HackingFinancial ServicesFinanceTargetedData ExfiltratedIdentity (basic)Government IDMediumContained

CROSS VALLEY FEDERAL CREDIT UNION

bd_e7b9ee333bc1faf8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 4, 2024

Filed

Mar 13, 2025

To disclose

14 weeks

Affected

15state residents only

Linked

8 filings

Confidence

67%

Full breach record for CROSS VALLEY FEDERAL CREDIT UNION →

Cross Valley Federal Credit Union notified the Maryland AG of a network intrusion discovered on Dec 4, 2024. Unauthorized access impacted names, addresses, and SSNs of 15 Maryland residents. The credit union engaged forensic investigators, secured its network, and provided credit monitoring services to affected members.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d14 weeks discovery → filing

Incident timeline

discovery → filing · 14 weeks / 99 days

Dec 4, 2024

Discovered

Mar 13, 2025

Filed

vs. sector median

+6 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_0ef8a32959bc633f2025-03-13Verified
Nebraska State AGbd_7eb9456dfc38bcf72025-03-13Verified
Massachusetts State AGbd_825de0f7519715012025-03-22 · +9dVerified
Montana State AGbd_3e85ee612d7035252025-03-23 · +10dCandidate

Show 3 more filings ↓up to 11d gap

Vermont State AGbd_5a2dd1243a17f6572025-03-23 · +10dVerified
Maine State AGbd_cd7fbb993e7577312025-03-23 · +10dVerified
New Hampshire State AGbd_92dd0552a9389e0d2025-03-24 · +11dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: CROSS VALLEY FEDERAL CREDIT UNION
norm: cross valley federal credit union
Industry: Financial Servicesllm

Discovered: Dec 4, 2024
Materiality determined: —
Notification sent: Mar 13, 2025
Affected individuals: 15state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Provided preliminary notice to Maryland Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Initiated measures to contain the intrusion and secure its environment
Engaged Wilson Elser, LLP as its legal counsel
Engaged a third-party cybersecurity firm to conduct a forensics investigation
Completed a notification list
Provided preliminary notice of the incident to regulators
Mailed notices to affected individuals
Changes made: Isolated the intrusion and secured its network environment
Implemented enhanced security training
Implemented additional protections on email links
Implemented sandboxing potential email threats
Offered free credit monitoring and identity theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Indiana State AGMar 13 · first

Nebraska State AGMar 13 · first

Maryland State AGMar 13 · first · this page

Massachusetts State AG+9d

Montana State AG+10d

Vermont State AG+10d

Maine State AG+10d

New Hampshire State AG+11d

Pattern: first filing Mar 13 (IN), last Mar 24 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376551.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2025
Raw hash: d0d52cfd628b9c646cc462f63a74240e7cc110ed0e9a823718409b2977352de0

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityCROSS VALLEY FEDERAL CREDIT UNION

Incidentdiscovered Dec 4, 2024

Stated responseInitiated measures to contain the intrusion and secure its environment

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov