Analyst assessment
A ransomware attack detected June 29, 2024, forced Patelco Credit Union to disable banking systems and disrupted members’ access to accounts and transactions. Its July 1 CEO notice explicitly confirmed ransomware. The California regulator later imposed a $100,000 cybersecurity penalty; that was a regulatory sanction, not a ransom payment.
The consent order identified weaknesses in risk management, security controls, business continuity and internal audit. Patelco agreed to strengthen its cybersecurity program and retain an independent consultant without admitting or denying the regulator’s findings. The remediation requirements do not establish that banking services remained unavailable.
A court order filed July 1, 2026 granted final approval to a $7.25 million class settlement over alleged failures to protect personal information. The settlement fund includes fees and administrative costs; it is separate from the regulatory penalty and does not establish a ransom payment.
Patelco’s breach notice filed with California’s attorney general places initial network access on May 23. The later intrusion finding does not move the visible banking outage into May. Cyber involvement and operational disruption are confirmed; the reviewed notices do not identify the initial access method or responsible operator.
Operational significance
The June 30 CEO message described unavailable online banking, the mobile app, contact-center functions and electronic transactions. Card use was limited, while ATMs offered an alternative. Members could not reliably view balances, move money or use normal payment channels.
Patelco’s July 1 clarification distinguished transactions initiated elsewhere from transfers or bill payments initiated through Patelco. Externally initiated ACH items and written checks could continue processing, with delayed posting; some Patelco-initiated services remained unavailable. Branches and contact-center staff were assisting members, with longer waits. This was a major partial banking disruption, not proof that all transactions stopped or member funds disappeared.
The credit union offered fee relief and help with late-payment consequences. Original NBC Bay Area reporting described members unable to see account information or make needed transfers. Fears about rent, mortgage and business payments explain the disruption’s practical consequences; they do not establish that every anticipated payment was missed.
Patelco’s newsroom confirms core banking services and transactions returned July 15. That milestone ended the major loss of digital banking access, but did not establish restoration of every feature. The incident information center records residual limitations, including unavailable electronic statements in the July recovery plan and PrizeOut access as of August 12.
The same information center’s service table lists services as available effective March 3, 2025. The incident is resolved, but the exact date when the final remaining function returned is unverified. August 12 is the latest dated concrete remaining limitation identified in this pass; the later service table supplies a recovery bound rather than evidence of continuous impairment throughout the interval.
An original June 29 public outage post supports first public observation. The June 30 serious-security-incident message preceded the explicit July 1 ransomware confirmation. The later August data finding and February 2025 enforcement action are separate milestones, not new outage dates.
Confidence and uncertainty
The attorney general’s sample notice confirms unauthorized access to databases containing personal information, with review completed August 14. Potential information varied by individual and included identity and contact details. Patelco said the specific data accessed was not determined and offered two years of identity-protection services. Database access does not independently verify a particular leak-site dataset or its size.
An existing ransomware.live claim lists www.patelco.org under RansomHub. Native metadata records discovery August 16, 2024; this is not an original posting date or proof that RansomHub caused the outage. Patelco’s assertion that member funds were not lost is distinct from the confirmed information-access incident.
Analytic gaps
The initial access method, encryption details, original leak contents, ransom amount and payment remain unverified. The exact final-restoration date is unknown.
