A Payments Vendor Was Named on an Extortion Leak Site. Your Notification Clock Depends on Facts You May Not Have Yet

On October 19, 2026, the extortion group n0n added Finzly to its leak site. Finzly provides payments technology to banks and credit unions. According to American Banker, the group claims it holds access secrets for Finzly's payment infrastructure and cloud access keys. It set a publication deadline of 8:20 p.m. Eastern on Friday, October 23.

Finzly told American Banker it recently learned of the claim, is investigating with external cybersecurity experts, and is fully operational. The spokesperson did not say whether credentials were taken, whether clients were notified, or whether keys were rotated. As of American Banker's report on October 20, n0n had posted no sample data.

A leak site listing is a claim. It is not proof of a breach. This article does not assume one occurred.

It addresses a narrower question that applies whenever a vendor is named. What has to happen before your own reporting clock starts?

The answer differs for banks and credit unions.

If you are a bank

The computer-security incident notification rule, 12 CFR Part 53 for the OCC with parallel Federal Reserve and FDIC rules, has two parts.

A banking organization must notify its primary federal regulator as soon as possible, and no later than 36 hours, after it determines that a notification incident occurred. A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, specified aspects of the bank's operations.

A bank service provider must notify at least one bank-designated point of contact at each affected banking customer as soon as possible when it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours.

Both triggers turn on disruption or degradation, actual or reasonably likely. Neither turns on data theft alone.

So a vendor that reports it is fully operational may have concluded that 12 CFR 53.4 does not require it to notify you. That conclusion rests on the vendor's own view of what is reasonably likely.

That leaves the bank's own analysis. Whether stolen payment access keys make a material disruption reasonably likely is a judgment the rule leaves to you. It may depend on what the keys reach, whether they were rotated, and what controls sit in front of your payment rails.

If you are a credit union

12 CFR 748.1(c) is broader in two ways.

The third prong of the reportable cyber incident definition, at 748.1(c)(1)(i)(C), covers "a disruption of business operations or unauthorized access to sensitive data" caused by a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise.

It reaches unauthorized access to sensitive data, not only disruption.

The clock also has two starting points. NCUA must receive notice no later than 72 hours after the credit union reasonably believes it experienced a reportable cyber incident. When reporting under prong (C), the deadline is 72 hours after being notified by a third party, whichever is sooner. NCUA's letter on the rule says the obligation arises when the vendor informs the credit union or when the credit union forms a reasonable belief, whichever comes first.

A vendor's silence does not stop the clock if your own analysis gets there first.

Two questions remain open. No published NCUA answer to either was located. First, whether a payments software vendor fits "credit union service organization, cloud service provider, or other third-party data hosting provider," or is better analyzed as a supply chain compromise. Second, whether stolen access keys, without evidence of member data access, amount to unauthorized access to sensitive data. The rule defines sensitive data broadly, to include information that by itself or combined with other information could be used to cause harm to a credit union or member.

The other prongs may also apply. Prong (A) covers a substantial loss of confidentiality, integrity, or availability of a network or member information system that results from unauthorized access to or exposure of sensitive data, disrupts vital member services, or has a serious impact on the safety and resiliency of operational systems and processes. Prong (B) covers a disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.

What to do when any vendor is named

Find out whether the vendor is yours. Check your vendor inventory, including fourth parties that reach you through a direct vendor.

Contact the vendor's designated security contact and ask specific questions in writing. Was data or credential material taken? Which systems do the claimed secrets reach? Have keys, tokens, and certificates touching your connections been rotated, and when? Has the vendor determined whether services to you were disrupted or are reasonably likely to be?

Rotate what you control. If the vendor holds credentials, API keys, or certificates for your environment, rotate them on your side.

Increase monitoring on the connections the vendor touches. For payment vendors, that includes ACH, wire, and real-time payment activity flowing through them.

Document your reasonable-belief analysis with timestamps. For a credit union, that record shows when the 72-hour clock started or why it did not. For a bank, it supports your 36-hour determination either way.

Read your contract's incident notification clause. Many clauses track the four-hour disruption trigger. If yours does, a data theft with no outage may not require the vendor to tell you anything. Consider whether that clause needs to cover credential and key compromise.

Re-check the facts. Claims, vendor statements, and leak site status may change after this was written.

SOURCE: 12 CFR 748.1(c), eCFR, current as of October 20, 2026. NCUA, "Cyber Incident Notification Requirements," Letter to Credit Unions 23-CU-07. 12 CFR Part 53 (OCC), 12 CFR Part 225 Subpart N (Federal Reserve), and 12 CFR Part 304 Subpart C (FDIC). Incident facts from American Banker, "Extortion group threatens to leak bank vendor's secrets," October 2026, and the ransomware.live listing dated October 19, 2026.

This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.