunday after Thanksgiving. Most Americans were recovering from turkey dinners and Black Friday shopping. At Mountain Valley Federal Credit Union in Peru, New York, members started noticing something was wrong. They couldn’t access their accounts. The mobile app wasn’t working. ATM transactions were failing. CEO Maggie Pope knew immediately this wasn’t a simple glitch. “This is not just an MVFCU issue,” she told local news. “It is nationwide.” She was right. Approximately 60 credit unions across America had just gone dark-all at once.

Take Our 2-Minute Security Assessment

The Invisible Target

None of the 60 credit unions were directly attacked. The ransomware hit a company most of their members had never heard of: Ongoing Operations, a cloud services provider owned by a company called Trellance. Ongoing Operations provided the technology backbone for dozens of credit unions. When they went down, every credit union that depended on them went down too. The attackers knew exactly what they were doing. Instead of attacking 60 individual targets, they hit one-and took out 60 at once.

How They Got In

Security researcher Kevin Beaumont analyzed the attack and identified the entry point: CitrixBleed, a critical vulnerability in Citrix networking equipment. The vulnerability, officially designated CVE-2023-4966, had been publicly disclosed months earlier. A patch had been available since May 2023-six months before the attack. The attackers didn’t need sophisticated zero-day exploits or nation-state resources. They just needed to find an organization that hadn’t updated its systems.

The Ripple Effect

For the affected credit unions, the timing couldn’t have been worse. Members couldn’t check balances, transfer funds, or pay bills during the critical end-of-month period. Small businesses that relied on these credit unions for payroll were scrambling for alternatives. Mountain Valley Federal Credit Union, with just 4,600 members, suddenly found itself explaining to customers why a ransomware attack on a company in another state had frozen their accounts. The National Credit Union Administration, the federal agency that oversees credit unions, confirmed the scope of the attack on December 4, 2023-more than a week after it began.

Cybersecurity professional examining network vulnerability on screen — The vulnerability that enabled this attack had a patch available for six months. Sometimes the most devastating breaches exploit the most preventable weaknesses.

The Uncomfortable Truth

Here’s what made this attack so effective: the credit unions did everything right. They chose a reputable vendor. They outsourced their technology to professionals. They trusted their provider to maintain security. But they couldn’t control what their vendor did-or didn’t do. NCUA Chairman Todd Harper had actually testified before Congress about vendor risk management just three weeks before the attack. He warned that credit unions were increasingly dependent on third-party technology providers, and that a single point of failure could affect the entire system. Three weeks later, his warning proved prophetic.

The Recovery

By December 13, 2023-seventeen days after the attack began-affected credit unions were reported to be fully operational again. But for nearly three weeks, millions of Americans had limited or no access to their money. The incident demonstrated something many organizations don’t want to think about: your security is only as good as your weakest vendor’s security.

What This Means for Your Organization

You probably don’t run a credit union. But you almost certainly depend on third-party vendors for critical business functions. Cloud services, payment processing, customer relationship management, email-the list goes on. Ask yourself: Do you know who your critical vendors are? Not just the big names, but the companies behind the companies. The vendors your vendors use. Do you know what happens if they go down? Not just an inconvenience, but completely offline. For days or weeks. Do you have any visibility into their security practices? When was the last time you asked about their patch management? Their incident response plan? Do you have alternatives? If your primary vendor disappeared tomorrow, could you continue operating?

The Lesson

The credit union attack wasn’t about credit unions being careless. It was about the interconnected nature of modern business technology. One unpatched system at one vendor can cascade into a crisis affecting millions of people. You can’t eliminate vendor risk. But you can understand it, plan for it, and make sure you’re not blindsided when something goes wrong.

Take Our 2-Minute Security Assessment

centrexIT helps San Diego organizations understand their vendor dependencies and build resilience into their technology strategy. If you’re not sure how a vendor failure would affect your business, let’s find out together.

Sources

• CNN Politics: “Ransomware attack causes outages at 60 credit unions, federal agency says” (December 4, 2023) • Cybersecurity Dive: “Dozens of credit unions confront outages linked to third-party ransomware attack” (December 4, 2023) • The Record: “60 credit unions facing outages due to ransomware attack on popular tech provider” (December 1, 2023)

Smartphone glowing with security alert notifications on nightstand at 3 AM with red digital alarm clock showing the time and hand reaching to answer

Business, Education, IT CyberSecurityDecember 5, 2025December 5, 2025

The Early AM Alert No One Answered: A Christmas Day Ransomware Attack

The week before Christmas, in the early hours of Christmas Day, a security system detected something unusual. A desktop device inside a company’s network had been compromised. Then the attackers moved laterally, reaching two domain controllers. The controllers began making suspicious connections to endpoints linked to known ransomware operations.

The security platform alerted at every stage. Every lateral movement. Every suspicious connection. Every indicator of compromise.

No one acted.

“Although the system had alerted to this activity at every stage,” the security company later reported, “the security team was under great stress during the December period and did not manage to action even these highly critical alerts.”*

The attackers waited. On Christmas Eve, after business hours, the threat re-emerged. Suspicious executables were written. Data was exfiltrated. And in the early hours of Christmas Day, while most employees were offline opening presents with their families, the ransomware payload executed.

The alerts had done their job. The coverage gap turned a detected threat into a full-scale breach.

How would your team manage this situation? Take The 3 AM Test

Office worker at desk with wall clock visible, reviewing computer screen in bright fluorescent-lit corporate office setting, illustrating the critical first hour of a network breach.

Business, Education, IT CyberSecurityDecember 3, 2025

The First 60 Minutes: What Happens When Your Network Is Breached

The Clock Starts Now

A ransomware attack doesn’t announce itself with sirens. It starts with something small-a frozen screen, an error message, a file that won’t open. By the time most organizations realize what’s happening, they’ve already lost precious time.

The first 60 minutes after a breach begins are the most critical. What happens in that window often determines whether an incident becomes a manageable problem or a catastrophic failure.

Here’s what actually happens-minute by minute-when ransomware hits an organization that isn’t prepared.

Take Our 2-Minute Security Assessment

Jackson Hospital, the site of a cyber security attack.

Business, Culture, Healthcare, IT CyberSecurityDecember 2, 2025December 2, 2025

The Hospital IT Director Who Became a Cyber Security Hero

The Call That Changed Everything

It was approaching midnight on a Sunday when the emergency room called. The charting system was down. What happened next would determine whether a 100-bed community hospital in Florida’s panhandle would become another ransomware statistic-or a story of disaster averted.

Jamie Hussey had been IT director at Jackson Hospital in Marianna, Florida, for over 25 years. That Sunday night in January 2022, he got a call from the emergency room: they couldn’t connect to the charting system that doctors use to look up patients’ medical histories.

Hussey investigated and quickly realized this wasn’t a routine technical glitch. The charting software, maintained by an outside vendor, was infected with ransomware. And he didn’t have much time to keep it from spreading.

Take Our 2-Minute Security Assessment Now >>

Robert Morris, and The Morris Worm—99 lines of code that changed cybersecurity forever.

Business, Culture, Healthcare, IT CyberSecurity, Non Profit, SecurityNovember 30, 2025November 30, 2025

The Night a Grad Student Broke the Internet (And Why Today We Celebrate National Computer Security Day)

A Curious Question, A Catastrophic Result

On November 2, 1988, at 8:30 PM, a 23-year-old Cornell graduate student named Robert Tappan Morris had a simple question: How big is the internet?

To find out, he wrote 99 lines of code—a self-replicating program designed to quietly count computers on the network. He released it from an MIT computer (to hide his tracks) and went to dinner.

By the time he got back, he’d accidentally crashed 10% of the entire internet.

The Morris Worm on Display at the Computer History Musuem — Internet Worm – decompilation:Photo courtesy Intel Free Press.

What Happened

Within 24 hours, about 6,000 of the 60,000 computers connected to the internet were grinding to a halt. Harvard, Stanford, NASA, and military research facilities were all affected. Vital functions slowed to a crawl. Emails were delayed for days.

The problem? A bug in Morris’s code. The worm was supposed to check if a computer was already infected before copying itself. But Morris worried administrators might fake infection status to protect their machines. So he programmed it to copy itself anyway 14% of the time—regardless of infection status.

The result: computers got infected hundreds of times over, overwhelmed by endless copies of the same program.

“We are currently under attack,” wrote a panicked UC Berkeley student in an email that night.

VAX 11-750 computer at the University of the Basque Country Faculty of Informatics in 1988 — A VAX 11-750 at the University of the Basque Country Faculty of Informatics, 1988—the same year the Morris Worm struck. VAX systems running BSD Unix were primary targets. Photo: Wikimedia Commons

The Aftermath

The Morris Worm caused an estimated $100,000 to $10 million in damages. Morris became the first person convicted under the Computer Fraud and Abuse Act, receiving three years probation, 400 hours of community service, and a $10,000 fine.

But here’s the thing—Morris didn’t have malicious intent. He genuinely just wanted to measure the network’s size. His creation accidentally became the first major wake-up call for internet security.

The incident led directly to the creation of CERT (Computer Emergency Response Team) and sparked the development of the modern cybersecurity industry. The New York Times even used the phrase “the Internet” in print for the first time while reporting on it.

Why November 30th?

In direct response to the Morris Worm, the Association for Computing Machinery established Computer Security Day just weeks later. They chose November 30th specifically—right before the holiday shopping season—because cybercriminals love exploiting busy, distracted people.

That advice is even more relevant 37 years later.

The 1977 Trinity: Commodore PET, Apple II, and TRS-80 - Byte Magazine — The “1977 Trinity”: Commodore PET, Apple II, and TRS-80. Byte Magazine retrospectively named these three computers the pioneers of personal computing. When the Morris Worm struck in 1988, most people had never heard of “the internet.”

1988 vs. 2025: A Quick Comparison

Consider how things have changed:

Then: 60,000 computers connected to the internet.
Now: Over 15 billion devices.

Then: Total damage from Morris Worm: $100K-$10M.
Now: Average cost of a single data breach: $4.44 million.

Then: Attack motivation was curiosity.
Now: 97% of attacks are financially motivated.

Yet some things haven’t changed. The Morris Worm exploited weak passwords and unpatched systems—the same vulnerabilities that cause most breaches today.

ARPANET network map from 1977 showing the entire internet as just a handful of connected institutions — The entire internet in 1977—just a handful of connected institutions. By 1988, this had grown to 60,000 computers. Today: over 15 billion devices. Source: Wikimedia Commons (Public Domain)

What This Means for You

Computer Security Day isn’t just history—it’s a reminder that the basics still work:

• Multi-factor authentication stops 99.9% of account compromises
• Regular, tested backups can save your business from ransomware
• Employee training dramatically reduces successful phishing attacks

And yes—the holiday season really is prime time for attacks. Stay vigilant through January.

One More Thing

Robert Morris never went to prison. After completing his sentence, he co-founded Y Combinator (the startup accelerator behind Airbnb, Dropbox, and Reddit) and became a tenured professor at MIT—the same school where he launched his infamous worm.

In 2015, he was elected a Fellow of the Association for Computing Machinery—the organization that created Computer Security Day in response to his attack.

The lesson? The person who exposed the internet’s greatest vulnerabilities is now part of the establishment working to secure it. Threats evolve. Defenses must evolve too.

The question is: will yours?

Take Our 2-Minute Security Assessment →

CentrexIT has been protecting San Diego businesses since 2002. Questions about your security? Let’s talk.

Software engineer copying proprietary code into ChatGPT browser window on desk, unaware of data leakage to external servers.

Business, Healthcare, IT CyberSecurity, Non Profit, SecurityNovember 25, 2025

The ChatGPT Confession: How Your Employees Are Accidentally Leaking Proprietary Data to AI

Your employees aren’t trying to sabotage your company. They’re just trying to be productive.

A Google engineer copies a few lines of proprietary code into ChatGPT to debug a problem. A Samsung employee pastes semiconductor design specifications into a prompt, asking the AI to help optimize performance. A healthcare administrator shares a de-identified patient dataset (they think) to train an AI model for internal use. A financial analyst includes client account numbers in a spreadsheet she uploads to an AI tool for analysis.

<< Schedule your Cybersecurity Risk Assessment today >>

The Video Call Requesting Money—That Wasn’t Real

A finance manager at a multinational company joins what appears to be a routine video conference. On screen: the CFO and several other executives. They need urgent approval for a $25 million transfer. The faces are familiar. The voices match. The urgency seems reasonable.

The transfer is approved. Days later, the company discovers the truth: every person on that video call was an AI-generated deepfake. The $25 million is gone.

This isn’t a hypothetical scenario. It happened in 2024. And according to Keepnet Labs research, more than 10 percent of companies have now experienced attempted or successful deepfake fraud, with losses from successful attacks reaching as high as 10 percent of annual profits.

For healthcare organizations, life sciences companies, and nonprofits operating on tight margins, you’re not immune. You’re actually more vulnerable.

<< Schedule your Cybersecurity Risk Assessment today >>

Insider Threats: The Security Risk Living Inside Your Organization

You’ve secured the perimeter. You’ve hardened your network. You’ve implemented sophisticated threat detection. You’re protected.

But what about the threats already inside your organization?

Insider threats represent one of the most damaging and least understood cybersecurity risks. They’re not always malicious. They can be negligent employees, disgruntled team members, or sophisticated bad actors embedded within your organization.

The financial impact is staggering: insider threats cost organizations an average of 15.38 million per incident—more than twice the cost of external breaches.

And the worst part? Most organizations have minimal detection and prevention capabilities.

<< Schedule your Cybersecurity Risk Assessment today >>

Supply Chain Security: Your Weakest Link Is Killing You

You’ve invested heavily in your own security. You have firewalls, endpoint protection, and a strong incident response team. You’re protected.

Then a vendor you work with gets breached, and your organization becomes the next victim.

Supply chain attacks have become the preferred method for sophisticated threat actors. Why? Because it’s easier to compromise a smaller vendor than attack a hardened enterprise directly. Vendors become the backdoor into your organization, and by the time you discover the compromise, the damage is already done.

<<Schedule your Cybersecurity Risk Assessment today and take control of your supply chain security strategy.>>

Beyond Backups: Building a Ransomware Recovery Plan That Actually Works

Ransomware attacks have evolved. They’re no longer just about encryption and extortion. Modern ransomware campaigns combine encryption, data exfiltration, and multi-stage attacks designed to maximize pressure and financial extraction.

And yet, most organizations have no documented recovery plan specific to ransomware scenarios.

The assumption is simple: “If we have backups, we can recover.” The reality is far more complex—and far more dangerous.