DisclosureLens
HackingSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

IRCO COMMUNITY FEDERAL CREDIT UNION

bd_8aab22296f59d0f4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2025

Filed

Jul 2, 2026

To disclose

34 weeks

Affected

9state residents only

Confidence

66%
Full breach record for IRCO COMMUNITY FEDERAL CREDIT UNION →

IRCO Community Federal Credit Union notified Massachusetts residents of a data breach involving its former vendor, Mercadien P.C. On November 7, 2025, Mercadien detected unauthorized access to its Box environment, which contained files with personal information of IRCO individuals. IRCO states its own systems were not impacted. The incident involved names. IRCO is offering complimentary credit monitoring via Experian IdentityWorks.

Massachusetts clock✗ MA AG >90d34 weeks discovery → filing

Incident timeline

discovery → filing · 34 weeks / 237 days

Nov 7, 2025

Discovered

Jul 2, 2026

Filed

Part of Mercadien, P.C. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.