HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

WESCOM CENTRAL CREDIT UNION

bd_1809c0affb7871cc · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 29, 2024

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for WESCOM CENTRAL CREDIT UNION →3 incidents on file

Wescom Central Credit Union notified California residents of a data breach involving a third-party vendor, Barracuda Network, Inc. A vulnerability in Barracuda's network protection solutions allowed unauthorized third-party access to data between October 30, 2022, and May 30, 2023. Wescom discovered the incident on May 19, 2023. Affected data includes names, financial account numbers, and Social Security numbers. Wescom ceased using Barracuda and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 30, 2022

Begins

Apr 29, 2024

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_42931b60724634232024-04-29Candidate

Name: WESCOM CENTRAL CREDIT UNION
norm: wescom central credit union

Name: WESCOM CENTRAL CREDIT UNION
norm: wescom central credit union
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Oct 30, 2022 – May 30, 2023
Materiality determined: —
Notification sent: Apr 9, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: supply_chain

During the incident: Ceased utilizing Barracuda immediately upon notification
Completed forensic analysis
Notified Direct Federal Credit Union
Offering 12 months of complimentary Triple Bureau Credit Monitoring/Triple Bureau Credit Report/Triple Bureau Credit Score services through Cyberscout/Identity Force
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGApr 29 · first

California State AGApr 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-584611
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2024
Raw hash: 5944ca36d5f18f4232e560579388487ba7332bbe4d203be7a81c25809840e72b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWESCOM CENTRAL CREDIT UNION

Victim entityWESCOM CENTRAL CREDIT UNION

IncidentThird-Party / Supply Chain

Stated responseCeased utilizing Barracuda immediately upon notification

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov