Former Audit Chief Sues Patelco, Alleging Firing Followed Warnings Of Continuing Cyber Risks
By CU Today Staff —
DUBLIN, Calif.—Patelco Credit Union’s former chief audit executive has sued the $9.7-billion institution, alleging he was fired days after reporting serious compliance deficiencies, unresolved cybersecurity vulnerabilities and recommendations for meeting requirements imposed following the credit union’s massive 2024 ransomware attack.
Ricardo Araujo filed the wrongful-termination lawsuit in Alameda County Superior Court in July, accusing Patelco of retaliation and unfair business practices. According to the complaint, Araujo presented the results of internal audits in December 2025 to management and the board’s Audit Review Committee, only to be terminated shortly afterward for purported “poor job performance.” Araujo alleges there was no documented history supporting that explanation.
The lawsuit claims Araujo found that Patelco remained susceptible to relatively simple cyber exploits more than a year after the earlier attack. The complaint also alleges Patelco management contacted human resources about his information-technology audit, which Araujo viewed as an attempt to intimidate the independent audit function. His attorneys contend Patelco feared his recommendations could increase regulatory scrutiny and potentially delay unspecified merger or “exit” plans. Patelco had not publicly responded to the allegations as of the initial reporting on the case,
Patelco hired Araujo in June 2025 as part of its efforts to strengthen risk management and comply with a February 2025 consent order issued by the California Department of Financial Protection and Innovation. The order required Patelco to develop a cybersecurity program appropriate for its risk profile, retain an independent compliance consultant, improve board oversight and training, report its progress to regulators and pay a $100,000 penalty.
As CUToday.info previously reported, the state enforcement action followed the June 2024 ransomware attack that forced Patelco to shut down online and mobile banking and other essential systems from June 29 through July 15. Branch employees were also unable to provide members with balances and certain other services. Attackers accessed personally identifiable information, and subsequent breach disclosures indicated information associated with more than one million people was compromised.
The attack also produced steep financial consequences. Patelco reported a $39.2-million third-quarter 2024 loss, driven largely by a roughly $38-million charge tied to the incident and overdrafts covered while systems were unavailable. The credit union later agreed to a $7.25-million settlement of consolidated litigation brought by people affected by the breach. Araujo’s lawsuit seeks lost compensation and other economic damages, along with punitive damages.
CUToday.info has reached out to the credit union for comment.
Originally reported by CU Today.