HackingFinancial ServicesFinanceCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHighContained

Ellafi Federal Credit Union

bd_9c226fd1cb837e14 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 20, 2025

Filed

Dec 27, 2025

To disclose

5 weeks

Affected · nationwide

17,62740 in this filing

Linked

6 filings

Confidence

65%

Full breach record for Ellafi Federal Credit Union →

Ellafi Federal Credit Union experienced an external system breach (hacking) on October 14, 2025. The incident compromised names, SSNs, and credit/debit card numbers for 17,627 individuals, including 40 Maine residents. EFCU discovered the incident on November 20, 2025, notified the FBI, and sent consumer notifications on December 23, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 20, 2025 → Filed with AG Dec 27, 202537d ⏱ ME AG >30d5 weeks discovery → filing

Incident timeline

undetected · 37 days

discovery → filing · 5 weeks / 37 days

Oct 14, 2025

Begins

Nov 20, 2025

Discovered

Dec 27, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_82a62062914256702025-12-27Verified
Vermont State AGbd_bcc8904986e140822025-12-27Verified
New Hampshire State AGbd_3253b3d33844ae042025-12-26 · +1dVerified
Nebraska State AGbd_c400386c182639e82025-12-23 · +4dVerified

Show 1 more filing ↓up to 4d gap

Indiana State AGbd_d5f35a53cb9420352025-12-23 · +4dVerified

Name: Constangy, Brooks, Smith, and Prophete
norm: constangy brooks smith and prophete

Name: Ellafi Federal Credit Union
norm: ellafi federal credit union
Industry: Financial Servicesllm

Discovered: Nov 20, 2025
Breach occurred: Oct 14, 2025
Undetected for: 37 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 23, 2025
Affected individuals: 17,627state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity experts to assist with the process
Undertook a comprehensive review of those files
Notified the Federal Bureau of Investigation
Offering complimentary identity protection services through IDX
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: ME AG >30d · 37d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 20, 2025
→ Filed with AG: Dec 27, 2025
37d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 20, 2025 → Filed with AG: Dec 27, 2025	37d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGDec 23 · first

Indiana State AGDec 23 · first

New Hampshire State AG+3d

Massachusetts State AG+4d

Vermont State AG+4d

Maine State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ecc2d8ec-8e5f-473d-9064-a5a7835d408c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 27, 2025
Raw hash: 311ccce0fe0ad6faedaf01222e4226edac1a00e3ac3fcc7d83cd299108f391a4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith, and Prophete

Victim entityEllafi Federal Credit Union

Incidentdiscovered Nov 20, 2025

Stated responseEngaged cybersecurity experts to assist with the process

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov