HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDCriticalContained

1ST MIDAMERICA CREDIT UNION

bd_275f4715bec7cc1d · schema v1 · pii pii-v1

Severity

Critical

Discovered

Aug 14, 2025

Filed

Jan 30, 2026

To disclose

24 weeks

Affected · nationwide

131,0707 in this filing

Linked

7 filings

Confidence

66%

Full breach record for 1ST MIDAMERICA CREDIT UNION →3 incidents on file

1st MidAmerica Credit Union (MACU) reported a data breach affecting 131,070 individuals, including 7 Maine residents. The incident involved unauthorized access to vendor Marquis Software Solutions' network on August 14, 2025, exposing names and Social Security Numbers. MACU notified affected individuals on January 22, 2026, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockScope identified Nov 24, 2025 → Filed with AG Jan 30, 202667d ⏱ ME AG >30d24 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 24 weeks / 169 days

Aug 14, 2025

Begins

Aug 14, 2025

Discovered

Jan 30, 2026

Filed

vs. sector median

+16 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Part of Marquis Software Solutions, Inc. supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_d41974d707bdedf72026-01-30Verified
Texas State AGbd_30a6ecedbb016c462026-02-02 · +3dVerified
New Hampshire State AGbd_4a0e035dbcce10e12026-02-02 · +3dVerified
Indiana State AGbd_76d756860b4047a32026-01-22 · +8dCandidate

Show 2 more filings ↓up to 30d gap

Nebraska State AGbd_8357d148dea927b52026-01-22 · +8dVerified
Illinois State AGbd_5d6294648734975e2026-03-01 · +30dVerified

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: 1ST MIDAMERICA CREDIT UNION
norm: 1st midamerica credit union
Industry: Financial Servicesllm

Discovered: Aug 14, 2025
Scope identified: Nov 24, 2025Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “On November 24, 2025, we determined that the data of seven (7) Maine residents whose personal information was controlled by MACU was included in those certain files.”
Breach occurred: Aug 14, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 22, 2026
Affected individuals: 131,070state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maine Office of Attorney General
Initial access: supply_chain

During the incident: Launched an investigation
Enhanced security controls on its network
Reviewing its policies
Offering 24 months of credit monitoring, fraud consultation, and identity theft restoration services through Epiq
Reported this incident to the three major credit reporting agencies Experian, Equifax, and TransUnion
Changes made: Enhanced security controls on its network
Reviewing its policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: ME AG >30d · 67d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Nov 24, 2025
→ Filed with AG: Jan 30, 2026
67d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Nov 24, 2025 → Filed with AG: Jan 30, 2026	67d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGJan 22 · first

Nebraska State AGJan 22 · first

Vermont State AG+8d

Maine State AG+8d · this page

Texas State AG+11d

New Hampshire State AG+11d

Illinois State AG+38d

Pattern: first filing Jan 22 (IN), last Mar 1 (IL) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a673f5bb-a5a8-4406-b516-a851f5b0b0e2.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2026
Raw hash: 3c63a513514d0348fdcf5b08466d6ac65ac98db56a560dffcacd1696e4bf362f

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entity1ST MIDAMERICA CREDIT UNION

Incidentdiscovered Aug 14, 2025

Stated responseLaunched an investigation

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov