HackingIDENTITY_BASICLowContained
IRCO COMMUNITY FEDERAL CREDIT UNION
bd_8aab22296f59d0f4 · schema v1 · pii pii-v1
Full breach record for IRCO COMMUNITY FEDERAL CREDIT UNION →IRCO Community Federal Credit Union notified Massachusetts residents of a data breach involving its former vendor, Mercadien P.C. On November 7, 2025, Mercadien detected unauthorized access to its Box environment, which contained files with personal information of IRCO individuals. IRCO states its own systems were not impacted. The incident involved names. IRCO is offering complimentary credit monitoring via Experian IdentityWorks.
Massachusetts clock✗ MA AG >90d29 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1077-irco-community-federal-credit-union-irco/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 993dbe10ddba46ec6f9595b16e81c50ccdf9302dca81e5c2e1cf2c970664384b
Reporting entity
- Name
- IRCO COMMUNITY FEDERAL CREDIT UNIONnorm: irco community federal credit union
Victim entity
- Name
- IRCO COMMUNITY FEDERAL CREDIT UNIONnorm: irco community federal credit union
Incident
- Discovered
- Nov 7, 2025
- Materiality determined
- —
- Notification sent
- Jul 2, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via Mercadien P.C.
- Initial access
- supply_chain
Compliance
- Time to disclose
- 29 weeks(206 days from discovery to filing)
- Compliance flags
- MA AG >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.