HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (Dependency)Customer Data InvolvedFinancial accountCredentialsHighResolved

UNIVERSITY FEDERAL CREDIT UNION

bd_5b896898ca06cc29 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 15, 2023

Filed

Oct 9, 2023

To disclose

24 days

Affected · nationwide

102,65029 in this filing

Linked

4 filings

Confidence

50%

Full breach record for UNIVERSITY FEDERAL CREDIT UNION →4 incidents on file

University Federal Credit Union reported a data breach affecting 29 Maine residents. The breach, which occurred between May 7 and May 27, 2023, was discovered on September 15, 2023. The incident was a result of the MOVEit Transfer vulnerability, an external system breach. The compromised information includes names in combination with financial account or credit/debit card numbers and their associated security codes or PINs. Affected individuals were notified on October 10, 2023, and offered 12 months of credit monitoring and identity theft protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 15, 2023 → Filed with AG Oct 9, 202324d ✓ ME AG ≤30d24 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 131 days

discovery → filing · 24 days

May 7, 2023

Begins

Sep 15, 2023

Discovered

Oct 9, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_9d100ecc7e0e51842023-10-09Verified
Massachusetts State AGbd_1af9717463aa0b252023-10-10 · +1dVerified
Vermont State AGbd_f0cf02b02814adcc2023-10-10 · +1dVerified

Name: UNIVERSITY FEDERAL CREDIT UNION
norm: university federal credit union

Name: UNIVERSITY FEDERAL CREDIT UNION
norm: university federal credit union
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Sep 15, 2023
Breach occurred: May 7, 2023 – May 27, 2023
Undetected for: 131 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2023
Affected individuals: 102,650state + nationwide
Data types: Financial accountCredentials
Data elements: Financial account number
Attack vector: Unauthorized Access
Threat actor: ExternalFinancial

Changes made: Offered 12 months of credit monitoring and identity theft protection services through Experian.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: ME AG ≤30d · 24d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 15, 2023
→ Filed with AG: Oct 9, 2023
24d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 15, 2023 → Filed with AG: Oct 9, 2023	24d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGOct 9 · first

Maine State AGOct 9 · first · this page

Massachusetts State AG+1d

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/4998b188-69ac-4f44-b8d0-e581b31cb189.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2023
Raw hash: 36d01ed3ec45d6be412618e4f0b82f6c15fcd9f61553b3f39268fc5e356e2515

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUNIVERSITY FEDERAL CREDIT UNION

Victim entityUNIVERSITY FEDERAL CREDIT UNION

Incidentdiscovered Sep 15, 2023

Stated responseOffered 12 months of credit monitoring and identity theft protection services through Experian.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov