HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

FAIRWINDS CREDIT UNION

bd_87801b1cf8b4ab31 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 7, 2025

Filed

Sep 23, 2026

To disclose

46 weeks

Affected

92state residents only

Linked

4 filings

Confidence

69%

Full breach record for FAIRWINDS CREDIT UNION →2 incidents on file

Fairwinds Credit Union notified the NH Attorney General of a third-party cybersecurity incident involving vendor Mercadien. An unauthorized actor accessed Mercadien's systems between September 7, 2025, and November 7, 2025. Mercadien identified the incident on November 7, 2025, and notified Fairwinds on August 13, 2026. Personal information of 92 New Hampshire residents, including names, SSNs, financial account info, and driver's license numbers, may have been accessed. Fairwinds terminated its relationship with Mercadien and is providing 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 61 days

discovery → filing · 46 weeks / 320 days

Sep 7, 2025

Begins

Nov 7, 2025

Discovered

Sep 23, 2026

Filed

vs. sector median

+38 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Part of Mercadien, P.C. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_034f71279b639d882026-09-23Verified
California State AGbd_fecaca497b44987b2026-09-23Verified
Texas State AGbd_05e8cef4512254672026-09-25 · +2dVerified

Name: Fairwinds Credit Union
norm: fairwinds credit union

Name: FAIRWINDS CREDIT UNION
norm: fairwinds credit union
Industry: Financial Servicesllm

Discovered: Nov 7, 2025
Breach occurred: Sep 7, 2025 – Nov 7, 2025
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2026
Affected individuals: 92state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney GeneralNotified federal law enforcementProviding written notice to relevant state and federal regulators
Third party: via Mercadien
Initial access: supply_chain

During the incident: Undertook an additional review to validate the impacted population
Notified federal law enforcement regarding the event
Providing access to credit monitoring and identity protection services for twelve (12) months, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators
Providing written notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Terminated our relationship with Mercadien as a result of this incident
Changes made: Providing complimentary credit monitoring, identity restoration, and identity theft insurance services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(320 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 23 · first

California State AGSep 23 · first

New Hampshire State AGSep 23 · first · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fairwinds-credit-union-20260923.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2026
Raw hash: 24b4464a7ad6d529033e66e9b11f472b510e231f7d427c305f56030e34080022

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFairwinds Credit Union

Victim entityFAIRWINDS CREDIT UNION

Incidentdiscovered Nov 7, 2025

Stated responseUndertook an additional review to validate the impacted population

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov