HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Financial accountLowContained

Suffolk Federal Credit Union

bd_5318710d64f515eb · schema v1 · pii pii-v2

Severity

Low

Discovered

Nov 7, 2025

Filed

Sep 11, 2026

To disclose

44 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

69%

Full breach record for Suffolk Federal Credit Union →

Suffolk Federal Credit Union notified members of a data breach involving a former vendor, Mercadien, P.C., CPAs. Unauthorized access to Mercadien's systems occurred between September 17, 2025, and October 9, 2025, and was discovered on November 7, 2025. The incident may have exposed personal information including names, addresses, and financial account details. Suffolk Credit Union's own systems were not compromised. Affected individuals are offered one year of complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 7, 2025 → Notified Sep 11, 2026308d ✗ CA 60-day late44 weeks discovery → filing

Incident timeline

undetected · 51 days

discovery → filing · 44 weeks / 308 days

Sep 17, 2025

Begins

Nov 7, 2025

Discovered

Sep 11, 2026

Filed

vs. sector median

+36 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_eac5159e86a6caeb2026-09-11Verified
Texas State AGbd_d58a2e78baf02f992026-09-15 · +4dVerified
Massachusetts State AGbd_f07e2b96a2be022e2026-09-01 · +10dVerified

Name: Suffolk Federal Credit Union
norm: suffolk federal credit union

Name: Suffolk Federal Credit Union
norm: suffolk federal credit union
Industry: Financial Servicesllm

Discovered: Nov 7, 2025
Breach occurred: Sep 17, 2025 – Oct 9, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Mercadien, P.C., CPAs
Initial access: trusted_relationship

During the incident: Took immediate steps to secure its environment
Began an investigation with assistance from digital forensics and cybersecurity experts
Promptly sought information from Mercadien so that we could understand the scope of the incident
Arranged for you to enroll in a one-year membership in Experian IdentityWorks Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(308 days from discovery to filing)
Compliance flags: CA 60-day late · 308d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 7, 2025
→ Notified: Sep 11, 2026
308d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 7, 2025 → Notified: Sep 11, 2026	308d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Vermont State AG+10d

California State AG+10d · this page

Texas State AG+14d

Pattern: first filing Sep 1 (MA), last Sep 15 (TX) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-629581
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2026
Raw hash: bc2c5d1f5f54426cb3395e45da1df638e4ba984fef1ea21a7b9d37945a206924

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySuffolk Federal Credit Union

Victim entitySuffolk Federal Credit Union

Incidentdiscovered Nov 7, 2025

Stated responseTook immediate steps to secure its environment

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov