HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICHighContained
Workers Federal Credit Union
bd_6d885a633dd648fd · schema v1 · pii pii-v1
Full breach record for Workers Federal Credit Union →Wellness Federal Credit Union, via third-party vendor Bradford-Scott Data, LLC, experienced an external system breach (hacking) on May 19, 2023, discovered on December 10, 2023. The incident compromised the names and Social Security Numbers of 41,968 individuals, including 55 Maine residents. The credit union provided 12 months of credit monitoring and identity theft restoration services to affected individuals.
Maine clockDiscovered Dec 10, 2023 → Filed with AG Mar 8, 202489d ⏱ ME AG >30d13 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed41,968 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a962e210-669d-4c3a-93ac-f3a0aff6ab43.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 8, 2024
- Raw hash
- 8b8c2a1650367eea7ec6d6550aca6e8abc2cfd735137f075274bbb80b4e76d47
Reporting entity
- Name
- Bradford-Scott Data, LLCnorm: bradford scott data
- Industry
- technology
Victim entity
- Name
- Workers Federal Credit Unionnorm: workers federal credit union
- Industry
- financial_services
Incident
- Discovered
- Dec 10, 2023
- Materiality determined
- —
- Notification sent
- Mar 8, 2024
- Affected individuals
- 41,968
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 13 weeks(89 days from discovery to filing)
- Compliance flags
- ME AG >30d · 89dME resident >60d · 89d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 10, 2023→ Filed with AG: Mar 8, 202489d 30 days (soft) ME AG >30d Maine Discovered: Dec 10, 2023→ Notified: Mar 8, 202489d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.