HackingCustomer Data InvolvedPIILowResolved
Ellafi Federal Credit Union
bd_9c226fd1cb837e14 · schema v1 · pii pii-v1
Full breach record for Ellafi Federal Credit Union →Ellafi Federal Credit Union, a financial services organization, reported a data breach affecting 40 Maine residents. The breach, described as an external system breach (hacking), occurred on October 14, 2025, and was discovered on November 20, 2025. Affected individuals were notified on December 23, 2025, and offered 12 months of credit monitoring and identity protection services from IDX. The total number of individuals affected, including those outside of Maine, was 17,627.
Maine clockDiscovered Nov 20, 2025 → Filed with AG Dec 27, 202537d ⏱ ME AG >30d5 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_bcc8904986e14082Vermont State AGfiled 2025-12-27Verified
- bd_3253b3d33844ae04New Hampshire State AGfiled 2025-12-26(1d gap)Verified
- bd_d5f35a53cb942035Indiana State AGfiled 2025-12-23(4d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ecc2d8ec-8e5f-473d-9064-a5a7835d408c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 27, 2025
- Raw hash
- a61ece74f98751f866adeff7be9a4df9528e404c12b71ccf43f6fc8424d8f952
Reporting entity
- Name
- Ellafi Federal Credit Unionnorm: ellafi federal credit union
Victim entity
- Name
- Ellafi Federal Credit Unionnorm: ellafi federal credit union
Incident
- Discovered
- Nov 20, 2025
- Materiality determined
- —
- Notification sent
- Dec 23, 2025
- Affected individuals
- 40
- Data types
- PII
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 5 weeks(37 days from discovery to filing)
- Compliance flags
- ME AG >30d · 37d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Nov 20, 2025→ Filed with AG: Dec 27, 202537d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.