Well, hello there, boys and ghouls, and welcome to a new thrilling holiday tradition. The leaves are falling, the treats are being tricked, and it is time to gather around to tell the trembling tales of yesteryear. And wow, do I have goody for you! One that is guaranteed to make your spine shiver and your anxiety rise.

Yes, I am your Guide, as we stroll through the dreadful directory of credit union history mishaps. Our story is not for the faint of heart and could result in you questioning your own compliance conundrums. Tonight features a reader’s tale from a Laurie at Haddonfield Credit Union, as she recounts her colleague’s unfortunate events…

Our story begins with a fellow who reminds us of someone we all know: that one do-it-all person at the credit union. For Jason, it started off like any typical Friday. He sat down with his Nightcrawler Coffee, booted up his laptop, and was painstakingly fine-tuning his risk assessment matrix for the upcoming audit.

You see, Jason was in way over his head at the credit union. He knew some basic Bank Secrecy Act compliance, did a bit of programming, and even pulled weekday shifts at the teller desk. He was good with numbers, dependable, and he could operate his way around a spreadsheet, like the assessment in front of him. It was a monster of a matrix. Every articulable risk had been thought of: over-privileged user access, unencrypted nonpublic personal information, and even those pesky telecommunication failures. This list went on and on for another three hundred rows.

As the hours ticked by, he felt his eyes grow weary, to the point where he needed to conjure up another pot of coffee or he was going to fall asleep. That’s not all he was monitoring. Between regulatory research and answering various departments’ spooky questions about loans, Jason periodically had to check the compliance email inquiries. He clicked over to find a chilling notification hit the Compliance Folder: “PLEASE HELP: Question on Reg E(eeeeeeeeeeeeeeeek).” His heart sank. “Well, it looks like I have another mystery on my hands. Where do I begin?”

Then suddenly, his computer flickered, and the lights went out. Jason groaned, “Whoa, what gives?” As soon as he spoke those words, the power flashed back, and his screen booted back up. Bewildered by what had just transpired, he was flustered, wondering if he had saved his assessment or if he had to start all over again.

Oddly, his computer screen prompted him to enter his password on a screen he had not seen before. He typed it in: “!beetleJuice!” The computer flickered black to green, back to black, and then a new window stating, “Are you sure?” popped up. Again, he typed, “!beetleJuice!” It prompted him for a third time. “Oh my goodness, how many times do I have to type this in? It’s !beetleJuice!.”

The computer went dark once again, and then his desktop illuminated back to normal. “That was strange,” he thought, “where is the multifactor authenticator? That is not how I normally log in, but oh well.” As everything was back in running order, he booted up his spreadsheets and his agentic artificial intelligence, Halford. After those got rolling, he opened up his cloud storage service. What he found next shocked him to his core.

The alarms were going off in his head. “What had happened to all the audit logs and security clearances?” he asked. “Where did the penetration testing notes go? What about the member data about loan repayment history?” His heart sank. He looked further and could not find his precious risk assessment either.

This is where things began to spiral for him. Afraid that he might have lost all his compiled data, he frantically went to Halford and feverishly started typing away. He uploaded files that he had saved from past audits and inputted them into his A.I. program to try to see if he could replicate some documents he had lost. He even took member loan data and asked AI if it could create a dataset to extract delinquent consumers.

Hours flew by, and he was like a madman in some sort of trance, trying to recreate the files that he lost, typing so loudly that it disturbed his coworkers. It was not until his counterpart Nancy walked into his office and noticed how hastily he was typing that he stopped in his tracks.

“What is going on in here?” she asked. Jason chronicled his entire catastrophe from signing into his workstation to the hectic attempt to replicate his work with AI. “Oh no,” Nancy murmured, “did you get the memo to your email about the phishing attack after the power went off?”

“What memo?”

After those two cold words were uttered, Nancy walked Jason through everything that happened. There had been a security breach that was part of the power failure at the credit union. Immediately, Sidney, the Risk Manager on site, had sent out an emergency email to the entire staff, urging them to reboot their computers before signing in and reminding everyone about the multifactor authenticator codes that were linked to their key fobs.

There was a nefarious phishing scheme going around, and devious hackers were trying to social engineer passwords for company servers. She reminded him that, per the disaster recovery plan that was in place, Haddonfield Credit Union employees were supposed to restart their computers every Thursday so that data automatically saved to their cloud service.

“I thought it was once a month, and I thought I could use AI for anything,” Jason mumbled.

With great annoyance in her voice, Nancy shrieked, “Double no! And we are going to have to make a call to see how we can fix this.”

“Who you gonna call?” he shouted.

“The IT Department, Jason! That is standard operating procedure. Do you even watch the employee security videos? You co-wrote the policy on AI too! You should know better.”

Nancy offered her best advice and tried to assist in this nightmare situation. Swiftly, they reset his passwords and did a scan for malicious malware within his email. Then, they worked on a plan to try to recover documents that had been lost on the cloud server and reviewed their vendor agreement with Halford to see how they could sanitize the nonpublic information from their application.

They even answered that frightful Reg E request; that was somehow scarier than this whole order. However, the dastardly deed had already been done, and Jason had made some grave mistakes.

“Oh, and one more thing, Jason. Find Laurie; she is the final one to talk to. She is an expert in making it out alive of these disasters.”

Jeepers! What a fantastically foul little story that was for all of us. There are so many components that can go horribly wrong for our financial institutions if they do not follow proper protocols while in a precarious position. I hope our readers know never to put nonpublic private information into any artificial intelligence.

Moreover, creating a sound AI Policy that reinforces the protection of our most valuable and personal data is paramount. Couple that policy with educational enforcement with your staff so that you can safeguard against unsuitable uses of powerful technology. And consistently have a disaster recovery plan, with backup capabilities, when the power goes out and things go bump in the night.

Remember, the devil is always in the details. Embrace the camp that follows this time of year and stay spooky! Until next time, my friends.