Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSMediumContained
FIRST HARVEST Federal Credit Union
bd_e5b9567f26b08d41 · schema v1 · pii pii-v1
Full breach record for FIRST HARVEST Federal Credit Union →First Harvest Federal Credit Union notified the NH AG of a data event affecting 16 NH residents. An unknown actor accessed an employee email account on Jan 14, 2026, after suspicious activity was detected on Feb 3, 2026. Data potentially exposed included names, SSNs, and financial/payment card info. The credit union provided 12 months of credit monitoring via Kroll/Experian and notified regulators.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_09b41c7ea1244482Vermont State AGfiled 2026-05-06Verified
- bd_9b5f4fdfe0bffc64Maine State AGfiled 2026-05-06Verified
- bd_cd6c0df3fb879c20Massachusetts State AGfiled 2026-05-01(5d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/first-harvest-federal-credit-union-20260506.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 6, 2026
- Raw hash
- 47c95150e587205f3db8889cc3e9c9d5ce0129504a9db84c9c06094ae29a4706
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- FIRST HARVEST Federal Credit Unionnorm: first harvest federal credit union
- Domain
- firstharvestcu.com
Incident
- Discovered
- Feb 3, 2026
- Materiality determined
- —
- Notification sent
- May 6, 2026
- Affected individuals
- 16
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
- Initial access
- phishing_link
Compliance
- Time to disclose
- 13 weeks(92 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.