Social EngineeringPhishingCustomer Data InvolvedPIIIDENTITY_BASICLowContained
EDUCATIONAL EMPLOYEES CREDIT UNION
bd_15b461a85b8b7df7 · schema v1 · pii pii-v1
Full breach record for EDUCATIONAL EMPLOYEES CREDIT UNION →Educational Employees Credit Union notified Massachusetts residents of a cybersecurity incident on December 15, 2025, where an unauthorized individual accessed a single employee email account. The breach potentially exposed personal information contained in those emails. The Credit Union secured the environment, engaged cybersecurity professionals, and is offering two years of complimentary identity monitoring services through Kroll.
Massachusetts clock✗ MA AG >90d20 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_6b3e06557a4d06e6California State AGfiled 2026-05-29(28d gap)Verified
- bd_d4e3d38742b461e1Texas State AGfiled 2026-06-01(31d gap)Verified by operator
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-878-educational-employees-credit-union/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- 669002c4a6f8ed0bf2e764aaa3a1a6a37c3ab8c9f194c32cede4d31befb11225
Reporting entity
- Name
- EDUCATIONAL EMPLOYEES CREDIT UNIONnorm: educational employees credit union
Victim entity
- Name
- EDUCATIONAL EMPLOYEES CREDIT UNIONnorm: educational employees credit union
Incident
- Discovered
- Dec 15, 2025
- Materiality determined
- —
- Notification sent
- May 29, 2026
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 20 weeks(137 days from discovery to filing)
- Compliance flags
- MA AG >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.