Credit Union Cybersecurity Statistics 2026: 55% of Credit Unions Do Not Enforce DMARC, Five Years After NCUA Urged It

These credit union cybersecurity statistics come from our own measurement, as of November 11, 2026: we took the website address every federally insured credit union reports to NCUA on its June 30, 2026 Call Report and checked the public DNS and homepage of each. Of 3,730 credit unions measured, 55% do not enforce DMARC, the email setting that stops criminals from sending mail as the credit union. The 45% that do enforce it serve 80% of members.

The asset-band ladder: DMARC policy by credit union size

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a DNS record at _dmarc. plus the domain. With p=quarantine or p=reject, receiving mail servers are told to junk or refuse messages that claim to come from the credit union but fail authentication. With p=none, or no record, a spoofed message is delivered like any other. The share of credit unions that enforce rises at every step of the asset ladder:

Each bar is 100% of measured credit unions in the band (total assets on the June 30, 2026 Call Report). Right-hand figure: quarantine plus reject. 7 domains with malformed or duplicate DMARC records are counted as having no valid record.

Under $10 million in assets, 35% of credit unions publish any DMARC record and 15% enforce one. Between $100 million and $500 million, enforcement reaches 55%; from $1 billion to $10 billion, 78%, and 46% of that band use p=reject. 64 enforcing domains apply the policy to only part of their mail through a pct value below 100. Among domains with any DMARC record, 70% ask for aggregate reports (a rua address), the feed an administrator needs before tightening the policy.

DNS columns are shares of measured domains; web columns are shares of homepages reached (3,503 in total). Web shares count every homepage reached, so a site whose TLS handshake we did not see lowers the TLS 1.3 column.

By membership size

Counting people rather than institutions changes the picture. 1,480 credit unions have fewer than 2,500 members, and 23% of those measured enforce DMARC. Of the 100 credit unions with 250,000 members or more, 87% enforce, 63% at p=reject.

Charter type matters a little: 51% of federally insured state-chartered credit unions enforce DMARC against 42% of federal credit unions. The low-income designation makes almost no difference (47% vs 43%).

Provider split: who receives credit union email

We classified each domain by the host in its lowest-preference MX record, the same method as our Microsoft 365 market share census. Bars show the share of measured domains; the right-hand figure is the DMARC enforcement rate inside each group.

Gateway customers enforce DMARC more often than credit unions that point MX straight at Microsoft 365 (56% vs 51%), but that gap is mostly size: gateways are more common at larger credit unions. Inside the single $100 million to $500 million band, 55% of gateway domains and 59% of Microsoft 365 direct domains enforce. A filtering service on inbound mail does nothing to stop someone spoofing the credit union’s own domain to members; only the domain’s DMARC policy does that. Credit unions on Google Workspace (15%) and on their own mail servers (21%) enforce least. 184 domains publish no MX record at all, and 11% of them have an enforcing DMARC record, although a domain that never sends mail can safely publish p=reject.

Credit union cybersecurity statistics by state

The map and table show the share of measured credit unions enforcing DMARC by mailing-address state. States with fewer than 10 measured credit unions are not shown, so that no single institution can be identified. Among the five states with the most credit unions, Texas sits at 42%, Pennsylvania at 29%, New York at 37%, California at 57% and Illinois at 38%.

Filter by state name, or click a column heading to sort.

HTTPS and HSTS cells need at least 10 homepages measured in the state. “n<10” marks a suppressed cell.

Website transport security: HTTPS, TLS 1.3 and HSTS

On November 11, 2026, for each credit union website, we made one homepage request starting at the plain http:// address and followed redirects that stayed on the credit union’s own domain. That single request shows whether the site moves visitors to HTTPS, which TLS version the server negotiates with a current client, and whether it sends a Strict-Transport-Security (HSTS) header telling browsers never to use plain HTTP again (RFC 6797).

95.7% of the 3,503 homepages we reached send HTTP visitors to HTTPS. Of the sites where we saw the TLS handshake, 94% negotiated TLS 1.3 and 6% TLS 1.2. 54% send an HSTS header, 38% with a lifetime of at least one year, and 15.8% include the preload flag. 15 sites presented a certificate our client could not validate, and 90 still serve their homepage over plain HTTP with no redirect, 65 of them at credit unions under $50 million in assets. HSTS is the clearest size gap on the web side: 36% of credit unions under $10 million send the header, against 62% between $100 million and $500 million and 77% from $1 billion to $10 billion.

What NCUA requires, and what it has counted

NCUA does not require DMARC. What it does require, since September 1, 2023, is fast notice of incidents. The rule, 12 CFR 748.1(c), reads:

“Each federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe. The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident or, if reporting pursuant to paragraph (c)(1)(i)(C) of this section, within 72 hours of being notified by a third-party, whichever is sooner.”

Paragraph (c)(1)(i)(C) covers incidents “caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.” NCUA has published three counts from the reports it received:

The periods overlap; do not add them. NCUA says no incident reported from May 2024 to April 2025 was systemic to the credit union system.

On email specifically, NCUA’s Risk Alert 21-RISK-01 (October 2021), on business email compromise through cloud email services, told boards and chief executives to “implement email authentication technologies such as Domain-based Message Authentication Reporting and Conformance (DMARC) policies to prevent spoofing and validate incoming email.” Five years later, 2,040 of 3,730 measured credit unions (55%) have no enforcing policy. The incident rule is about reporting quickly; how long organizations in other sectors take to disclose breaches is tracked in our breach notification timing study.

Breach notices filed by credit unions

State attorney general lists show only breaches that a credit union itself reported to residents of that state, so they are a floor, not a census. We used the California list (back to 2012) and the Washington list (back to 2015), and not Maine’s list, which returned no records when we requested it on November 11, 2026. We counted notices from organizations whose name contains “credit union” or “FCU” and publish only the counts.

*2026 runs to November 9, 2026 (California) and November 9, 2026 (Washington). Washington lists only breaches affecting more than 500 Washington residents.

California’s list holds 74 credit union notices since 2012, 47 of them from January 2023 on, against 13 in the four years from 2019 to 2022. Washington’s 20 credit union notices name ransomware as the cause in 7 and payment-card skimmers in 4. For every sector together, see our 2026 data breach statistics.

dig +short TXT _dmarc.example.org      # DMARC: look for p=quarantine or p=reject
dig +short TXT example.org | grep spf1  # SPF: ends in -all (hard fail) or ~all (soft fail)
dig +short MX example.org               # who receives the mail
dig +short DS example.org               # any output means DNSSEC is signed at the registry
curl -sI http://www.example.org/ | grep -i location          # should point to https://
curl -sI https://www.example.org/ | grep -i strict-transport  # HSTS header

What this means for MSPs and credit union IT teams

For an MSP serving credit unions under $100 million in assets, the gap is concrete: 29% of $10 million to $50 million credit unions and 38% of $50 million to $100 million credit unions enforce DMARC, and many publish p=none and stop there. Moving a domain from p=none to p=reject means listing every service that sends as the domain (core banking notices, e-statements, marketing platforms, loan origination systems), getting each aligned through SPF or DKIM, reading the rua reports for a few weeks, then stepping to quarantine and reject. Domains used only for websites, and the 184 measured domains with no MX, can go straight to v=DMARC1; p=reject. Because the 72-hour clock in 748.1(c) also runs when a vendor tells the credit union about a third-party compromise, contracts should require vendors to notify the credit union quickly enough to meet it.

Frequently asked questions

Are credit unions safe from cyber attacks?

Credit unions are attacked constantly but rarely in ways that threaten the whole system. Under NCUA’s 72-hour rule, credit unions reported 1,072 cyber incidents from September 1, 2023 to August 31, 2024, and NCUA says none of the 539 incidents reported from May 2024 to April 2025 was systemic. Basic email defenses are uneven: 55% of the 3,730 credit union domains we measured do not enforce DMARC.

How many cyber incidents do credit unions report to the NCUA?

NCUA has published three counts: 892 incidents from September 1, 2023 to May 1, 2024 (about 73% involving a third party), 1,072 from September 1, 2023 to August 31, 2024 (742 tied to a third-party vendor), and 539 from May 1, 2024 to April 30, 2025. The periods overlap, so the figures should not be added together.

Do credit unions have to report cyber incidents?

Yes. Since September 1, 2023, 12 CFR 748.1(c) requires every federally insured credit union to notify NCUA no later than 72 hours after it reasonably believes a reportable cyber incident occurred, or within 72 hours of being notified by a third party such as a credit union service organization or cloud provider.

Have any credit unions been hacked?

Yes. Organizations with credit union in their name filed 74 breach notices with the California Attorney General from 2012 to November 9, 2026, 47 of them since January 2023, and 20 with the Washington Attorney General, 7 of which cite ransomware. These are notices filed by credit unions themselves; incidents at their vendors are often filed under the vendor’s name.

Is DMARC really necessary for a credit union?

NCUA’s Risk Alert 21-RISK-01 (October 2021) told credit unions to implement DMARC policies to prevent spoofing. Only a quarantine or reject policy tells receiving mail servers to stop mail that fakes the domain. 45% of measured credit unions have one; 31% publish p=none, which only monitors.

How many credit unions use Microsoft 365?

1,669 of 3,730 measured credit union domains (45%) point their MX records straight at Microsoft 365. Another 606 route mail through a security gateway and list Microsoft 365 in SPF, which suggests Microsoft mailboxes behind the gateway: 2,275 domains, or 61%, in total.

Free to cite and republish with a link to this page. The CSV holds aggregates only (all credit unions, asset bands, member bands, charter type, mail route, states with at least 10 measured credit unions); it contains no per-credit-union results.

Methodology

References

1. NCUA, 5300 Call Report Quarterly Data, June 2026 (call-report-data-2026-06.zip). Accessed November 2026.
2. NCUA, Federally Insured Credit Union List, June 2026. Accessed November 2026.
3. eCFR, 12 CFR 748.1, Filing of reports. Accessed November 2026.
4. eCFR, 12 CFR 740.5, Requirements for the official advertising statement. Accessed November 2026.
5. NCUA, Board Approves Final Rule on Cyber Incident Reporting Requirements (effective September 1, 2023). Accessed November 2026.
6. NCUA, Cybersecurity and Credit Union System Resilience Annual Report to Congress (2024). Accessed November 2026.
7. NCUA, Board Briefed on Cybersecurity, New Charters, and Field of Membership (October 2024). Accessed November 2026.
8. NCUA, 2025 Cybersecurity and Credit Union System Resilience Report. Accessed November 2026.
9. NCUA, Risk Alert 21-RISK-01, Business Email Compromise through Exploitation of Cloud-Based Email Services (October 2021). Accessed November 2026.
10. California Attorney General, Data Security Breach Reports (CSV export). Accessed November 2026.
11. Washington Attorney General, Data Breach Notifications Affecting Washington Residents (data.wa.gov). Accessed November 2026.
12. Provena, US Bank and Credit Union Email Census: 7,537 Domains (October 2026), used as a cross-check only. Accessed November 2026.
13. IETF RFC 7489, DMARC and RFC 6797, HSTS. Accessed November 2026.