HackingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Ellafi Federal Credit Union
bd_3253b3d33844ae04 · schema v1 · pii pii-v1
Full breach record for Ellafi Federal Credit Union →Ellafi Federal Credit Union notified the New Hampshire Attorney General of a data security incident affecting approximately 49 NH residents. Unauthorized access to systems occurred around October 14, 2025, with confirmation of accessed PII (names, SSNs, card numbers) on November 20, 2025. Notifications were sent on December 23, 2025. The credit union engaged forensic experts, notified the FBI, and provided 12 months of credit monitoring via IDX.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9c226fd1cb837e14Maine State AGfiled 2025-12-27(1d gap)Candidate
- bd_bcc8904986e14082Vermont State AGfiled 2025-12-27(1d gap)Verified
- bd_d5f35a53cb942035Indiana State AGfiled 2025-12-23(3d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/ellafi-federal-credit-union-20251226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 26, 2025
- Raw hash
- d82b020fad57d255f2146e3213cf2f3d7ba9c535447154c2a163de438d248fcb
Reporting entity
- Name
- Constangy, Brooks, Smith & Prophete, LLPnorm: constangy brooks smith prophete
Victim entity
- Name
- Ellafi Federal Credit Unionnorm: ellafi federal credit union
Incident
- Discovered
- Oct 14, 2025
- Materiality determined
- —
- Notification sent
- Dec 23, 2025
- Affected individuals
- 49
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified the Federal Bureau of Investigation and will cooperate with any resulting investigation
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 10 weeks(73 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.