DUBLIN — Nine different cases against Patelco Credit Union have been consolidated in Alameda County Superior Court following the massive ransomware attack on the company earlier this year.
Nine plaintiffs are suing the Dublin-based company for negligence, breach of contract and good faith, violations of the California Consumer Privacy Act and other damages caused in the “massive and preventable cyberattack” suffered by the credit union this summer, according to court documents. .
Patelco first announced the attack in an email and web posting to its customers on June 29, at the same time blocking customers’ access to their online banking accounts. This prohibited anyone, even Patelco cashiers and administrators, from checking customer balances, sending or receiving online payments or even logging into their online accounts.
Throughout this two-week ordeal, Patelco continued to post updates on a dedicated website to notify customers of service updates, such as when online payments through Zelle and PayPal were available. The credit union announced that it had “stabilized” its network at the end of July, after the lockout ended on July 15.
The nine customers suing the credit union include Anand Chaudhry, Jamie Wallace, Joshua Warren, Carl Cordell, Austin Lawhead, Bradley Tanzman, Darren Van Antwerp, Darrel Adams, Wily Lee, Siobhan Gallagher, Sean McGinity and Daniel Corona, according to court records . Cordell’s case is considered the lead case, records show.
In mid-July, the courts began consolidating the nine cases from August. The group’s lead attorneys, Scott Edward Cole and Alicyn B. Whitley of the Oakland firm Cole & Van Note, wrote in court filings that the ransomware attack could have affected more than 1 million people. Patelco says it serves more than half a million customers and manages more than $9 billion in assets.
Patelco also reported $39 million in losses to the National Credit Union Association in the third quarter of this fiscal year, according to a report in the Credit Union Times, a trade publication.
Rina Johnson, a spokesperson for Patelco, confirmed to this news agency that the losses were primarily “caused by members overdrawing their accounts during the system outage.”
“For the period ended September 30, 2024, we have adequately reserved all expected losses related to the security incident,” Johnson said in a statement to the Bay Area News Group this week. However, the end result may not be resolved for an extended period of time and may be different than expected.
Johnson also confirmed that “Patelco did not pay the ransom.” When asked to specify the amount of the ransom demand, Johnson declined to comment further.
A case management conference regarding the consolidated cases is scheduled for Jan. 28 in Alameda County Court, records show. No trial date has been set.
The credit union is also being sued by a half-dozen other plaintiffs in Federal Court over the attack.
