Labor unions occupy an unusual position in the security landscape. Few organizations hold such a combination of personal, financial, and strategic information in so few hands. Membership records may contain names, home addresses, Social Security numbers, and employment histories, while grievance files, bargaining strategies, and organizing lists contain additional sensitive information. The people who run these organizations are devoted to their members, but limited time and budgets can make consistent network defense difficult.
Why Member Data Carries So Much Risk
When a breach occurs at a union, the consequences can extend beyond identity theft. Organizing campaigns depend on confidentiality, and a leaked list of workers who have signed authorization cards can expose individuals to retaliation. Strike funds, dues processing, and benefit plan administration also involve regular movements of money, making payment redirection and invoice fraud important risks. As discussed in our review of the union breach that exposed 46,000 members' data, protecting member records deserves leadership attention. Our earlier article, Cybersecurity Risks Specific to Labor Unions, explores additional risks facing union organizations. Local chapters that manage their own email, file sharing, and devices should adopt consistent security standards rather than relying on informal practices.
Benefit-plan cybersecurity also deserves attention. Many unions sponsor or help oversee health, pension, and welfare funds. The U.S. Department of Labor provides cybersecurity guidance covering security programs, access controls, encryption, service-provider oversight, and incident response. Plan fiduciaries should review the guidance relevant to their responsibilities with qualified advisers. These practices can also inform broader protection of union member information, without implying that every union record falls under the same legal requirements.
Practical Steps That Fit a Union's Budget
Security improvements need not be elaborate. Enable multi-factor authentication on email and cloud accounts, prioritizing phishing-resistant options such as security keys or passkeys where supported. App-based authentication can improve on text-message codes, but not every app-based method resists phishing. Keep member records in a managed system with role-based access so that stewards and volunteers see only what they need. Remove access promptly when responsibilities change, and avoid personal email accounts and uncontrolled spreadsheets for sensitive official business.
Backups should be isolated from the primary network, protected with separate access controls, and tested regularly. Offline or immutable copies can help preserve recovery options if attackers compromise production systems. Keep devices and applications updated, and maintain an inventory of accounts, systems, and vendors that handle member data. Before changing bank details or sending an unusual payment, verify the request through a known phone number rather than contact information supplied in the message.
Equally important is a clear plan for the day something goes wrong. Decide in advance who will coordinate the response, which systems may need isolation, how evidence will be preserved, and which legal, insurance, and technical partners must be contacted. Plan how to communicate with members if normal email is unavailable. Notification obligations depend on the data involved and applicable law, so legal advice should be part of the response. Short, practical training sessions can help staff and volunteers recognize credential phishing and suspicious payment requests.
Trust is a central asset of any union, and protecting member information is part of representing members well. A steady investment in managed security, monitoring, and recovery planning can reduce risk without requiring every local to build its own security department. Begin with a review of accounts, devices, backups, and vendors. ComSolutions can help union leaders identify practical next steps for protecting member data and trust.
