Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

MERITUS Federal Credit Union

bd_84cd4b5a8fc40df3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 28, 2021

Filed

Nov 22, 2021

To disclose

17 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for MERITUS Federal Credit Union →

Meritus Federal Credit Union notified the NH AG of a data event affecting 1 NH resident. On July 28, 2021, an unauthorized individual accessed an employee's email account. Affected data included name and SSN. Meritus engaged forensic specialists, reviewed records, and provided 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 117 days

Jul 28, 2021

Begins

Jul 28, 2021

Discovered

Nov 22, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_1ba2e70367524d0d2021-11-17 · +5dVerified
Massachusetts State AGbd_28c4a72350656b072021-11-17 · +5dVerified
Maine State AGbd_5fe1be7948b738462021-11-17 · +5dCandidate
Montana State AGbd_a9b390ec9cb7baed2021-11-17 · +5dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: MERITUS Federal Credit Union
norm: meritus federal credit union
Domain: merituscu.net
Industry: Financial Servicesllm

Discovered: Jul 28, 2021
Breach occurred: Jul 28, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 17, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified appropriate state and federal regulators
Initial access: phishing_link

During the incident: Launched an investigation into the nature and scope of the incident with the assistance of third-party computer forensic specialists
Engaged third-party specialists to undertake a comprehensive programmatic and manual review of information stored on the impacted email account
Conducted a manual review of its records to confirm the identities of individuals potentially affected
Notified appropriate state and federal regulators
Providing access to credit monitoring services for twelve (12) months, through Experian
Changes made: Working to implement additional safeguards and training to its employees
Reviewing and enhancing its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGNov 17 · first

Massachusetts State AGNov 17 · first

Maine State AGNov 17 · first

Montana State AGNov 17 · first

New Hampshire State AG+5d · this page

Pattern: first filing Nov 17 (IN), last Nov 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/meritus-federal-credit-union-20211122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2021
Raw hash: 66fcdd93a29bc5db4cf8c3489265fe49de52d0f8953ea3712d63978610160834

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityMERITUS Federal Credit Union

Incidentdiscovered Jul 28, 2021

Stated responseLaunched an investigation into the nature and scope of the incident with the assistance of third-party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov