HackingFinancial ServicesFinanceCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)Financial accountMediumContained

MemberSource Credit Union

bd_1368db5c6ffe857e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2025

Filed

May 7, 2026

To disclose

—

Affected

11state residents only

Linked

8 filings

Confidence

67%

Full breach record for MemberSource Credit Union →

MemberSource Credit Union reported a data event to the Nebraska AG on May 8, 2026. On June 3, 2025, unauthorized access to branch networks resulted in the exfiltration of names, SSNs, driver's licenses, and financial account data. 11 Nebraska residents were notified on May 7, 2026. The credit union engaged forensic specialists, reset passwords, notified law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

Incident timeline

Jun 3, 2025

Discovered

May 7, 2026

Filed

This filing is one of 8 about the same incident.View merged incident

A leak claim by safepay about this victim predates this filing by 338 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesafepaybd_b2fc6079fb9d7fa02025-06-03 · +338dVerified by operator

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_61c95d24c3f146972026-05-07Verified
Massachusetts State AGbd_9aa063fac94e3ba32026-05-08 · +1dVerified
California State AGbd_9db84dbb566e334a2026-05-08 · +1dVerified
Vermont State AGbd_c53f2485178b1a202026-05-08 · +1dVerified

Show 2 more filings ↓up to 4d gap

Montana State AGbd_1fa68433c68e29442026-05-05 · +2dCandidate
Texas State AGbd_aa1e8bc975a47fba2026-05-11 · +4dVerified

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: MemberSource Credit Union
norm: membersource credit union
Domain: membersourcecu.org
Industry: Financial Servicesllm

Discovered: Jun 3, 2025
Materiality determined: —
Notification sent: May 7, 2026
Affected individuals: 11state-resident count only
Data types: Government IDIdentity (basic)Financial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: reporting the event to other state and federal regulators as required
Initial access: exploit_public_facing

During the incident: Partnered with specialists to investigate the nature and scope of the event and restore its operations safely and securely
Reset user passwords
Reported the incident to federal law enforcement
Changes made: Reviewing its existing security controls, policies, and procedures it has in place to maximize the benefits of its encryption software
Offering twelve (12) months of complimentary credit monitoring and identity protection services through CyberScout
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGMay 5 · first

Indiana State AG+2d

Nebraska State AG+2d · this page

Massachusetts State AG+3d

California State AG+3d

Vermont State AG+3d

Texas State AG+6d

Pattern: first filing May 5 (MT), last May 11 (TX) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/e519d401-1835-48fa-8428-71a66356edd8.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2026
Raw hash: 2eca0aa17f3fe5d2b0ce26f80d147be9ab0d9f64787f798ef3cd0dbc4cab6d79

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityMemberSource Credit Union

Incidentdiscovered Jun 3, 2025

Stated responsePartnered with specialists to investigate the nature and scope of the event and restore its operations safely and securely

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov