MisusePrivilege AbuseSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
Credit First National Association
bd_6fd5469bb2360448 · schema v1 · pii pii-v1
Full breach record for Credit First National Association →Credit First National Association (CFNA) disclosed a data breach involving third-party vendor United Nearshore Operations (UNO). An employee memorized customer debit card numbers, exposing non-CFNA debit card numbers, expiration dates, security codes, names, birthdates, and contact details. No passwords, SSNs, or TINs were involved. CFNA investigated, took disciplinary action, and enhanced security procedures. No fraud was detected.
Massachusetts clock⏱ MA AG >30d12 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1168-credit-first-national-association/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2026
- Raw hash
- c95b257a0bf5d1deabcf2f27294d398211acab1c67d50cdbdd2832d031e84714
Reporting entity
- Name
- Credit First National Associationnorm: credit first national
Victim entity
- Name
- Credit First National Associationnorm: credit first national
Incident
- Discovered
- Apr 7, 2026
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Insider
- MITRE ATT&CK
- T1056 Input Capture
- Threat actor
- Internal
- Initial access
- insider_action
Compliance
- Time to disclose
- 12 weeks(85 days from discovery to filing)
- Compliance flags
- MA AG >30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.