HackingFinancial ServicesFinanceStolen CredentialsCapture App DataCustomer Data InvolvedDelayed DiscoveryPIILowContained
LAFAYETTE FEDERAL CREDIT UNION
bd_d80aaf6241c8160b · schema v1 · pii pii-v1
Full breach record for LAFAYETTE FEDERAL CREDIT UNION →LFCU discovered Feb 5, 2025 that an unauthorized third party accessed one employee email account on Sep 16, 2024. Personal information in the account may have been acquired. 118 Maine residents among 75,545 total affected. LFCU secured the account, engaged a forensic firm, and offered 12-month Experian IdentityWorks Credit 3B to affected individuals.
Maine clockDiscovered Feb 5, 2025 → Filed with AG Mar 20, 202543d ⏱ ME AG >30d6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_6ff5139107b80bcaCalifornia State AGfiled 2025-03-20Verified
- bd_d6cea7531eafa392Montana State AGfiled 2025-03-20Candidate
- bd_8bc2e38bdebff7f2Texas State AGfiled 2025-07-15(117d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6c038d1f-41db-4c57-9bdd-c1c7215b7eba.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 20, 2025
- Raw hash
- 2aad6c5779b8cbce00675b16f7c66a3baceec8e8e48e5d847438f7d8f7379912
Reporting entity
- Name
- LAFAYETTE FEDERAL CREDIT UNIONnorm: lafayette federal credit union
- Industry
- Financial Services
Victim entity
- Name
- LAFAYETTE FEDERAL CREDIT UNIONnorm: lafayette federal credit union
- Industry
- Financial Services
- Industry
- Financial Servicesllm
Incident
- Discovered
- Feb 5, 2025
- Materiality determined
- —
- Notification sent
- Mar 20, 2025
- Affected individuals
- 118
- Data types
- PII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- ME AG >30d · 43d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 5, 2025→ Filed with AG: Mar 20, 202543d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.