Navy Federal Credit Union Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with database secured post-discovery, and third party assistance with socradar..

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Phishing portals.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Operational Metadata, Hashed Passwords, Internal Usernames, Emails, Business Intelligence Workbooks, System Logs, Database Connection Details, Financial Performance Formulas, Loan Portfolio Metrics, , Credentials, device fingerprints, geolocation and timestamps.

Third-Party Assistance: The company involves third-party assistance in incident response through SOCRadar.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by database secured post-discovery and .

Key Lessons Learned: The key lessons learned from past incidents are The incident underscores the critical importance of securing databases with encryption and authentication, even for internal or operational data. Exposure of non-customer data (e.g., internal usernames, system logs, business intelligence) can still enable targeted attacks like phishing or credential stuffing, posing significant downstream risks to both the organization and its members.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Jeremiah Fowler (Cybersecurity Researcher), and Source: SOCRadar.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Consumers Advised To Use Identity Protection Tools (E.G., Bitdefender Digital Identity Protection) And Monitor For Phishing Or Credential Stuffing Attempts. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as SOCRadar.

Last Attacking Group: The attacking group in the last incident was an GS7.

Most Recent Incident Detected: The most recent incident detected was on 2025-12-01.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2026-01-01.

Most Significant Data Compromised: The most significant data compromised in an incident were operational metadata, hashed passwords, storage locations, system logs, internal usernames, emails (plain text), Tableau business intelligence workbooks (database connection details, financial performance formulas, loan portfolio metrics), , Usernames, passwords, IP addresses, geolocation, device fingerprints and timestamps.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was SOCRadar.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was database secured post-discovery.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were system logs, emails (plain text), hashed passwords, storage locations, operational metadata, internal usernames, Usernames, passwords, IP addresses, geolocation, device fingerprints, timestamps, Tableau business intelligence workbooks (database connection details, financial performance formulas and loan portfolio metrics).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was The incident underscores the critical importance of securing databases with encryption and authentication, even for internal or operational data. Exposure of non-customer data (e.g., internal usernames, system logs, business intelligence) can still enable targeted attacks like phishing or credential stuffing, posing significant downstream risks to both the organization and its members.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Educate employees and members on recognizing phishing and social engineering attempts, especially following data exposures., Implement robust encryption and access controls for all databases, including those containing operational or internal data., Adopt tools like Bitdefender Digital Identity Protection to proactively detect and respond to identity-related risks., Monitor for exposed credentials or internal details on the Dark Web to preemptively address potential threats. and Regularly audit third-party vendors and contractors for security vulnerabilities to mitigate supply chain risks..

Most Recent Source: The most recent source of information about an incident are Jeremiah Fowler (Cybersecurity Researcher) and SOCRadar.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Resolved (database secured post-discovery).

Most Recent Customer Advisory: The most recent customer advisory issued were an Consumers advised to use identity protection tools (e.g. and Bitdefender Digital Identity Protection) and monitor for phishing or credential stuffing attempts.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Phishing portals.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was unprotected database lacking encryption and authenticationpotential third-party mishandling of sensitive data, Lack of multi-factor authentication, social engineering.