The Backup Plan for Your Bank Account Is Shutting Down

Sheltered Harbor, the industry program that vaults Americans’ account data in case a cyberattack wipes out a bank, is winding down. Its work moves to a bank-run group, while a former Fed president warns the real danger is how few companies the whole system runs on.

By Rich Vandall · Nov. 4, 2026

How we reportCorrectionsWho pays for thisSend a tip

For about a decade, a little-known nonprofit called Sheltered Harbor has been the banking industry’s answer to a nightmare: a cyberattack that destroys a bank’s systems and its backups, leaving customers unable to prove what they have.

Now it is going away. Sheltered Harbor’s board “has approved the wind-down of the organization,” according to a notice on the website of its parent, the Financial Services Information Sharing and Analysis Center, or FS-ISAC, the industry’s cyber-threat clearinghouse. Its “key assets” are being transferred to FS-ISAC, and its technical specification will be “available to all FS-ISAC members,” managed by a group of member-firm resilience executives FS-ISAC calls its Resilience Congress. The notice gives no date and no reason. FS-ISAC has not explained the decision publicly, and The Despoiler found no other news coverage of the wind-down as of Wednesday.

What Sheltered Harbor did

The idea grew out of cybersecurity exercises the U.S. Treasury ran in 2015 that exposed how vulnerable the economy was to a major attack, according to FIS, one of the country’s largest bank technology providers. FS-ISAC unveiled Sheltered Harbor on Nov. 22, 2016, with backing from industry trade groups including the American Bankers Association.

The system is simple on paper. At the end of each day, a participating bank or brokerage copies its customers’ account data in a standard format into an encrypted vault that can’t be altered and is kept offline, cut off from the bank’s own systems and backups. If the bank is knocked out, a pre-chosen restoration partner, often another institution or the bank’s technology vendor, pulls the data and runs a temporary system so customers can reach their money while the bank rebuilds. Members also have to test the recovery every year, the Bank Policy Institute says.

Participation was always voluntary. By 2019, members covered 71% of U.S. deposit accounts and 55% of client assets at U.S. retail brokerages, FIS reported.

What it never covered: what you owe

Public descriptions of Sheltered Harbor, from its partners and trade groups, all describe protecting deposit and brokerage account data: your money. The Despoiler found no public description saying loan balances were part of the vault.

That matters for a fantasy that circulates every time the economy wobbles: that a big enough hack could wipe out Americans’ debts. It can’t, and the two real tests of the idea show why. Loans don’t live in one place. They are recorded by the lender, the company that services the loan, the investors who buy bundled loans, the credit bureaus and, for mortgages, the county recorder.

In late 2023, an attack on Mr. Cooper, one of the country’s largest mortgage servicers, exposed personal data on 14.7 million current and former customers and shut down online payments for about a week. In January 2024, ransomware at lender loanDepot encrypted company data and affected almost 17 million people; the company began restoring systems two weeks after the attack started, and the company expected a $12 million to $17 million hit to its quarterly earnings. In both cases, the mortgages were still owed when the systems came back.

What a hack takes from ordinary people, in other words, is access, not debt: days or weeks of not being able to pay, get paid or see your balance, while the bills keep coming.

The bigger worry: everyone uses the same few companies

The wind-down comes as regulators and economists focus on a different weak point. In a policy paper published Oct. 1, former Philadelphia Fed President Patrick Harker reported that the top three cloud providers serve more than 80% of regulated U.S. financial institutions, and the top four core-processing vendors, the companies that run banks’ account systems, serve more than 70% of community and regional banks.

Harker’s argument is that regulators push each vendor to be reliable, but nobody manages the risk that many institutions fail at the same moment because they share a provider. In his model, the same amount of downtime does about 43% more damage when failures hit at once. His example: the July 19, 2024, CrowdStrike software update that knocked out about 8.5 million computers. In July, the United Kingdom designated four cloud providers, Amazon Web Services, Google Cloud, Microsoft and Oracle, as “critical third parties” subject to oversight. The U.S. has no equivalent.

The backup plan wasn’t entirely separate from that concentration. Sheltered Harbor partnered with Amazon Web Services in November 2024 to help financial firms build vaults on AWS, and restoration often depends on the same technology vendors that run banks day to day.

Why now

All of this lands amid open talk of a market bubble. Investor Ray Dalio said in January that artificial intelligence is in “the early stages of a bubble.” A financial shock and a cyber shock are different things, but both test the same question: whether the system can keep working for ordinary customers on its worst day.

What it means for the Miami Valley

The question matters close to home. Beavercreek-based Wright-Patt Credit Union, the largest member-owned credit union in Ohio, reports more than 526,500 members and more than $9.6 billion in assets. Whether it, Kettering’s Day Air Credit Union or the Ohio-based banks Huntington and Fifth Third vault customer data under the Sheltered Harbor standard, and what they plan to do once it winds down, isn’t public.

If you bank locally, you can ask your bank or credit union two questions: Do you keep an offline, unchangeable copy of my account data, and who would restore my account if your systems were destroyed? If you have worked in bank IT or know what your institution is doing, tell us.

AI tools gathered and sorted the records for this story, checked the math and wrote a first draft. Rich Vandall rewrote, checked and edited it. How we report.