When the Audit Ends, What Happens to Credit Union Member Data?
The Mercadien incident shows why Third-Party Risk Management (TPRM) should extend beyond the initial vendor review. When an auditor retains sensitive member records after an engagement ends, the risk can remain long after the work is complete.
Executive Summary
A cybersecurity incident involving accounting and audit firm Mercadien highlights a broader credit union responsibility: managing the risks of outside service providers throughout the relationship, including after an engagement ends. That is the purpose of a risk-based Third-Party Risk Management (TPRM) program.
The incident, discovered in November 2025 and affecting information associated with at least nine banks and credit unions, involved records from both current and former clients. In one documented case, member information from a 2023 engagement was still being held by the firm when its systems were compromised in 2025.
For credit union leaders already balancing regulatory responsibilities, operational priorities, and limited resources, effective TPRM is not about treating every vendor as equally risky or adding unnecessary work. It’s about focusing oversight on the relationships that present the greatest risk to member information and operations, and making sure protections remain appropriate for as long as a vendor holds that information.
What Happened at Mercadien?
Mercadien, a certified public accounting and advisory firm serving financial institutions, discovered unauthorized access to part of its environment on November 7, 2025. Its investigation identified potential unauthorized access to sensitive information between September 17 and October 9, 2025.
According to October 2026 reporting on the Mercadien breach, at least nine banks and credit unions were affected. Depending on the individual, potentially exposed information included Social Security numbers, financial account numbers, dates of birth, and driver’s license numbers.
One particularly relevant example involves Suffolk Credit Union. According to Suffolk’s official incident disclosure, Mercadien retained member information from professional services performed in 2023, even though the firm was no longer an active service provider. Suffolk received the completed review of potentially affected information on August 13, 2026, and began notifying members on September 11.
Importantly, Suffolk reported that its own computer systems were not compromised. The incident occurred entirely within its former service provider’s environment.
The issue extends beyond auditors. Any former service provider holding member information can present an ongoing risk, even after its business relationship with the credit union ends.
Why Auditor Data Retention Belongs in a Risk-Based TPRM Program
Auditors need access to financial records and supporting documentation to perform their work. They may also be required to preserve certain records for professional, legal, or regulatory purposes, sometimes for several years.
The challenge is understanding which information must be retained, which information is no longer necessary, and whether the protections surrounding that data remain appropriate over time.
A risk-based TPRM program identifies which vendors warrant closer attention based on the sensitive information they access, the services they perform, and the potential impact if something goes wrong. An auditor storing member records presents different risks from a vendor that never handles member information. Both may be legitimate partners, but they do not require identical oversight.
For credit unions, this is an established responsibility rather than a new regulatory expectation. The NCUA has long emphasized third-party risk management and vendor oversight. Its guidance on evaluating third-party relationships calls for oversight suited to the credit union’s risk profile and the nature of each vendor relationship.
The Mercadien incident makes data retention a useful test of that approach. Two questions can help leadership understand whether the controls around a higher-risk vendor remain appropriate after an audit ends.
Two Questions Worth Including in Your Auditor Review
1. What member information does our auditor retain after the engagement?
An auditor may need to retain selected documentation to support its findings. However, there’s an important difference between preserving necessary audit records and retaining unnecessary copies of complete member files, account statements, or other sensitive information.
Understanding the difference begins with a straightforward conversation about what information the firm maintains, including records from previous engagements.
Ideally, the auditor can explain which records are required, how access is restricted, and whether unnecessary information is routinely removed. A written response gives compliance teams information they can use to document the vendor’s risk and determine whether additional safeguards are warranted.
2. How long is that information retained, and what happens when it’s no longer needed?
Once the types of retained information are understood, the next step is understanding how long those records remain in the auditor’s possession.
A documented retention schedule should clearly distinguish between records that must be preserved and information that can be securely deleted. It should also address archived copies, backups, and any outside providers involved in storing the information.
These conversations are also a reasonable opportunity to review incident notification language. Under the NCUA’s 72-hour cyber incident reporting requirements, federally insured credit unions must report qualifying incidents within the applicable reporting window, including certain incidents involving third-party providers.
That makes timely communication from auditors extremely important, even when their investigation is incomplete. Member notification obligations are separate and depend on the circumstances and applicable requirements.
Making Risk-Based TPRM Part of Existing Oversight
Most credit unions already maintain vendor management processes, conduct periodic risk assessments, and review professional service agreements. Strengthening TPRM does not necessarily require creating another program or introducing additional meetings.
It may simply mean using those existing reviews to distinguish vendors that handle sensitive member data or support critical services from those with more limited access. Higher-risk relationships can receive closer review of security practices, contract terms, incident reporting, and how information is returned or deleted when services end.
For an auditor, that means incorporating the two questions above into the next scheduled vendor review, contract renewal, or supervisory committee discussion. Compliance and risk management teams can document the answers and decide whether the engagement agreement needs clearer provisions covering data protection, retention, deletion, or incident communication.
For institutions with limited internal resources, fractional cybersecurity and compliance leadership can provide experienced guidance without requiring additional full-time staff.
The goal is practical, documented oversight that reflects the credit union’s actual risks, resources, and operating environment.
The Technical Side: What Secure Data Retention Really Means
Deleting a document from a shared folder doesn’t always eliminate every copy. Information may also exist in cloud storage, archived files, system backups, or an auditor’s supporting workpapers.
A well-defined retention policy should account for these locations and establish appropriate safeguards while information remains stored. These may include encryption, restricted access, activity monitoring, and documented disposal procedures.
Where records must be retained for legal or professional reasons, the emphasis should be on minimizing unnecessary information and protecting what remains.
For a broader evaluation of these practices, TorchLight’s cybersecurity audit, assessment, and compliance services help organizations examine how security controls operate, identify weaknesses, and document improvements.
A Broader Perspective on Member Data Protection
Credit unions depend on trusted outside professionals to provide specialized services, and those relationships are essential to maintaining effective operations and regulatory compliance.
The Mercadien incident isn’t a reason to distrust auditors or assume existing arrangements are inadequate. It illustrates why a risk-based TPRM program should account for the full lifecycle of shared member information, including what happens after a vendor’s work is finished.
For leadership teams, the practical goal is to identify which relationships create the greatest exposure, document reasonable safeguards, and ensure member information remains appropriately protected wherever it is held.
TorchLight works with credit unions to strengthen cybersecurity, compliance readiness, and third-party risk management while accounting for the operational demands their teams already face.
If your institution would benefit from an independent perspective on its existing TPRM practices, connect with TorchLight. We can help your team evaluate current protections, prioritize meaningful improvements, and integrate them into the processes you already have in place.