HAYWARD, Calif.—Former Patelco Credit Union Chief Audit Executive Ricardo Araujo has filed a wrongful termination lawsuit alleging he was fired after identifying cybersecurity and compliance deficiencies at the $9.9-billion credit union in the wake of its widely publicized 2024 cyberattack.
The lawsuit, filed July 17 in Alameda County Superior Court, alleges Araujo was terminated in retaliation for reporting audit findings that highlighted ongoing cybersecurity vulnerabilities and compliance shortcomings more than a year after a ransomware attack disrupted Patelco’s operations and exposed the personal information of more than one million members, according to the publication Danville San Ramon.
According to the report, Araujo is seeking economic damages, punitive damages and relief under California’s whistleblower and unfair business practices laws.
Patelco had hired Araujo in June 2025 as chief audit executive as part of its efforts to strengthen governance and restore confidence following the June 29, 2024, cyberattack. The credit union was operating under a February 2025 consent order with California regulators requiring improvements to its risk management and cybersecurity programs.
At the time of his appointment, Patelco CEO Erin Mendez said Araujo’s experience in risk management and internal audit would help strengthen the organization’s internal controls and support its long-term success, Danville San Ramon reported.
‘Significant Compliance Deficiencies Alleged’
According to the complaint, Araujo conducted an internal audit that identified what he described as significant compliance deficiencies and continuing cybersecurity weaknesses. His attorneys allege that after presenting those findings to management and the board’s Audit Review Committee, he faced scrutiny from human resources before being terminated days later for what Patelco characterized as poor job performance.
The lawsuit contends the stated reason for his dismissal was pretextual and that the real motivation was retaliation for raising concerns that could increase regulatory scrutiny and potentially delay unspecified merger or strategic plans, Danville San Ramon stated.
Among the allegations is that Patelco’s network remained vulnerable to relatively simple cyber exploits more than a year after the 2024 attack.
Danville San Ramon reported that neither Araujo nor Patelco had responded to requests for comment.
New Exec Appointed
Patelco later named former Federal Reserve Bank of San Francisco executive Azher Abbasi as chief audit executive as part of a broader leadership restructuring announced in February. At the time, the credit union said the appointments were intended to strengthen the organization as it approaches $10 billion in assets.
An initial case management conference is scheduled for Dec. 14 in Alameda County Superior Court, according to the report.
