This week, CU Solutions Group (CUSG) notified its 275 credit union web services clients that use CUSG’s proprietary content management system (CMS) that a temporary vulnerability was discovered and promptly remedied on October 28, 2023.
The vulnerability was identified by LMG Security, a cybersecurity consulting firm on October 26, 2023, and was immediately remedied by CUSG within 48 hours. CUSG was able to make the fixes independently without client impact or exposure.
Credit union industry trade press/news media was being notified since LMG Security published a security statement that may have been noticed and/or published by certain news media outlets. However, news reports failed to state that CUSG had immediately taken remedial action without client impact.
CUSG has notified LMG Security of that omission and asked that LMG Security clarify this for their readers.
Similar to other technology services providers, CUSG conducts regular audits, engages outside consultants, and relies on numerous partners to assure that all of its products minimize security risks for CUSG clients. Again, in this case, these continuous processes are an example of those efforts being successful.
What Clients (Credit Unions) Can Do
While the risk is minimal, CUSG recommends that affected clients update their authenticated CMS access passwords to reinforce security.
Additionally, for any CU Solutions Group CMS clients not currently using multi-factor authentication for CMS backend access, CUSG strongly encourages them to reach out to CUSG to have this important security protocol enabled.
CUSG remains committed to the security of our systems and the protection of your data. While there was no known breach, CUSG believes transparency is paramount and wanted to communicate this incident to clients.
If your credit union has any questions or concerns, please do not hesitate to contact CUSG. CUSG appreciates your understanding and continued support.
