MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

Alaska USA Federal Credit Union

bd_7de055b56b5cd102 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 2, 2022

Filed

Jul 25, 2022

To disclose

8 weeks

Affected

2,262state residents only

Confidence

69%

Alaska USA Federal Credit Union, a customer of Kaye-Smith Enterprises, Inc., experienced a ransomware attack. Unauthorized access occurred between May 18 and June 2, 2022. The breach was discovered on June 2, 2022. Data exfiltrated included names, addresses, member numbers, account numbers, VINs, and collateral. 2,262 Washington residents were notified on August 22, 2022.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 15 days

discovery → filing · 8 weeks / 53 days

May 18, 2022

Begins

Jun 2, 2022

Discovered

Jul 25, 2022

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,262 affectedView incident

Name: Kaye-Smith
norm: kaye smith

Name: Alaska USA Federal Credit Union
norm: alaska usa federal credit union
Industry: Financial Servicesllm

Discovered: Jun 2, 2022
Breach occurred: May 18, 2022 – Jun 2, 2022
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 22, 2022
Affected individuals: 2,262state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General

During the incident: Engaged outside experts to investigate suspicious activity
Notified federal law enforcement
Deployed enhanced security measures and endpoint monitoring and detection
Sent written notice to affected members
Changes made: Enhanced security measures and monitoring
Offered complementary credit monitoring and identity theft services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15777.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2022
Raw hash: 3cb86b53259d07c486dae3686f71d30ab32d5aa19095d563b59935d06066c0ac

Reporting entityKaye-Smith

Victim entityAlaska USA Federal Credit Union

Incidentdiscovered Jun 2, 2022

Stated responseEngaged outside experts to investigate suspicious activity

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com