A cooling failure in one data center stopped credit unions holding $2.56bn in assets

Divide $2.56bn across 23 institutions and the average affected credit union holds about $111m in assets, with roughly 8,700 members ^[4][1][2]. Iberville Federal Credit Union sits far below that line at $8.9m, about a third of one percent of the group's assets, and it is the one that shut its branch ^[6][3].

The 23 is a floor. American Banker built the list from notices the credit unions posted to members and from local news reports ^[5], and Sharetec served more than 250 credit unions as of 2018 ^[7], so the identified institutions are fewer than one in ten of the client base the vendor had eight years ago ^[4].

Before 2020, four companies sold and ran the same core system in their own regions: Bradford-Scott Data of Fort Wayne, Data Systems of Texas, NDS-Sharetec of Maine and GBS-Sharetec of Ohio ^[10]. Evergreen Services Group, a private equity firm, bought all four and merged them into one between 2020 and 2022 ^[11]. Each region still has its own online banking front end. But the four sit on a single domain, onlinecu.com, and resolve to one internet address in a range the American Registry for Internet Numbers assigns to Ark Data Centers of Cedar Rapids, Iowa. Sharetec's email routes through the same range, and so does the path connecting its network to the rest of the internet ^[12][9].

A bank in this position would have a regulator able to examine the vendor. Under the Bank Service Company Act, work a bank farms out is "subject to regulation and examination by such agency to the same extent as if such services were being performed by the depository institution itself," according to the statute ^[13], and bank regulators examine vendors on that basis ^[14]. The Financial Stability Oversight Council, the Treasury-chaired panel of federal financial regulators, has recommended every year since 2015 that Congress grant the same authority for credit union vendors ^[18]. The NCUA raised the point itself as recently as a 2024 report to Congress ^[16].

What stopped these 23 credit unions last week was cooling equipment in a building none of them selected, reached through a network four formerly separate vendors were merged onto after 2020 ^[11][12]. The counter-argument sits in the same record, which does not say where Bradford-Scott, Data Systems, NDS and GBS ran production before the merger. If all four already sat in the same third-party facilities, the roll-up bought billing efficiency and added no concentration at all.

What happens next depends on the rest of the client book. If the credit unions on Sharetec's other three front ends kept posting transactions on Sept. 15, the shared internet address matters less than the shared building, and only that one facility failed ^[12]. If instead the count of disclosed outages climbs toward the 250-plus figure, the concentration sits in the vendor. Neither Sharetec nor Ark responded to a request for comment, and neither has named the facility that overheated ^[8].