HackingStolen CredentialsData ExfiltratedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumActive
Metrowest Community Federal Credit Union
bd_5f8f7d025bc854f9 · schema v1 · pii pii-v1
Full breach record for Metrowest Community Federal Credit Union →MetroWest Community Federal Credit Union notified Vermont AG of unauthorized access to systems on Sept 3, 2025, following suspicious activity alerts starting Sept 1. Compromised data includes names, SSNs, financial account/debit card numbers, and driver's licenses. The FBI was notified. MetroWest is offering 24 months of credit monitoring via Experian. The investigation is ongoing.
Vermont clock✗ VT AG >45 bday17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
A leak claim by akira about this victim predates this filing by 65 days.View originating leak claim
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-12-29-metrowest-community-federal-credit-union-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 29, 2025
- Raw hash
- 87edf9cbbde52688efd8b3d5a6ce7ec565905a0739fde9a59a39d469d11cef22
Reporting entity
- Name
- Metrowest Community Federal Credit Unionnorm: metrowest community federal credit union
- Domain
- mwcfcu.com
Victim entity
- Name
- Metrowest Community Federal Credit Unionnorm: metrowest community federal credit union
- Domain
- mwcfcu.com
Incident
- Discovered
- Sep 1, 2025
- Materiality determined
- —
- Notification sent
- Dec 29, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- reported the event to the Federal Bureau of Investigation
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 17 weeks(119 days from discovery to filing)
- Compliance flags
- VT AG >45 bdayLeak >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.