HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)MediumContained

Direct Federal Credit Union

bd_d0ba11ccea82911a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 12, 2020

Filed

Dec 18, 2020

To disclose

10 weeks

Affected

1,014state residents only

Linked

2 filings

Confidence

66%

Full breach record for Direct Federal Credit Union →7 incidents on file

Direct Federal Credit Union notified the NH Attorney General of an incident where an unauthorized user accessed one server on October 12, 2020. The access was terminated quickly. A forensic investigation concluded that names, addresses, and member numbers of 1,014 New Hampshire residents were potentially visible. Social Security numbers and dates of birth were not involved. The organization updated security protocols and enhanced technology-driven security systems.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 67 days

Oct 12, 2020

Begins

Oct 12, 2020

Discovered

Dec 18, 2020

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_b573aa1db182f6c62020-12-10 · +8dVerified

Name: Direct Federal Credit Union
norm: direct federal credit union

Name: Direct Federal Credit Union
norm: direct federal credit union
Industry: Financial Servicesllm

Discovered: Oct 12, 2020
Breach occurred: Oct 12, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 10, 2020
Affected individuals: 1,014state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notification provided to Attorney General Gordon MacDonald, Office of the Attorney General, New Hampshire

During the incident: IT team was aware of the situation less than an hour after it began
Team was able to quickly take steps to ensure that no others could access the system
Unauthorized access was terminated
Worked collaboratively with external cyber-security experts to further secure our systems
Providing the affected residents with written notification of this incident commencing on or about December 10, 2020
Advising the affected residents to always remain vigilant in reviewing financial account statements for fraudulent or irregular activity on a regular basis
Advising the affected residents about the process for placing a fraud alert and/or security freeze on their credit files and obtaining free credit reports
Providing the affected residents with the contact information for the consumer reporting agencies and the Federal Trade Commission
Changes made: Updated our manual security protocols
Enhanced our technology driven security systems and services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGDec 10 · first

New Hampshire State AG+8d · this page

Pattern: first filing Dec 10 (IN), last Dec 18 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/direct-federal-credit-union-20201218.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 18, 2020
Raw hash: ab554aa01236e49ae306eaf7c5331d29656f1f28fa295aa6b2e3a7b4c8695e7e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDirect Federal Credit Union

Victim entityDirect Federal Credit Union

Incidentdiscovered Oct 12, 2020

Stated responseIT team was aware of the situation less than an hour after it began

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov