HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsMediumContained

Fairmont Federal Credit Union

bd_761a3297a827ae36 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2024

Filed

Sep 18, 2025

To disclose

20 months

Affected

36state residents only

Linked

8 filings

Confidence

66%

Full breach record for Fairmont Federal Credit Union →

Fairmont Federal Credit Union (FFCU) notified New Hampshire AG John Formella of a cybersecurity incident affecting 36 NH residents. Unauthorized access occurred between September 30 and October 18, 2023. FFCU discovered the breach on January 23, 2024, and confirmed the scope on August 17, 2025. Impacted data includes names, SSNs, tax IDs, account numbers, and credit card details. FFCU engaged outside cybersecurity professionals for forensic investigation and is offering complimentary credit monitoring to affected residents.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d20 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 115 days

discovery → filing · 20 months / 604 days

Sep 30, 2023

Begins

Jan 23, 2024

Discovered

Sep 18, 2025

Filed

vs. sector median

+78 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by black_basta about this victim predates this filing by 701 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblack_bastabd_3065b6789ce4ea202023-10-18 · +701dVerified

Regulatory filings (6) · sorted by filing gap

Texas State AGbd_296cd008c0de54c12025-09-12 · +6dVerified
Maine State AGbd_0a31c3a936612f172025-09-11 · +7dVerified
Montana State AGbd_21b07e63bef16c8e2025-09-11 · +7dCandidate
Nebraska State AGbd_2ad939cf43bf74292025-09-11 · +7dVerified

Show 2 more filings ↓up to 7d gap

Massachusetts State AGbd_548cd262e7012e8c2025-09-11 · +7dVerified
California State AGbd_a6c06c435aa4a9612025-09-11 · +7dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Fairmont Federal Credit Union
norm: fairmont federal credit union
Domain: fairmontfcu.com
Industry: Financial Servicesllm

Discovered: Jan 23, 2024
Breach occurred: Sep 30, 2023 – Oct 18, 2023
Undetected for: 115 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2025
Affected individuals: 36state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Conducted an extensive forensic investigation and exhaustive manual document review
Providing the affected residents with written notification
Offering the affected residents whose Social Security numbers were impacted complimentary memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files and obtaining free credit reports
Providing the contact information for the consumer reporting agencies and the Federal Trade Commission
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 months(604 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Maine State AGSep 11 · first

Montana State AGSep 11 · first

Nebraska State AGSep 11 · first

Massachusetts State AGSep 11 · first

California State AGSep 11 · first

Texas State AG+1d

New Hampshire State AG+7d · this page

Pattern: first filing Sep 11 (ME), last Sep 18 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fairmont-federal-credit-union-20250918.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2025
Raw hash: fe42ea7f046264be676e5c0d630eabee532b0f8fa450e26579f67aabe5bb213c

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityFairmont Federal Credit Union

Incidentdiscovered Jan 23, 2024

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov