Cyber Incident Victim: Envision Credit Union
Date:
Aug 2021
Location:
United States of America
Summary
Envision Credit Union experienced a suspected ransomware attack involving the LockBit 2.0 group, prompting an operational response including system isolation, third-party forensic investigation, and law enforcement engagement. The institution confirmed no member funds were compromised and customer-facing systems remained operational despite internal technical disruptions. LockBit's tactics typically involve network-wide encryption, extortion through operational disruption, and threats to publish stolen data unless demands are met, aligning with broader ransomware trends targeting organizational vulnerabilities. While the attack's full scope remained under investigation, the credit union emphasized ongoing efforts to safeguard member data privacy throughout the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 26, 2021, Envision Credit Union publicly addressed potential technical difficulties following indications of a cybersecurity incident. Initial reports surfaced via social media alerts from Datminr, a New York-based AI threat detection firm, suggesting the LockBit 2.0 ransomware group threatened to publish stolen Envision data by August 30. The credit union confirmed experiencing system disruptions despite maintaining extensive security measures, characterizing the situation as an "event" without explicitly confirming ransomware. Response actions included immediate isolation of impacted systems, engagement of third-party computer forensic specialists to investigate the incident's nature and scope, and formal notifications to law enforcement agencies. Envision assured members that no customer funds were compromised and emphasized that member-facing computer systems remained operational throughout the incident.
LockBit 2.0 ransomware, identified as the potential threat actor, operates as a self-propagating malware designed to automatically identify high-value targets, spread across networks, and encrypt accessible systems. According to cybersecurity firm Kaspersky, LockBit attackers employ tactics including operational disruption through system encryption, financial extortion for decryption keys, and data theft with threats of public leakage to pressure victims. This incident occurred amid a documented global surge in ransomware attacks, including the May 2021 Colonial Pipeline attack by DarkSide that disrupted US fuel distribution. Envision's containment strategy focused on protecting member account privacy while restoring isolated systems, with no evidence suggesting unauthorized access to financial assets or customer transaction platforms. The credit union disseminated identical incident details to both media inquiries and its membership base during the initial response phase.