Social EngineeringFinancial ServicesFinancePhishingTargetedPIIIdentity (basic)LowResolved

Sequoia Federal Credit Union

bd_a93bccfda0ae861b · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 16, 2022

Filed

Dec 24, 2022

To disclose

19 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Sequoia Federal Credit Union →

Sequoia Federal Credit Union notified Montana residents of a security incident where an unauthorized individual accessed an employee email account between July 13 and August 16, 2022. The investigation concluded on December 7, 2022, revealing that full names were compromised. The credit union engaged outside cybersecurity professionals and offered 12 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 34 days

discovery → filing · 19 weeks / 130 days

Jul 13, 2022

Begins

Aug 16, 2022

Discovered

Dec 24, 2022

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_2e56906afdf11c022022-12-24Candidate
Indiana State AGbd_0181ba8c4655acd82022-12-23 · +1dVerified

Name: Sequoia Federal Credit Union
norm: sequoia federal credit union

Name: Sequoia Federal Credit Union
norm: sequoia federal credit union
Industry: Financial Servicesllm

Discovered: Aug 16, 2022
Breach occurred: Jul 13, 2022 – Aug 16, 2022
Undetected for: 34 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Launched an investigation in consultation with outside cybersecurity professionals
Offering a complimentary 12-month membership of Experian’s® IdentityWorksSM
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(130 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGDec 23 · first

California State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-29.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 24, 2022
Raw hash: b7a7f915adb4d5447238827a1abbb3adc155cd29f8247641e0de9a9679468a1d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySequoia Federal Credit Union

Victim entitySequoia Federal Credit Union

Incidentdiscovered Aug 16, 2022

Stated responseLaunched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov