DisclosureLens
Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedEmployee Data InvolvedFinancial accountIdentity (basic)Government IDPCIMediumContained

FIRST HARVEST Federal Credit Union

bd_cd6c0df3fb879c20 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 3, 2026

Filed

May 6, 2026

To disclose

13 weeks

Affected

23state residents only

Linked

5 filings

Confidence

66%
Full breach record for FIRST HARVEST Federal Credit Union

First Harvest Federal Credit Union notified Massachusetts and Rhode Island residents of a security incident involving unauthorized access to an employee email account. The breach, discovered on February 3, 2026, resulted from suspicious activity likely stemming from a phishing attack on January 14, 2026. The incident exposed name data elements and potentially government identifiers (SSN, DOB, driver's license) of affected individuals. First Harvest engaged third-party forensic reviewers, enhanced security policies, and offered 12-24 months of credit monitoring via Experian. No actual misuse of information was indicated at the time of notification.

Massachusetts clock MA AG >90d13 weeks discovery → filing

Incident timeline

undetected · 20 days
discovery → filing · 13 weeks / 92 days

Jan 14, 2026

Begins

Feb 3, 2026

Discovered

May 6, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Filing propagation · 5 filings · 5 states

View merged incident ↗
Vermont State AGMay 6 · first
Maine State AGMay 6 · first
Nebraska State AGMay 6 · first
Massachusetts State AGMay 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.