HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Financial accountLowContained

Franklin Mint Federal Credit Union

bd_423f190687b39d3b · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 1, 2023

Filed

Jul 27, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

65%

Full breach record for Franklin Mint Federal Credit Union →2 incidents on file

Franklin Mint Federal Credit Union (FMFCU) disclosed a data security incident involving the MOVEit Transfer software vulnerability. On June 1, 2023, FMFCU became aware of a CISA alert regarding a critical vulnerability in MOVEit. An investigation revealed that data belonging to FMFCU members may have been acquired without authorization. The breach date is listed as May 31, 2023. Affected data may include personal information, member numbers, and partial credit card numbers. FMFCU patched the system, engaged external experts, reported to law enforcement, and is offering 12 months of Experian IdentityWorks to affected members.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 8 weeks / 56 days

May 31, 2023

Begins

Jun 1, 2023

Discovered

Jul 27, 2023

Filed

vs. sector median

on median

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedispossessorbd_b80cb7caaa80cfab2023-07-15 · +12dVerified by operator
Leak Sitecl0pbd_5df843afb3ea92312023-07-10 · +17dVerified by operator

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_567bc1186a84f6bc2023-07-21 · +6dVerified by operator
Maine State AGbd_30006f193fe4bd032023-07-20 · +7dVerified by operator
Massachusetts State AGbd_62b1c6dd574948e62023-07-20 · +7dVerified
Indiana State AGbd_773bee6d81ed25e82023-07-20 · +7dVerified

Show 3 more filings ↓up to 7d gap

Delaware State AGbd_abe5990bc5581add2023-07-20 · +7dVerified by operator
Montana State AGbd_ad9fe53b1998dfdc2023-07-20 · +7dVerified by operator
Vermont State AGbd_c86a8670fd1794342023-07-20 · +7dVerified

Name: Franklin Mint Federal Credit Union
norm: franklin mint federal credit union
Domain: fmfcu.org

Name: Franklin Mint Federal Credit Union
norm: franklin mint federal credit union
Domain: fmfcu.org
Industry: Financial Servicesllm

Discovered: Jun 1, 2023
Breach occurred: May 31, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported the incident to law enforcement
Initial access: exploit_public_facing

During the incident: Patched its MOVEit system in accordance with the developer’s instructions
Conducted an internal assessment
Undertook a comprehensive investigation with the assistance of leading external experts
Reported the incident to law enforcement
Quarantined the affected MOVEit system
Taken all remediation measures recommended by the MOVEit software developers
Offering individuals whose information was involved in this incident complimentary access to Experian IdentityWorksSM for 12 months
Changes made: Evaluating additional safeguards that can be put in place to further enhance the security of the data entrusted to us
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGJul 20 · first

Massachusetts State AGJul 20 · first

Indiana State AGJul 20 · first

Delaware State AGJul 20 · first

Montana State AGJul 20 · first

Vermont State AGJul 20 · first

New Hampshire State AG+1d

California State AG+7d · this page

Pattern: first filing Jul 20 (ME), last Jul 27 (CA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570959
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2023
Raw hash: fa225809025efa0aee57b4cd290114ec8a5b1c2c09add36feaf437eb3adebb57

Linked disclosures

Ransomware claims (2)

Regulatory filings (7) · sorted by filing gap

Reporting entityFranklin Mint Federal Credit Union

Victim entityFranklin Mint Federal Credit Union

Incidentdiscovered Jun 1, 2023

Stated responsePatched its MOVEit system in accordance with the developer’s instructions

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov