HackingFinancial ServicesFinanceData ExfiltratedIdentity (basic)Government IDMediumContained

AOD Federal Credit Union

bd_58c00161d459e445 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2024

Filed

Mar 27, 2025

To disclose

33 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

66%

Full breach record for AOD Federal Credit Union →

AOD Federal Credit Union notified consumers of a data breach detected on August 9, 2024. Unauthorized access occurred between August 8-9, 2024, potentially exposing personal information including names and government IDs. The FBI was notified, and forensic investigators were engaged. The credit union offered complimentary credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday33 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 33 weeks / 230 days

Aug 8, 2024

Begins

Aug 9, 2024

Discovered

Mar 27, 2025

Filed

vs. sector median

+24 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Nebraska State AGbd_575f7c6c68293e562025-03-27Candidate
Maine State AGbd_e205c374a9baf0282025-03-27Verified
Indiana State AGbd_f328328d752148aa2025-03-27Verified
Massachusetts State AGbd_f90b368961e8ddbd2025-03-27Verified

Show 2 more filings ↓up to 392d gap

New Hampshire State AGbd_60597874a70e09a32025-03-31 · +4dVerified
Maryland State AGbd_6ff6b8172c292c0b2026-04-23 · +392dVerified

Name: AOD Federal Credit Union
norm: aod federal credit union

Name: AOD Federal Credit Union
norm: aod federal credit union
Industry: Financial Servicesllm

Discovered: Aug 9, 2024
Breach occurred: Aug 8, 2024 – Aug 9, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Mar 27, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Secured the environment
Reported the incident to the Federal Bureau of Investigation
Worked with external cybersecurity professionals
Offered complimentary month membership of Experian IdentityWorks Credit 3B
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(230 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Nebraska State AGMar 27 · first

Maine State AGMar 27 · first

Indiana State AGMar 27 · first

Massachusetts State AGMar 27 · first

Vermont State AGMar 27 · first · this page

New Hampshire State AG+4d

Maryland State AG+392d

Pattern: first filing Mar 27 (NE), last Apr 23 (MD) — a 392-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-03-27-aod-federal-credit-union-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2025
Raw hash: 878bb556a55ab04bd5e0aaa61054f0535d18aedc07b37e4b2b97bb2b49a17c38

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAOD Federal Credit Union

Victim entityAOD Federal Credit Union

Incidentdiscovered Aug 9, 2024

Stated responseSecured the environment

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov