HackingFinancial ServicesFinanceStolen CredentialsCapture App DataCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDMediumContained

KEYPOINT Credit Union

bd_82ec30846eb09bfe · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Dec 9, 2020

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

69%

Full breach record for KEYPOINT Credit Union →

KeyPoint Credit Union notified affected individuals of a data breach in which an unauthorized third party gained access to an employee email account in August 2020. The incident was contained to a single email account. On October 28, 2020, a forensic review determined that the email account contained personal information including names and at least one additional variable data element (e.g., SSN per the notice template). One year of Experian IdentityWorks Credit 3B was offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 13, 2020

Begins

Dec 9, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_7af2d9f4171182c62020-12-09Verified

Name: KEYPOINT Credit Union
norm: keypoint credit union

Name: KEYPOINT Credit Union
norm: keypoint credit union
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Aug 13, 2020
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Promptly reset the credentials of the compromised email account to prevent further access
Retained a leading forensic security firm to investigate and conduct a comprehensive search for any personal information in the impacted email account and to confirm the security of our email and computer systems
Offering a complimentary one-year membership of Experian IdentityWorks Credit 3B
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGDec 9 · first

California State AGDec 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-196989
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2020
Raw hash: a64671fa140931dc2522a6dfcae12eec1451f63b1fae58c72b21d68e28220d1a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKEYPOINT Credit Union

Victim entityKEYPOINT Credit Union

IncidentUnauthorized Access

Stated responsePromptly reset the credentials of the compromised email account to prevent further access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov