PhysicalFinancial ServicesFinanceSkimmerCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Boeing Employees' Credit Unioin

bd_bf31ad3565d8eb2e · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 1, 2020

Filed

Jun 9, 2020

To disclose

10 weeks

Affected

1state residents only

Confidence

63%

Full breach record for Boeing Employees' Credit Unioin →

Boeing Employees' Credit Union (BECU) notified members of a data security incident involving deep insert skimmers installed at six Washington state ATM locations. The skimmers, active between April and June 2020, compromised card numbers, CVVs, PINs, and expiration dates. BECU reversed fraudulent transactions, issued new cards/PINs, and deployed fraud detection technology. No SSN or government ID data was compromised.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

Apr 1, 2020

Begins

Apr 1, 2020

Discovered

Jun 9, 2020

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Boeing Employees' Credit Unioin
norm: boeing employees credit unioin
Domain: becu.org

Name: Boeing Employees' Credit Unioin
norm: boeing employees credit unioin
Domain: becu.org
Industry: Financial Servicesllm

Discovered: Apr 1, 2020
Breach occurred: Apr 1, 2020 – Jun 30, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unknown
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial

During the incident: Deployed technology to help identify and decline potentially fraudulent transactions
Reversed unauthorized transactions and credited affected accounts
Issued new cards to affected members
Issuing new cards and PINs to all affected members
Changes made: Bolstering ATM security using information uncovered during investigation
Routinely taking steps to increase security of ATMs to keep up with industry standards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Boeing-Consumer.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 9, 2020
Raw hash: d150d8a4b7b5e9e5ff4af8f37664cf841e20e31346d59ac7b63e241f486f9b51

Reporting entityBoeing Employees' Credit Unioin

Victim entityBoeing Employees' Credit Unioin

Incidentdiscovered Apr 1, 2020

Stated responseDeployed technology to help identify and decline potentially fraudulent transactions

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov