MARSHALL, Mich. — Marshall Community Credit Union has become the latest credit union to sue Fiserv, accusing the financial technology giant of failing to provide promised cybersecurity protections while allegedly demanding potentially seven-figure fees if the credit union attempts to move its data to another provider.
The lawsuit, filed Oct. 5 in U.S. District Court for the Western District of Michigan, names Fiserv Solutions LLC and parent Fiserv Inc. as defendants. The $371-million Marshall Community Credit Union is seeking monetary damages, rescission of its contract, restitution, injunctive relief and a court declaration that it does not have to pay early termination, deconversion or other post-termination fees.
The allegations have not been proven in court, and Fiserv had not filed a response to the complaint at the time it was submitted.
Numerous other credit unions have also filed similar suits. Most recently, Tampa-based FiCare Federal Credit Union asked a federal judge to order Fiserv to quickly produce records about alleged fraud through its cardholder services call center, saying criminals posing as members persuaded agents to remove restrictions from stolen debit and
MCCU, which said it has approximately 18,500 members, alleged Fiserv stores and processes some of its most sensitive information, including member names, dates of birth, Social Security numbers, account numbers, balances and transaction histories.
The CU Daily has previously reported on a growing number of credit unions taking Fiserv to court over disputes involving technology, cybersecurity, contracts and other issues. The new complaint itself cites litigation involving U.S. Courthouse SDNY Federal Credit Union, Bessemer System Federal Credit Union, Cencap Federal Credit Union, Self-Help Federal Credit Union, FiCare Federal Credit Union, POLAM Federal Credit Union, Educational & Governmental Employees Federal Credit Union and Midwest Family Federal Credit Union.
MCCU is being represented by Nerko, PLLC; Hecht Partners, LLP and Holzman Law, PLLC.
CU Alleges Basic Security Controls Missing
At the heart of MCCU’s 305-page filing are allegations that Fiserv represented that it employed appropriate cybersecurity safeguards but failed to implement what the credit union contends are basic, industry-standard protections.
“Fiserv falsely represents that it employs appropriate safeguards to protect the sensitive and confidential financial data of MCCU credit union members,” the complaint alleges. MCCU said those shortcomings leave its systems and member information vulnerable to unauthorized access.
MCCU said its relationship with Fiserv dates to a Master Agreement executed in November 2011 and subsequently amended in 2015 and 2017. The credit union contends the agreement requires Fiserv to use at least a reasonable standard of care to protect information and to maintain an information-security program designed to protect customer data against threats and unauthorized access.
What Risk Assessment Allegedly Found
According to the lawsuit, a recent MCCU risk assessment found that several Fiserv systems lacked what the credit union considers adequate multifactor authentication.
Among other things, MCCU alleged Fiserv’s Client360 system uses a username and password with an email-based one-time passcode required only intermittently. It also alleged Fiserv’s Corillian online banking platform and Mobiliti mobile banking application do not require MFA before users can conduct certain high-risk activities, including viewing account information and transferring funds. COMPLAINT[99]
MCCU further alleged that Fiserv either does not require MFA or relies on email passcodes on systems containing confidential information, despite federal cybersecurity guidance the credit union says does not recognize email as an acceptable second authentication factor. COMPLAINT[99]
More Than 280 Service Tickets
The lawsuit goes beyond cybersecurity.
MCCU alleged Fiserv systems have also suffered frequent outages and other disruptions. The credit union said it submitted more than 160 support tickets in 2025 and more than 120 through approximately July 2026.
From the beginning of 2025 through approximately July 2026, MCCU alleged SecureNow experienced 37 outages, Corillian had 32 and Portico had 26. COMPLAINT[99]
MCCU said those problems have forced it to devote substantial resources to addressing technology issues and, in some instances, develop its own workarounds. COMPLAINT[99]
Fiserv Denied Breaching Agreement
The dispute escalated May 19 when MCCU sent Fiserv a formal Notice of Breach, according to the complaint. The credit union requested audits, security-test results, security certifications, information about Fiserv’s information-security plan and other records. COMPLAINT[99]
Fiserv, through outside counsel, responded May 26 and denied breaching the agreement, according to the lawsuit. Fiserv asserted that the security controls it provides MCCU comply with the Master Agreement and applicable laws and regulations.
The complaint said Fiserv also acknowledged it had not completed its investigation of security configurations for each of the products identified by MCCU.
Seven-Figure Cost to Leave Alleged
One of MCCU’s most significant allegations involves what it says would happen if it attempted to leave Fiserv.
The credit union alleged Fiserv would demand seven-figure early termination and deconversion fees to allow MCCU to transfer its data to another provider. MCCU characterized that arrangement as forcing it to choose between paying substantial fees to move to another system or remaining with technology it believes does not adequately protect member information.
MCCU is asking the court to declare that it has no obligation to pay early termination, liquidated damages, deconversion or other post-termination fees. It argues, among other things, that Fiserv’s alleged breaches make those provisions unenforceable.
Multiple Claims Filed
The lawsuit asserts claims including breach of contract and seeks specific performance requiring Fiserv to properly secure MCCU’s confidential information. It also seeks declaratory relief regarding the contract and future payments, as well as damages and other remedies.
MCCU is seeking compensatory, consequential, statutory and punitive damages in amounts to be determined at trial, along with restitution and disgorgement of payments it made for services it alleges were deficient or nonconforming. It also seeks rescission of the Master Agreement and preliminary and permanent injunctive relief.
The credit union has demanded a jury trial.
