Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Government IDHighResolved

WESTERRA CREDIT UNION

bd_895b15c5a4022a49 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 24, 2022

Filed

Jul 19, 2022

To disclose

25 days

Affected · nationwide

8,7133 in this filing

Linked

2 filings

Confidence

50%

Full breach record for WESTERRA CREDIT UNION →2 incidents on file

Westerra Credit Union reported a phishing incident that occurred between February 25, 2022, and March 2, 2022. The breach was discovered on June 24, 2022. The breach affected 3 Maine residents and involved the acquisition of names and Social Security Numbers. The company offered identity protection services to those affected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 24, 2022 → Filed with AG Jul 19, 202225d ✓ ME AG ≤30d25 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 119 days

discovery → filing · 25 days

Feb 25, 2022

Begins

Jun 24, 2022

Discovered

Jul 19, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_e931d17b035e43b32022-07-19Verified

Name: WESTERRA CREDIT UNION
norm: westerra credit union

Name: WESTERRA CREDIT UNION
norm: westerra credit union
Industry: Financial Servicesllm

Discovered: Jun 24, 2022
Breach occurred: Feb 25, 2022 – Mar 2, 2022
Undetected for: 119 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 19, 2022
Affected individuals: 8,713state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
Threat actor: External

Changes made: Offered Experian Identity Works Credit 3B identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: ME AG ≤30d · 25d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 24, 2022
→ Filed with AG: Jul 19, 2022
25d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 24, 2022 → Filed with AG: Jul 19, 2022	25d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGJul 19 · first

Maine State AGJul 19 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a5f63fa4-f2fd-4eb3-90ed-361d7a558fdf.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 19, 2022
Raw hash: 236248ab848002eece4544dbab645efd4980a0ca178c4dd1283a4a5a7fee1094

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWESTERRA CREDIT UNION

Victim entityWESTERRA CREDIT UNION

Incidentdiscovered Jun 24, 2022

Stated responseOffered Experian Identity Works Credit 3B identity protection services

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov