Credit Union Sues Fintech Giant Fiserv Over Security Claims
Summary: A Pennsylvania credit union is suing Fiserv, alleging that its online banking platform would let anyone reset a customer's password using only the account number and the last four digits of the Social Security number, with no rate limiting to stop automated guessing. Bessemer System Federal Credit Union, which has $38 million in assets, says it launched its own investigation after a 2018 KrebsOnSecurity report on Fiserv authentication weaknesses, and that Fiserv's subsequent fix requiring a member's house number was bypassable because some servers did not enforce the check.
What's compelling: Fiserv is the top bank core processor with more than 37 percent market share and was set to grow through a $22 billion acquisition of First Data, so the authentication flaw Bessemer describes sits under hundreds of community banks and credit unions. Bessemer's attorney says the credit union is replacing its core processing vendor to protect its members.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026