HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

Suffolk Federal Credit Union

bd_f07e2b96a2be022e · schema v1 · pii pii-v2

Severity

Low

Discovered

Nov 7, 2025

Filed

Sep 1, 2026

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

69%

Full breach record for Suffolk Federal Credit Union →

Suffolk Credit Union notified members of a data security incident at former vendor Mercadien, P.C., CPAs. Unauthorized access occurred between September 17, 2025, and October 9, 2025, and was discovered on November 7, 2025. The incident involved personal information of Suffolk Credit Union members. The credit union engaged forensic experts, secured the environment, and offered two years of complimentary Experian IdentityWorks credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

Sep 17, 2025

Begins

Nov 7, 2025

Discovered

Sep 1, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_5318710d64f515eb2026-09-11 · +10dCandidate
Vermont State AGbd_eac5159e86a6caeb2026-09-11 · +10dVerified
Texas State AGbd_d58a2e78baf02f992026-09-15 · +14dVerified

Name: Suffolk Federal Credit Union
norm: suffolk federal credit union

Name: Suffolk Federal Credit Union
norm: suffolk federal credit union
Industry: Financial Servicesllm

Discovered: Nov 7, 2025
Breach occurred: Sep 17, 2025 – Oct 9, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Mercadien, P.C., CPAs
Initial access: trusted_relationship

During the incident: Took immediate steps to secure its environment
Began an investigation with assistance from digital forensics and cybersecurity experts
Promptly sought information from Mercadien so that we could understand the scope of the incident and notify involved individuals as soon as possible
Arranged for you to enroll in a two-year membership in Experian IdentityWorks Credit 3B
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 1 · first · this page

California State AG+10d

Vermont State AG+10d

Texas State AG+14d

Pattern: first filing Sep 1 (MA), last Sep 15 (TX) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1534-suffolk-federal-credit-union/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 7026e758088322b6bff2fceb80c9892383d3abb64fa63014217e574777fe12b6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySuffolk Federal Credit Union

Victim entitySuffolk Federal Credit Union

Incidentdiscovered Nov 7, 2025

Stated responseTook immediate steps to secure its environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov