HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumActive

TEXAS DOW EMPLOYEES CREDIT UNION

bd_b2e7dac90834b113 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 30, 2024

Filed

Aug 23, 2024

To disclose

24 days

Affected

47state residents only

Linked

7 filings

Confidence

66%

Full breach record for TEXAS DOW EMPLOYEES CREDIT UNION →

Texas Dow Employees Credit Union (TDECU) notified the NH Attorney General of a third-party data breach involving the MOVEit transfer tool. The bad actor accessed TDECU member files between May 29-31, 2023. TDECU discovered the compromise on July 30, 2024. Approximately 47 New Hampshire residents were affected. TDECU engaged external cybersecurity professionals, confirmed no broader network compromise, and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 428 days

discovery → filing · 24 days

May 29, 2023

Begins

Jul 30, 2024

Discovered

Aug 23, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_1caca9cfdc469dff2024-08-23Verified
Massachusetts State AGbd_275ff264b853e3ce2024-08-23Verified
Maine State AGbd_435c6c0784b230ee2024-08-23Verified by operator
Indiana State AGbd_634c94500f5b12582024-08-23Verified

Show 2 more filings ↓

Vermont State AGbd_88e3b57d2d281e642024-08-23Verified
Montana State AGbd_e658683972919e3c2024-08-23Candidate

Name: TEXAS DOW EMPLOYEES CREDIT UNION
norm: texas dow employees credit union

Name: TEXAS DOW EMPLOYEES CREDIT UNION
norm: texas dow employees credit union
Industry: Financial Servicesllm

Discovered: Jul 30, 2024
Breach occurred: May 29, 2023 – May 31, 2023
Undetected for: 428 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 23, 2024
Affected individuals: 47state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General John Formella, Office of the Attorney General, Consumer Protection Bureau
Initial access: supply_chain

During the incident: Engaged external cybersecurity professionals to investigate
Determined there was no compromise of TDECU’s broader network security
Located the most recent contact information for the impacted individuals
Provided notice to affected individuals
Set up a dedicated and confidential toll-free response line
Providing complimentary access to Experian IdentityWorks for 12 months
Changes made: Continually evaluate and modify practices and controls to enhance security and privacy
MOVEit has represented that the vulnerability exploited in this attack has been fixed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGAug 23 · first

Massachusetts State AGAug 23 · first

Maine State AGAug 23 · first

Indiana State AGAug 23 · first

Vermont State AGAug 23 · first

Montana State AGAug 23 · first

New Hampshire State AGAug 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/texas-dow-employees-credit-union-20240823.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2024
Raw hash: 61384907a74403cdbbca6b3c7cad3de0676e0046501a150174bc408fedbf24ec

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityTEXAS DOW EMPLOYEES CREDIT UNION

Victim entityTEXAS DOW EMPLOYEES CREDIT UNION

Incidentdiscovered Jul 30, 2024

Stated responseEngaged external cybersecurity professionals to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov