HackingVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHighContained
FIRST COMMUNITY CREDIT UNION
bd_55aad7b6ff75a65e · schema v1 · pii pii-v1
Full breach record for FIRST COMMUNITY CREDIT UNION →Community First Credit Union reported an unauthorized access incident affecting approximately 12,000 individuals. The breach, discovered on April 15, 2024, involved the exploitation of a public-facing application and compromised credentials. Affected data included names, SSNs, and financial account details. The credit union engaged forensic investigators, notified law enforcement, and offered credit monitoring to affected members.
Leak gap clock✗ Leak >180d22 days discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed12,000 affectedView incident
A leak claim by alphv about this victim predates this filing by 347 days.View originating leak claim
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/community-first-credit-union-20240507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 7, 2024
- Raw hash
- 8bb9f87280ed68343cbe14b3c92e922097b7f52061d22de2f0f0807334dbc2af
Reporting entity
- Name
- FIRST COMMUNITY CREDIT UNIONnorm: first community credit union
Victim entity
- Name
- FIRST COMMUNITY CREDIT UNIONnorm: first community credit union
Incident
- Discovered
- Apr 15, 2024
- Materiality determined
- —
- Notification sent
- May 7, 2024
- Affected individuals
- 12,000
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 22 days(22 days from discovery to filing)
- Compliance flags
- Leak >180d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.