HackingFinancial ServicesFinanceStolen CredentialsEmail MisuseCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHighActive

VENTURA COUNTY CREDIT UNION

bd_004d28accb577cd9 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 30, 2024

Filed

Jun 20, 2024

To disclose

20 weeks

Affected · nationwide

44,4747 in this filing

Linked

6 filings

Confidence

65%

Full breach record for VENTURA COUNTY CREDIT UNION →3 incidents on file

Ventura County Credit Union experienced an external system breach (hacking) affecting one employee email account between Jan 29-30, 2024. Unauthorized access exposed names, SSNs, and financial account info for 44,474 individuals, including 7 Maine residents. VCCU notified law enforcement and the NCUA, engaged outside specialists, and provided 12 months of Experian credit monitoring to affected individuals. Notices were sent on June 20, 2024.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 30, 2024 → Filed with AG Jun 20, 2024142d ✗ ME AG >90d20 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 20 weeks / 142 days

Jan 29, 2024

Begins

Jan 30, 2024

Discovered

Jun 20, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_16adfea87a25c6342024-06-20Verified
Indiana State AGbd_54934c9153dfbca02024-06-20Verified
Massachusetts State AGbd_73cd33a09b0c16882024-06-20Verified
California State AGbd_9893e2549b7bb4112024-06-20Verified

Show 1 more filing ↓

New Hampshire State AGbd_bfa82828285b3bc42024-06-20Verified

Name: VENTURA COUNTY CREDIT UNION
norm: ventura county credit union
Domain: vccuonline.net
Industry: Financial Services

Name: VENTURA COUNTY CREDIT UNION
norm: ventura county credit union
Domain: vccuonline.net
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jan 30, 2024
Breach occurred: Jan 29, 2024 – Jan 30, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jun 20, 2024
Affected individuals: 44,474state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified federal law enforcementNotified its primary federal regulator, the National Credit Union Association (NCUA)Providing written notice of this incident to relevant state and federal regulators
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of outside specialists
Reviewed the contents of the affected account
Notified federal law enforcement
Notified its primary federal regulator, the National Credit Union Association (NCUA)
Providing access to credit monitoring services for one (1) year, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implementing additional safeguards and training to its employees
Reviewing policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(142 days from discovery to filing)
Compliance flags: ME AG >90d · 142dME resident >60d · 142d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 30, 2024
→ Filed with AG: Jun 20, 2024
142d 90 days ME AG >90d
Maine
Discovered: Jan 30, 2024
→ Notified: Jun 20, 2024
142d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 30, 2024 → Filed with AG: Jun 20, 2024	142d	90 days	ME AG >90d
Maine	Discovered: Jan 30, 2024 → Notified: Jun 20, 2024	142d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGJun 20 · first

Indiana State AGJun 20 · first

Massachusetts State AGJun 20 · first

California State AGJun 20 · first

New Hampshire State AGJun 20 · first

Maine State AGJun 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/d962305e-b266-4643-8f65-b83f6bae532b.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 20, 2024
Raw hash: 2deffb8122f45fab60b5d0c22df6bda9ee759b211c446c0be07efafa147274aa

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityVENTURA COUNTY CREDIT UNION

Victim entityVENTURA COUNTY CREDIT UNION

Incidentdiscovered Jan 30, 2024

Stated responseLaunched an investigation with the assistance of outside specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov