HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountHighContained

Alaska Air Group Federal Credit Union

bd_e65e6ed6cee14458 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 5, 2026

Filed

Apr 17, 2026

To disclose

6 weeks

Affected

5,092state residents only

Linked

9 filings

Confidence

69%

Full breach record for Alaska Air Group Federal Credit Union →

Alaska Air Group Federal Credit Union notified WA AG of a third-party IT provider breach affecting 5,092 WA residents. Unauthorized actors accessed systems between March 9, 2026, after being detected on March 5, 2026. Data included SSNs, DOBs, driver's licenses, and financial account numbers. Notices sent April 16, 2026.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

Mar 9, 2026

Begins

Apr 17, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_280fdc00e92257fe2026-04-17Verified
Massachusetts State AGbd_335c6981a3c74afe2026-04-17Verified
California State AGbd_5e0a3bd92e5350802026-04-17Verified
Vermont State AGbd_869dab11152c8f642026-04-17Verified

Show 4 more filings ↓up to 1d gap

Maine State AGbd_b58902d8252995392026-04-17Verified
Indiana State AGbd_34559bdc6ddc4ce52026-04-16 · +1dCandidate
New Hampshire State AGbd_437e2f1386c30f9c2026-04-16 · +1dVerified
Montana State AGbd_b708e0d4efd7f6da2026-04-16 · +1dVerified

Name: Alaska Air Group Federal Credit Union
norm: alaska air group federal credit union

Name: Alaska Air Group Federal Credit Union
norm: alaska air group federal credit union
Industry: Financial Servicesllm

Discovered: Mar 5, 2026
Breach occurred: Mar 9, 2026
Materiality determined: —
Notification sent: Apr 16, 2026
Affected individuals: 5,092state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoing
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Third party: via third-party information technology (IT) service provider
Initial access: supply_chain

During the incident: Initiated an investigation with the assistance of cybersecurity experts
Resecured AAGCU’s IT environment
Installed monitoring capabilities on its IT systems to detect suspicious activity
Implementing additional safeguards
Offered potentially affected individuals two years of complimentary credit protection and monitoring services through Experian
Changes made: Installed monitoring capabilities on its IT systems to detect suspicious activity
Implementing additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Indiana State AGApr 16 · first

New Hampshire State AGApr 16 · first

Montana State AGApr 16 · first

Oregon State AG+1d

Massachusetts State AG+1d

California State AG+1d

Vermont State AG+1d

Maine State AG+1d

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37803.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2026
Raw hash: 4eff1acf7928fc6156842bde8ee4de5e71b8147a1d4b34941a1725471fbfc1c7

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityAlaska Air Group Federal Credit Union

Victim entityAlaska Air Group Federal Credit Union

Incidentdiscovered Mar 5, 2026

Stated responseInitiated an investigation with the assistance of cybersecurity experts

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com