HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)CredentialsMediumContained

LAFAYETTE FEDERAL CREDIT UNION

bd_b692cb281903e8c5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 5, 2025

Filed

Jul 30, 2025

To disclose

25 weeks

Affected · nationwide

77,337124 in this filing

Linked

10 filings

Confidence

66%

Full breach record for LAFAYETTE FEDERAL CREDIT UNION →

Lafayette Federal Credit Union (LFCU) issued a supplemental notice regarding an external system breach (hacking) on September 16, 2024. An unauthorized third party accessed one employee email account. LFCU discovered the incident on February 5, 2025, after a forensic review. The breach affected 77,337 individuals nationwide, including 124 Maine residents. Personal information, including names and other identifiers, was potentially acquired. LFCU secured the account, engaged forensic investigators, and offered 12 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 5, 2025 → Filed with AG Jul 30, 2025175d ⏱ ME AG >30d25 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 142 days

discovery → filing · 25 weeks / 175 days

Sep 16, 2024

Begins

Feb 5, 2025

Discovered

Jul 30, 2025

Filed

vs. sector median

+17 wks slower

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Texas State AGbd_8bc2e38bdebff7f22025-07-15 · +15dVerified
California State AGbd_025c5df977a8fe6d2025-07-14 · +16dVerified by operator
Nebraska State AGbd_58f8985131c5bdf42025-07-14 · +16dVerified by operator
California State AGbd_6ff5139107b80bca2025-03-20 · +132dVerified

Show 5 more filings ↓up to 151d gap

Nebraska State AGbd_c0296713adffca892025-03-20 · +132dVerified
Massachusetts State AGbd_ce94dbde1e7d94ab2025-03-20 · +132dVerified
Montana State AGbd_d6cea7531eafa3922025-03-20 · +132dCandidate
Maine State AGbd_d80aaf6241c8160b2025-03-20 · +132dVerified by operator
Illinois State AGbd_c604145f1bf0e4d72025-03-01 · +151dVerified by operator

Name: LAFAYETTE FEDERAL CREDIT UNION
norm: lafayette federal credit union
Domain: lfcu.org
Industry: Financial Services

Name: LAFAYETTE FEDERAL CREDIT UNION
norm: lafayette federal credit union
Domain: lfcu.org
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Feb 5, 2025
Breach occurred: Sep 16, 2024
Undetected for: 142 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2025
Affected individuals: 77,337state + nationwide
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email account
Began an internal investigation
Engaged a forensic security firm to investigate and confirm the security of our email systems
Offering a complimentary one-year membership of Experian IdentityWorks SM Credit 3B
Changes made: Further enhancing our security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(175 days from discovery to filing)
Compliance flags: ME AG >30d · 175d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 5, 2025
→ Filed with AG: Jul 30, 2025
175d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 5, 2025 → Filed with AG: Jul 30, 2025	175d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 7 states

View merged incident ↗

Illinois State AGMar 1 · first

California State AG+19d

Nebraska State AG+19d

Massachusetts State AG+19d

Montana State AG+19d

Maine State AG+19d

California State AG+135d

Nebraska State AG+135d

Texas State AG+136d

Maine State AG+151d · this page

Pattern: first filing Mar 1 (IL), last Jul 30 (ME) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/730f334a-0a37-4695-8abf-c7a761b880d7.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2025
Raw hash: ecc142f027d23a2b4afec6157eccc79b517eec34eca76f0c8c2c10da6f1f8861

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityLAFAYETTE FEDERAL CREDIT UNION

Victim entityLAFAYETTE FEDERAL CREDIT UNION

Incidentdiscovered Feb 5, 2025

Stated responseSecured the email account

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov