HackingStolen CredentialsCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Ellafi Federal Credit Union
bd_bcc8904986e14082 · schema v1 · pii pii-v1
Full breach record for Ellafi Federal Credit Union →Ellafi Federal Credit Union experienced unauthorized access to files containing personal information, including names, SSNs, and credit/debit card numbers, on October 14, 2025. The credit union engaged cybersecurity experts, notified the FBI, and is offering 12 months of complimentary identity protection services. No evidence of misuse was found.
Vermont clock✗ VT AG >45 bday11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9c226fd1cb837e14Maine State AGfiled 2025-12-27Candidate
- bd_3253b3d33844ae04New Hampshire State AGfiled 2025-12-26(1d gap)Verified
- bd_d5f35a53cb942035Indiana State AGfiled 2025-12-23(4d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-12-27-ellafi-federal-credit-union-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 27, 2025
- Raw hash
- 61e3060cf19c0912f6dba580c291fd75d08310d772b0fcb9aea3d8039877c282
Reporting entity
- Name
- Ellafi Federal Credit Unionnorm: ellafi federal credit union
Victim entity
- Name
- Ellafi Federal Credit Unionnorm: ellafi federal credit union
Incident
- Discovered
- Oct 14, 2025
- Materiality determined
- —
- Notification sent
- Dec 23, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 11 weeks(74 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.