MalwareFinancial ServicesFinanceRansomwareData EncryptedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountEmploymentHealth (basic)PIIHighContained

Georgia Heritage Federal Credit Union

bd_e8d6d8ccf46873e6 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 10, 2025

Filed

Apr 17, 2026

To disclose

14 months

Affected · nationwide

43,07718 in this filing

Linked

10 filings

Confidence

66%

Full breach record for Georgia Heritage Federal Credit Union →3 incidents on file

Georgia Heritage Federal Credit Union experienced a ransomware incident on January 25, 2025, discovered on February 10, 2025. Unauthorized access may have exposed personal information including names, SSNs, financial account data, and health information for approximately 43,077 individuals. The credit union engaged forensic investigators, secured its network, changed credentials, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 10, 2025 → Filed with AG Apr 17, 2026431d ✗ ME AG >90d14 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 16 days

discovery → filing · 14 months / 431 days

Jan 25, 2025

Begins

Feb 10, 2025

Discovered

Apr 17, 2026

Filed

vs. sector median

+52 wks slower

This filing is one of 10 about the same incident.View merged incident

A leak claim by ransomhub about this victim predates this filing by 447 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_9b6f3394bb016a572026-04-17Verified
Vermont State AGbd_e8c28663727256b32026-04-17Verified
South Carolina State AGbd_2783e266a5f1508e2026-04-20 · +3dVerified
Texas State AGbd_1539035136c4ef1c2026-04-22 · +5dVerified

Show 5 more filings ↓up to 92d gap

New Hampshire State AGbd_5b72bcb3850642622026-04-27 · +10dVerified
Massachusetts State AGbd_cb156bc6b63d12592026-04-28 · +11dVerified
New Hampshire State AGbd_21ac0ea0be3559bf2026-05-26 · +39dVerified
Nebraska State AGbd_a9f560c529b27a0b2026-01-15 · +92dCandidate
Indiana State AGbd_fd6f4db540c1cc012026-01-15 · +92dVerified

Name: Georgia Heritage Federal Credit Union
norm: georgia heritage federal credit union
Domain: gaheritagefcu.org

Name: Georgia Heritage Federal Credit Union
norm: georgia heritage federal credit union
Domain: gaheritagefcu.org
Industry: Financial Servicesllm

Discovered: Feb 10, 2025
Breach occurred: Jan 25, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2026
Affected individuals: 43,077state + nationwide
Data types: Identity (basic)Government IDFinancial accountEmploymentHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Secured its network
Engaged a specialized third-party cybersecurity firm to conduct a comprehensive investigation
Engaged a data mining vendor to review the accessed files
Changed all user credentials
Enhanced the security measures
Changes made: Took steps to mitigate the risk of a similar event occurring in the future
Provided 12 months of complimentary credit monitoring through Experian
Provided proactive fraud assistance through HaystackID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(431 days from discovery to filing)
Compliance flags: ME AG >90d · 431dME resident >180d · 339dLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 10, 2025
→ Filed with AG: Apr 17, 2026
431d 90 days ME AG >90d
Maine
Discovered: Feb 10, 2025
→ Notified: Jan 15, 2026
339d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 10, 2025 → Filed with AG: Apr 17, 2026	431d	90 days	ME AG >90d
Maine	Discovered: Feb 10, 2025 → Notified: Jan 15, 2026	339d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Nebraska State AGJan 15 · first

Indiana State AGJan 15 · first

New Hampshire State AG+92d

Vermont State AG+92d

Maine State AG+92d · this page

South Carolina State AG+95d

Texas State AG+97d

New Hampshire State AG+102d

Massachusetts State AG+103d

New Hampshire State AG+131d

Pattern: first filing Jan 15 (NE), last May 26 (NH) — a 131-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7e34d55f-e53c-43cf-b51e-cc62332f2abd.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2026
Raw hash: 5ea50cdd14cfda3c1cae1a53e2c165a37288c1640ce48bf867170e6ca9be7f24

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityGeorgia Heritage Federal Credit Union

Victim entityGeorgia Heritage Federal Credit Union

Incidentdiscovered Feb 10, 2025

Stated responseSecured its network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov