HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
UNIVERSITY FEDERAL CREDIT UNION
bd_9d100ecc7e0e5184 · schema v1 · pii pii-v1
Full breach record for UNIVERSITY FEDERAL CREDIT UNION →University Federal Credit Union notified members that their personal information, potentially including Social Security numbers, was accessed via a global data security event affecting the MOVEit file transfer software vendor. The breach occurred between May 27 and May 31, 2023, and was discovered on September 15, 2023. Files were copied and removed from the MOVEit platform by an unauthorized party. UFCU engaged third-party professionals and is offering 12 months of complimentary identity monitoring through Experian.
California clockDiscovered Sep 15, 2023 → Notified Oct 10, 202325d ✓ CA 60-day OK24 days discovery → filing
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_5b896898ca06cc29Maine State AGfiled 2023-10-09Candidate
- bd_f0cf02b02814adccVermont State AGfiled 2023-10-10(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-574827
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 9, 2023
- Raw hash
- ff61c1bf2734b24f087d92ad8a316985ff91b593d4d4a3ce59340a3a612946ae
Reporting entity
- Name
- UNIVERSITY FEDERAL CREDIT UNIONnorm: university federal credit union
Victim entity
- Name
- UNIVERSITY FEDERAL CREDIT UNIONnorm: university federal credit union
Incident
- Discovered
- Sep 15, 2023
- Materiality determined
- —
- Notification sent
- Oct 10, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 24 days(24 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 25d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 15, 2023→ Notified: Oct 10, 202325d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.