HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedGovernment IDFinancial accountPIIMediumContained

Envision Credit Union

bd_4e8029084e94bab8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 5, 2021

Filed

Jan 28, 2022

To disclose

25 weeks

Affected

12state residents only

Linked

4 filings

Confidence

65%

Full breach record for Envision Credit Union →2 incidents on file

Envision Credit Union notified Montana residents of unauthorized access to personal information occurring August 5-7, 2021. Data accessed included SSNs, financial account info, payment card info, and government IDs. The credit union engaged IT vendors for investigation, isolated systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 176 days

Aug 5, 2021

Begins

Aug 5, 2021

Discovered

Jan 28, 2022

Filed

vs. sector median

+17 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_362e23a26151394b2022-01-28Verified
Maine State AGbd_88b118426f3f1d5e2022-01-28Verified by operator
Massachusetts State AGbd_b1d795ba5fde6de02022-01-28Verified

Name: Envision Credit Union
norm: envision credit union

Name: Envision Credit Union
norm: envision credit union
Industry: Financial Servicesllm

Discovered: Aug 5, 2021
Breach occurred: Aug 5, 2021 – Aug 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 20, 2022
Affected individuals: 12state-resident count only
Data types: Government IDFinancial accountPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Initiated our information technology (IT) vendor to investigate and isolate the impacted area
Launched an internal investigation to confirm the full nature and scope of the incident
Conducted a clean sweep of our systems
Offering you access to complimentary credit monitoring and identity protection services provided through Experian
Changes made: Reviewed our existing policies and procedures regarding cybersecurity
Working to evaluate additional measures and safeguards to protect against this type of incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJan 28 · first

Maine State AGJan 28 · first

Massachusetts State AGJan 28 · first

Montana State AGJan 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-200.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 28, 2022
Raw hash: 2b95165389dd1f2dd5f5ff7aff6837714adbcc36d845486c250ca465401887da

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityEnvision Credit Union

Victim entityEnvision Credit Union

Incidentdiscovered Aug 5, 2021

Stated responseInitiated our information technology (IT) vendor to investigate and isolate the impacted area

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov