News

• ABA Banking Journal: House Republicans unveil data privacy bills
• ABA Banking Journal Podcast: ABA’s ecosystem strategy to tackle fraud
• ABA Banking Journal: Bringing financial literacy to life for the next generation
• CISA News: Okta Under Attack as Hackers Skip Phishing for Identity Systems

SDBA Updates

• Women of Impact Awards
• Years of Service Awards

SDBA Events

• 2026 NDBA/SDBA Annual Convention
• Graduate School of Banking
• Graduate School of Banking Colorado

Online Education

• Additional Educational Opportunities

Compliance Alliance

• 2026 Digital Banking and NEOBANK Conference

ABA Banking Journal: House Republicans unveil data privacy bills

House Republicans today unveiled two bills to establish national data privacy standards, including legislation to modernize the Gramm-Leach-Bliley Act, which is the federal law regulating how banks and other financial institutions safeguard customer data.

The SECURE Data Act would establish national privacy and data security standards enforced by the Federal Trade Commission and state attorneys general, according to a summary of the legislation. The legislation would exempt financial institutions and data covered by the GLBA, but a related bill – the GUARD Financial Data Act – would update the 1999 law to account for advances in technology. The GUARD Act also would preempt state laws in the financial activity space. These laws would work in concert to create a national privacy standard for banks to follow rather than the current state and federal patchwork.

The GUARD Act “minimizes data collection and disclosures; allows customers and former customers to request access to their financial data held by a financial institution; allows former customers of a financial institution to request deletion of their data; and requires a financial institution to receive a consumer’s affirmative opt-in consent before sensitive personal information can be disclosed,” according to a joint statement by House Financial Services Committee Chairman French Hill (R-Ark.) and the other committee GOP leaders.

“This effort represents a significant step to strengthen consumer protections and ensure Americans have control over their financial data,” they added. “We look forward to continuing to work together as these measures progress through the legislative process.”

Back to Top

ABA Banking Journal Podcast: ABA’s ecosystem strategy to tackle fraud

On the latest episode of the ABA Banking Journal Podcast — a crossover episode with the ABA Fraudcast — ABA’s Rob Nichols and Paul Benda provide several updates on ABA’s work to reduce the incidence and cost of fraud for bank customers. Among other topics, they highlight:

- Their recent participation in the United Nations and Interpol Global Fraud Summit. “One of the key messages that I heard loud and clear is the need for there to be a whole ecosystem approach,” said Nichols. “It can’t just be banks protecting their customers and their clients. . . . We have to get these other industrial sectors to really step up and do their fair share.”
The growing co-sponsorship of the bipartisan SCAM Act, which targets the source of many scams afflicting Americans.
- ABA’s collaboration with the International Banking Federation to bring the best global anti-fraud practices home to the United States.
- The growth of state-level legislative activity, and state bankers association leadership, on fraud issues.

Click here to download the episode.

Back to Top

ABA Banking Journal: Bringing financial literacy to life for the next generation

'When young people are empowered to teach and create, financial literacy becomes more relatable, engaging and memorable.'

Back to Top 

---

CISA News: Okta Under Attack as Hackers Skip Phishing for Identity Systems

April 14, 2026 | Mayura Kathir

Hackers are shifting away from email phishing and are directly targeting Okta and other identity providers using voice‑based social engineering, or “Okta vishing.”

This trend turns what used to be a single account compromise into an immediate, organization‑wide cloud data breach via Single Sign-On (SSO). Instead of sending links, they stay on the phone and walk the victim through actions that hand over identity provider control. During these calls, attackers pressure staff to reset MFA, enroll a new authenticator, provide OTP codes, approve push prompts, or share passwords and session details.

Okta vishing is a voice phishing technique in which attackers call employees or help desks, pretending to be legitimate users or IT staff, to manipulate MFA and Okta account settings. Once they gain Okta access, they immediately pivot through SSO into platforms like Microsoft 365, SharePoint, OneDrive, Google Workspace, Salesforce, Slack, VPN portals, and HR systems without exploiting each app individually.

Why These Attacks Are Growing

Threat actors have realized that MFA usually fails at the human layer, not the technical layer. Rather than technically bypassing strong authentication, they convince people to weaken it for them under the guise of support or urgency. Help desks are measured on speed, remote work makes access issues common, and attackers can easily gather employee details, org charts, and executive names from LinkedIn, company sites, and data leaks to build credible pretexts.

With identity providers now acting as the central control plane for SaaS access, compromising Okta effectively compromises the cloud environment behind it.

The attack usually begins with reconnaissance, where adversaries collect names, roles, phone numbers, help desk contacts, and Okta tenant patterns from open sources and prior breach data. 

They then call the victim or IT, posing as a locked‑out employee, traveling executive, contractor, or user with a “broken phone” and use urgency to push past normal verification.

Next, they manipulate MFA by convincing staff to reset factors, add attacker‑controlled devices or phone numbers, or share OTPs and push approvals, effectively transferring account control.

With Okta now compromised, they ride SSO into SaaS and proceed to download SharePoint and OneDrive data, export email, register OAuth apps, create API tokens, and set forwarding rules, turning the event into large‑scale cloud data exfiltration.

Detection Clues for DFIR Teams

On the identity side, responders should flag unjustified MFA resets, new device enrollments, changes to MFA methods followed by unusual logins, sign‑ins from unfamiliar ASNs, and help desk tickets that closely precede suspicious activity.

In Microsoft 365 and other SaaS platforms, warning signs include abnormal SharePoint or OneDrive download volumes, logins from new IPs across multiple apps, sudden OAuth consent events, and rapid multi‑app access right after an MFA change.

Defending against Okta vishing requires hardening identity workflows, not just email security.

Organizations should enforce strict verification for MFA and password resets, require step‑up checks for high‑risk changes, train help desks on vishing pretexts, and mandate phishing‑resistant MFA such as FIDO2 keys or passkeys where possible.

Security teams should also turn off legacy authentication, restrict OAuth app consent, regularly review MFA factors, and ensure IdP logs are ingested into SIEM to correlate identity events with SaaS, VPN, and endpoint telemetry.

Finally, SOC and MDR workflows must explicitly cover identity‑based attacks, with playbooks to rapidly revoke sessions, reset credentials, and remove rogue MFA methods when Okta vishing is suspected.

Full Article

Back to Top

2026 Women of Impact Awards

Back to Top

Years of Service Awards

40 and 50 Year Banker Awards

The SDBA will honor and recognize those bankers with 40 and 50 years of service in banking during its Annual Business Meeting at the 2026 NDBA/SDBA Convention in Bismarck, ND. Years of service awards can also be awarded at the bank. Service awards that will be awarded at the bank can be ordered at any time. To request an award for someone who has been in banking for 40+ years, please complete this form. 

The deadline to submit an award to be presented at the 2026 Annual Convention is May 22, 2026. 

Convention Memorial Service

Bankers who have passed away since the last Annual Convention (June 2025) will be remembered during the SDBA's Annual Business Meeting at the NDBA/SDBA Annual Convention in Bismarck, ND. 

The deadline to submit a name for the memorial service is also May 22, 2026.

Back to Top

2026 NDBA/SDBA Annual Convention

Registration is OPEN for the 2026 NDBA/SDBA Annual Convention, taking place June 15–17 in Bismarck, North Dakota! Join bankers from across the Dakotas for three days packed with connection, insight, and celebration.

What to expect:

Kick things off in style

Welcome Party at the North Dakota Gateway to Science Center 

Connect and engage

Exhibit Hall featuring industry partners 
Red, White & Blue Bash in the Exhibit Hall 
Optional activities, including the BankPAC Golf Tournament

Learn and grow

Business breakfasts with NDBA & SDBA 
General sessions with timely industry insights 
Morning and afternoon educational programming designed to inform and inspire 

Wrap it all up

Networking opportunities throughout 
Closing ice cream reception to celebrate a great convention together 

Beyond the agenda, this convention is about strengthening relationships, sharing ideas, and celebrating the important role community banks play in our communities. As we look ahead to the future of banking—and reflect on our nation’s history—there’s no better time to come together.

Don’t wait—secure your spot today! 

Back to Top

Graduate School of Banking

July 26-August 6, 2026 

Over the course of 25 months, through a mix of lectures, bank simulations, case study discussions and hands-on projects, you will learn to:

Enrollment deadline: June 1, 2026

Scholarships DUE May 8, 2026. APPLY TODAY!

Details & Registration

Back to Top

Graduate School of Banking Colorado

Enrollment Information

Additional information about all of GSBC's community banking-focused programs can be found at www.GSBColorado.org.

Online Education

Participating in learning opportunities outside the bank can be challenging. Take advantage of the SDBA's extensive selection of webinars and on-demand training to enhance your banking expertise directly from your computer.

GSB Online Seminars
OnCourse Learning
SBS Institute
ABA Training

2026 Digital Banking and NEOBANK Conference

Digital transformation continues to reshape how banks operate, compete and serve their customers—and the pace of change isn’t slowing down.

The 2026 Digital Banking and NEOBANK Conference brings together the key conversations shaping that future, offering practical insight into the technologies, strategies and risks defining today’s landscape.

From AI and fintech partnerships to digital assets, payments and regulatory considerations, the program is designed to provide a clear, actionable view of where the industry is heading—and how institutions can respond. Delivered in a flexible, virtual format, the conference makes it easy to engage with timely content while staying connected to day-to-day priorities. With the event approaching, now is the time to ensure your team is part of the conversation.

Register today and gain the insight needed to move forward with confidence

Learn how to put compliance management solutions from Compliance Alliance to work for your bank, by contacting (888) 353-3933 or [email protected] and ask for our Membership Team. For timely compliance updates, subscribe to Bankers Alliance’s email newsletters.