HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

UNIVERSITY FEDERAL CREDIT UNION

bd_f0cf02b02814adcc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2023

Filed

Oct 10, 2023

To disclose

25 days

Affected

Not disclosed

Linked

4 filings

Confidence

67%

Full breach record for UNIVERSITY FEDERAL CREDIT UNION →4 incidents on file

University Federal Credit Union (UFCU) notified consumers on October 10, 2023, of a data breach involving its vendor, Progress Software's MOVEit transfer platform. The incident, discovered on September 15, 2023, involved unauthorized access to files containing member personal information (including SSNs) copied from the MOVEit platform. No evidence of financial fraud was found. UFCU engaged third-party investigators and offered 12 months of credit monitoring. The breach affects members across multiple US states.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday25 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 107 days

discovery → filing · 25 days

May 31, 2023

Begins

Sep 15, 2023

Discovered

Oct 10, 2023

Filed

vs. sector median

6 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_1af9717463aa0b252023-10-10Verified
Maine State AGbd_5b896898ca06cc292023-10-09 · +1dCandidate
California State AGbd_9d100ecc7e0e51842023-10-09 · +1dVerified

Name: UNIVERSITY FEDERAL CREDIT UNION
norm: university federal credit union

Name: UNIVERSITY FEDERAL CREDIT UNION
norm: university federal credit union
Industry: Financial Servicesllm

Discovered: Sep 15, 2023
Breach occurred: May 31, 2023
Undetected for: 107 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Progress Software (MOVEit)
Initial access: supply_chain

During the incident: Engaged third-party professionals to assist in due diligence
Offering complimentary access to Experian IdentityWorks for 12 months
Changes made: Continually evaluate and modify practices and internal controls to prioritize privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 days(25 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGOct 9 · first

California State AGOct 9 · first

Massachusetts State AG+1d

Vermont State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-10-10-university-federal-credit-union-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2023
Raw hash: fc9679dcdc5c09f4dc98b95411928fdbe8758bf7810d27762b80b4ddf27bb381

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityUNIVERSITY FEDERAL CREDIT UNION

Victim entityUNIVERSITY FEDERAL CREDIT UNION

Incidentdiscovered Sep 15, 2023

Stated responseEngaged third-party professionals to assist in due diligence

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov