How Would Your Credit Union Respond to a Ransomware Attack Tomorrow Morning?

October is Cybersecurity Awareness Month.

So here’s a question I’d like every credit union CEO, COO, board member, and technology leader to think about:

What would happen if your credit union was hit by ransomware tomorrow morning?

Not theoretically.

Tomorrow.

It’s 8:07 a.m.

Employees are arriving.

Members are calling.

Someone reports that files won’t open.

A few minutes later, another employee reports the same problem.

Then somebody sees a ransom message.

What happens next?

Who gets called?

Who makes decisions?

Can you still serve members?

Can you recover your systems?

And perhaps most importantly:

Has your credit union practiced any of this before?

Cybersecurity Awareness Month shouldn’t only be about preventing cyberattacks.

It’s also an opportunity to make sure your organization is prepared when prevention doesn’t work.

Because no cybersecurity program can promise that nothing bad will ever happen.

Strong organizations prepare for that reality.

1. Know Who Makes the First Call

The first few minutes of a ransomware incident can be confusing.

Employees shouldn’t have to figure out what to do on their own.

Your incident response plan should clearly explain how employees report a suspected cybersecurity incident and who needs to be contacted.

That may involve:

• Internal IT
• Executive leadership
• Your managed technology provider
• Cybersecurity specialists
• Compliance
• Legal counsel
• Cyber insurance resources

The exact response depends on the incident.

But the process shouldn’t begin with:

“Does anybody know who we’re supposed to call?”

Make sure contact information is current.

And make sure it’s available somewhere other than the systems that might be unavailable during the attack.

2. Contain the Problem Before You Rush to Fix It

When something breaks, our natural reaction is to fix it.

Ransomware can require a different mindset.

Before everyone starts rebooting computers, deleting files, restoring systems, or making changes, your technical and incident-response professionals need to understand what is happening.

Which systems are affected?

Which accounts may be compromised?

Is suspicious activity continuing?

Could other systems be at risk?

The appropriate technical team may need to isolate affected devices, accounts, or systems while preserving information needed to understand the incident.

This is where preparation matters.

During an attack, people should be following an established process—not improvising one.

3. Decide Which Systems Matter Most

Here’s a question every credit union should answer before ransomware ever appears:

Which systems have to come back first?

During an emergency, everything feels important.

But everything can’t be priority number one.

Your recovery plan should identify critical systems and services.

Depending on the credit union, those may include:

• Core banking access
• Network infrastructure
• Employee identity systems
• Microsoft 365
• Teller operations
• Critical file systems
• Internet connectivity
• Member-facing services

Leadership, operations, and technology should agree on those priorities before the crisis.

If five departments all believe their system gets restored first, you don’t really have a recovery priority.

You have five opinions.

4. Know Whether Your Backups Can Actually Recover the Business

I’ve said this before, and I’ll probably keep saying it:

A backup is not the same thing as recovery.

Seeing a green “backup successful” notification every morning is reassuring.

But it doesn’t answer the question that matters during ransomware:

Can we get the credit union operating again?

Ask:

When did we last restore critical data?

When did we last test recovery of an important system?

How long did recovery actually take?

Who has access to the backup environment?

Are backups protected appropriately from problems affecting production systems?

What happens if the primary environment isn’t immediately usable?

You don’t want the first serious recovery test to happen during a real ransomware attack.

5. Plan How You’ll Communicate

There’s another part of ransomware recovery people sometimes forget.

Communication.

What happens if email isn’t available?

How does leadership communicate?

How do employees receive instructions?

How does the incident response team coordinate?

Who keeps the board informed?

Who handles questions from members?

Who is authorized to communicate externally?

You may have excellent technical people working on recovery, but if everybody else is operating on rumors and incomplete information, the situation becomes harder.

Your incident response and business continuity plans should include alternative communication methods.

Don’t assume your normal communication tools will be available.

6. Know Your Vendors Before the Emergency

A ransomware attack can quickly become a vendor-management exercise.

Your technology provider may be involved.

Cybersecurity specialists may be needed.

Your cyber insurance resources may have procedures to follow.

Critical software vendors may need to assist.

Legal and compliance professionals may need to provide guidance.

That’s why you should know these relationships before the incident.

Ask:

Who do we call?

Who has authority to engage them?

What are their responsibilities?

Where is their contact information?

You don’t want your CEO searching through old emails for a vendor’s emergency number while systems are unavailable.

7. Practice With a Tabletop Exercise

One of the best ransomware preparedness exercises doesn’t require shutting down a single server.

Put the right people around a table for 60 to 90 minutes.

Then say:

“It’s 8:07 Monday morning. Employees can’t open files, several computers display a ransom message, and member service is beginning to be affected. What do we do?”

Walk through the situation.

Who makes the first call?

Who leads the response?

What gets isolated?

How do you communicate?

Which systems are critical?

When do outside professionals get involved?

Can you access your incident response documentation?

What happens if the outage lasts the entire day?

The purpose isn’t to embarrass anyone.

It’s to discover gaps while the room is calm.

A Simple Ransomware Readiness Framework: READY

During Cybersecurity Awareness Month, I like giving leadership something simple to remember.

Think READY.

R — Recovery

Can we restore critical systems and data?

E — Escalation

Does everyone know when and how to report an incident?

A — Access

Are accounts, administrative privileges, and backup systems appropriately protected?

D — Decisions

Do we know who has authority to make important decisions during the incident?

Y — Your People

Have employees, leadership, and appropriate partners practiced what they’re supposed to do?

Recovery. Escalation. Access. Decisions. Your People.

If you’re uncertain about one of those five areas, you’ve found something worth discussing.

Five Questions for Your Next Board Meeting

Your board doesn’t need to know how ransomware encryption works.

But it should understand whether the credit union is prepared.

This Cybersecurity Awareness Month, ask:

1. When did we last test recovery of a critical system?

2. How long would it take us to restore essential operations?

3. Who leads our response to a serious cyberattack?

4. When did we last conduct a ransomware or incident-response tabletop exercise?

5. What is our biggest ransomware recovery weakness today?

Those five questions can create a much more useful cybersecurity discussion than another dashboard full of green boxes.

Final Thoughts

The goal of ransomware preparedness isn’t to predict exactly how an attack will happen.

You can’t.

The goal is to make sure a bad day doesn’t become complete chaos.

Know who to call.

Know what’s critical.

Protect your accounts.

Protect your backups.

Test recovery.

Prepare alternative communications.

Coordinate your vendors.

Practice your response.

And make sure leadership understands the plan.

Cybersecurity Awareness Month gives us a reason to talk about ransomware.

But ransomware preparedness needs to continue after October ends.

Because when an attack happens, your members aren’t going to ask whether your backup software was installed correctly.

They’re going to want to know:

Can my credit union still serve me?

That’s why ransomware preparedness isn’t simply an IT issue.

It’s a business continuity issue.

It’s a leadership issue.

And ultimately, it’s a member-trust issue.

Would Your Credit Union Be READY Tomorrow Morning?

You shouldn’t have to experience a ransomware attack to discover whether your recovery plan works.

At CTG, we help credit unions evaluate cybersecurity, ransomware preparedness, backup and disaster recovery, business continuity, Microsoft 365 security, identity protection, incident response, vendor coordination, and long-term technology strategy.

For more than 26 years, CTG has helped organizations prepare for technology problems before they become emergencies, backed by a team with more than 200 years of combined experience.

Our vendor-agnostic approach means we start with your organization’s risks, operations, and recovery requirements—not with a product we’re trying to sell.

This Cybersecurity Awareness Month, ask your leadership team:

If ransomware hit us tomorrow morning, are we confident we could respond and recover?

If you’re not completely comfortable with the answer, that’s a conversation worth having now.

Talk with CTG

Phone: 330-655-8144
Email: brett.harney@ctgusa.net
Website: ctgusa.net

Let’s test the plan, find the gaps, and make sure your credit union is READY before you need to be.