Ohio Bank Joins Cybersecurity Lawsuit Against Fiserv

Ohio-based Antwerp Exchange Bank has sued financial technology provider Fiserv in federal court, alleging that the company made misleading statements about its security controls and used those representations to obtain access to bank customer data. The case is the 10th related lawsuit handled by attorney Charles Nerko since 2018 and the first brought by a bank; the previous nine were filed by credit unions. The claims concern account-data protection, multifactor authentication and potential fees when customers end their relationships with Fiserv. No court has determined whether Fiserv’s cybersecurity measures are adequate.

Antwerp filed its complaint on Oct. 8 in federal court in Toledo, Ohio. The bank has $161 million in assets. Fiserv serves about 10,000 financial institutions, making the dispute relevant to how responsibility for authentication and security features is divided when banks and credit unions rely on third-party core-processing systems.

Antwerp focuses claims on trade secrets and security statements

Antwerp’s lawsuit relies solely on the federal Defend Trade Secrets Act and corresponding Ohio law. The bank says customer identities and account records qualify as trade secrets, and alleges that Fiserv obtained the information through false statements about its security controls in contracts and compliance materials. Unlike some earlier cases, Antwerp did not bring claims for breach of contract or fraud, narrowing its legal theory to trade-secret misappropriation.

The complaint identifies nine Fiserv systems used by the bank and alleges that some lack multifactor authentication. The Premier core system stores customer account information. According to the filing, bank employees log in with a username and password and “periodically” receive a one-time code by email. The system also offers codes through an authenticator application. Citing guidance from the National Institute of Standards and Technology, the complaint argues that email codes do not satisfy the requirements for a second authentication factor, but it does not say whether the bank enabled the authenticator-app option. Nerko said he would not comment on the security settings of individual customers.

The complaint says employees can access customer account numbers, addresses and Social Security numbers after logging in, but it does not identify a specific breach or fraud loss at the bank. Nerko said the two recent cases do not depend on proof that a security incident has already occurred. Antwerp also alleges that leaving Fiserv could trigger a termination fee in the “seven figures,” without specifying an amount. Bank Chief Executive Jeff Mumma said a bank should not still owe termination-related fees if a vendor has failed to meet its obligations.

Fiserv says customers can select security features

Fiserv has not yet filed a response in the Antwerp case. In other related litigation, however, the company has consistently argued that several of its systems offer stronger login protections and that customers decide whether to activate them. In a filing dated Oct. 5, Fiserv’s attorneys said customers ultimately determine their own level of risk tolerance. A company spokesperson said Fiserv provides security and authentication tools designed to accommodate different customer needs and preferences, and argued that neither Antwerp nor Marshall Community Credit Union of Michigan identified a specific security incident affecting customers or data. Fiserv said it considers the claims unsupported and plans to defend itself in court.

In a case brought by Indiana-based Midwest Family Federal Credit Union, Fiserv said the credit union had not enabled additional security features and had declined to migrate to its upgraded authentication product, SecureNow. Fiserv said SecureNow adds multifactor authentication to its Virtual Branch online banking and Mobiliti mobile banking products and is replacing the older Enhanced Authentication system. The company also said SecureNow carries an additional fee. Some plaintiffs argue that requiring customers to move to a paid product during the contract term is unreasonable.

Court filings also show that security capabilities differ across Fiserv systems. A Fiserv executive said in a 2025 declaration that the Portico core system added multifactor verification for online-banking enrollment in April, while authenticator-app codes became available in June. Another credit-union core system, CUSA, did not support that type of verification at the time. Existing filings do not state when the authenticator-app option was added to the Premier system used by Antwerp.

Courts reject two emergency requests as litigation continues

Two emergency motions that have received rulings from judges were denied, but neither decision determined whether Fiserv’s security controls were sufficient. In June 2025, a federal judge in Connecticut rejected Cencap Federal Credit Union’s request to bar Fiserv from storing its information on internet-connected systems without multifactor authentication. The judge cited, among other factors, the credit union’s delay of several years before filing suit. In January 2025, a federal judge in North Carolina also rejected Self-Help Credit Union’s request to cut off internet access to Fiserv’s Client360 support portal and require an exit plan.

Self-Help was later ordered to pay Fiserv’s related legal fees after the court found that it had evaded questions during discovery. The court also found that the credit union had had an opportunity several years earlier to use Portico’s authenticator-app codes. Self-Help withdrew its preliminary-injunction request the following day. Nerko said the credit union accepted an arrangement previously offered by Fiserv that allowed it to leave later that year without paying a termination fee in advance. FiCare Federal Credit Union’s emergency request to prevent Fiserv from automatically releasing card-fraud holds through its call center remains pending.

The broader litigation has produced mixed results. In June, a federal judge in California refused to dismiss Polam Federal Credit Union’s case, finding that the issues were better addressed after the parties completed discovery. A case brought by Pennsylvania’s Bessemer System Federal Credit Union was allowed to proceed before the parties agreed to dismiss it in 2024. Two other New York credit unions settled their lawsuits in 2023, while the Cencap case was dismissed in April after the parties reported a settlement. The other seven cases handled by Nerko remain unresolved, and Fiserv has not obtained a court ruling directly dismissing all claims in any of the 10 lawsuits.