Ransomware Attack on First Commonwealth Federal Credit Union by Meow Ransomware Group
Incident Date:
July 16, 2024
Overview
Title
Ransomware Attack on First Commonwealth Federal Credit Union by Meow Ransomware Group
Victim
First Commonwealth Federal Credit Union
Attacker
Meow
Location
First Reported
July 16, 2024
Ransomware Attack on First Commonwealth Federal Credit Union by Meow Ransomware Group
Overview of First Commonwealth Federal Credit Union
First Commonwealth Federal Credit Union, headquartered in Allentown, Pennsylvania, is a member-owned, not-for-profit cooperative financial institution. Founded in 1959, it serves over 94,000 members and businesses in the Lehigh Valley region. As the largest credit union in the area, it offers a wide range of banking services, including savings accounts, certificates of deposit (CDs), loans, and online banking. The credit union is known for its competitive rates and low fees compared to traditional banks. It also actively participates in community initiatives, such as sponsoring the giraffe exhibit at the Lehigh Valley Zoo and organizing events like the Business Clothing Drive.
Details of the Ransomware Attack
On July 16, 2024, First Commonwealth Federal Credit Union discovered that it had fallen victim to a ransomware attack orchestrated by the Meow ransomware group. The attack targeted the institution's domain, firstcomcu.org. While the exact size of the data leak remains unknown, the incident has raised significant concerns about the security of sensitive financial information belonging to its members and businesses. The credit union is currently assessing the full impact of the breach and working to mitigate any potential damage.
About Meow Ransomware Group
Meow Ransomware is a threat actor group that emerged in late 2022 and has been associated with the Conti v2 ransomware variant. The group resurfaced in late 2023 and has been highly active in 2024, primarily targeting organizations in the United States. Meow Ransomware employs various infection methods, including phishing emails, exploit kits, Remote Desktop Protocol (RDP) vulnerabilities, and malvertising. Once a system is compromised, the ransomware encrypts files using a combination of the ChaCha20 and RSA-4096 algorithms. The group maintains a data leak site where they list victims who have not paid the ransom.
Potential Vulnerabilities and Penetration Methods
First Commonwealth Federal Credit Union, like many financial institutions, holds a vast amount of sensitive data, making it an attractive target for ransomware groups. The Meow ransomware group could have penetrated the credit union's systems through several vectors, including phishing emails, exploiting RDP vulnerabilities, or using exploit kits. The cooperative model of the credit union, which focuses on member benefits rather than profit maximization, may also mean that cybersecurity investments are balanced with other priorities, potentially creating vulnerabilities.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.