CU Collections

CU Collections operates as a debt collection agency that provides services to credit unions across the United States. The company’s core activity involves managing delinquent accounts on behalf of its partner credit unions, which includes contacting borrowers and arranging repayment. Its headquarters is located in the United States, positioning it to serve a national client base of credit‑union members. One publicly referenced partner is Wellspring Credit Union, for which CU Collections performed debt‑collection work prior to the 2020 incident.

CU Collections specializes in handling personally identifiable information that is typically associated with delinquent financial accounts, such as names, addresses, Social Security numbers, financial account details and driver’s license numbers. This focus on sensitive data distinguishes it from general‑purpose collection firms and requires adherence to federal and state privacy and debt‑collection regulations. The company’s operational model emphasizes secure processing of the data it receives from credit‑union partners, although a breach in February 2020 demonstrated vulnerabilities in that process. Following the incident, CU Collections engaged external cybersecurity experts, coordinated with law‑enforcement authorities, notified the affected credit unions and offered complimentary identity‑protection and credit‑monitoring services to potentially impacted individuals.

The breach, discovered on February 1, 2020, involved unauthorized access to the personal information of individuals whose accounts were being managed by CU Collections for its credit‑union clients. Wellspring Credit Union confirmed that its own internal systems were not compromised, indicating that the exposure was limited to the data held by CU Collections on its behalf. The incident prompted the company to review its security controls and to improve safeguards for the consumer data it processes on behalf of its partners. These events illustrate CU Collections’ role as a data‑processor for credit‑union debt‑collection activities and highlight the importance of robust information‑security practices in that niche.