HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumResolved

Community First Credit Union

bd_e833d13a8a4c29cf · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 3, 2024

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

66%

Full breach record for Community First Credit Union →3 incidents on file

Community First Credit Union notified members that an unauthorized third party accessed an employee's email account between September 6-7, 2023, in an attempt to commit financial fraud. The incident potentially exposed members' names and Social Security numbers. The investigation concluded on April 16, 2024. The credit union engaged forensic experts, secured systems, and offered complimentary identity monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Sep 6, 2023

Begins

May 3, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_4a2aec17de19da052023-05-26 · +343dVerified by operator

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_004331e874f4b3922024-05-03Verified by operator

Name: Community First Credit Union
norm: community first credit union

Name: Community First Credit Union
norm: community first credit union
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Sep 6, 2023 – Sep 7, 2023
Materiality determined: —
Notification sent: Apr 16, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial

During the incident: Blocked any further attempts to access the account and further secured our systems
Engaged third-party cybersecurity experts to conduct an investigation
Engaged third-party forensic and legal experts to assist in the investigation
Offering a complimentary membership of Experian IdentityWorks Credit 3B
Changes made: Continuing to carefully review and further enhance protections as part of our ongoing commitment to data security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 3 · first

California State AGMay 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-584828
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2024
Raw hash: bdf53a781d0be3053c408dfa588f2bdbeb075b65f4419f283adfb2ba34691568

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityCommunity First Credit Union

Victim entityCommunity First Credit Union

IncidentUnauthorized Access

Stated responseBlocked any further attempts to access the account and further secured our systems

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov