HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumResolved

Community First Credit Union

bd_e833d13a8a4c29cf · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 3, 2024

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Community First Credit Union →

Community First Credit Union notified members that an unauthorized third party accessed an employee's email account between September 6-7, 2023, in an attempt to commit financial fraud. The incident potentially exposed members' names and Social Security numbers. The investigation concluded on April 16, 2024. The credit union engaged forensic experts, secured systems, and offered complimentary identity monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 6, 2023

Begins

May 3, 2024

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_004331e874f4b3922024-05-03Verified by operator
Montana State AGbd_c03478c2c640c4192024-05-03Verified by operator
New Hampshire State AGbd_55aad7b6ff75a65e2024-05-07 · +4dVerified

Name: Community First Credit Union
norm: community first credit union

Name: Community First Credit Union
norm: community first credit union
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Sep 6, 2023 – Sep 7, 2023
Materiality determined: —
Notification sent: Apr 16, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial

During the incident: Blocked any further attempts to access the account and further secured our systems
Engaged third-party cybersecurity experts to conduct an investigation
Engaged third-party forensic and legal experts to assist in the investigation
Offering a complimentary membership of Experian IdentityWorks Credit 3B
Changes made: Continuing to carefully review and further enhance protections as part of our ongoing commitment to data security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGMay 3 · first

Montana State AGMay 3 · first

California State AGMay 3 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-584828
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2024
Raw hash: bdf53a781d0be3053c408dfa588f2bdbeb075b65f4419f283adfb2ba34691568

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCommunity First Credit Union

Victim entityCommunity First Credit Union

IncidentUnauthorized Access

Stated responseBlocked any further attempts to access the account and further secured our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov