HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)Government IDFinancial accountMediumContained

FAIRWINDS CREDIT UNION

bd_fecaca497b44987b · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 13, 2026

Filed

Sep 23, 2026

To disclose

6 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

69%

Full breach record for FAIRWINDS CREDIT UNION →2 incidents on file

Fairwinds Credit Union notified members that an unauthorized actor accessed information within the systems of its external vendor, Mercadien, P.C. CPAs, between September 7 and November 7, 2025. Mercadien identified the incident on November 7, 2025, and notified Fairwinds on August 13, 2026. The incident did not involve a compromise of Fairwinds' own systems. Affected data may include personal information. Fairwinds terminated its relationship with Mercadien and is offering complimentary credit monitoring and identity restoration services through Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 340 days

discovery → filing · 6 weeks / 41 days

Sep 7, 2025

Begins

Aug 13, 2026

Discovered

Sep 23, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Part of Mercadien, P.C. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_034f71279b639d882026-09-23Verified
New Hampshire State AGbd_87801b1cf8b4ab312026-09-23Candidate
Texas State AGbd_05e8cef4512254672026-09-25 · +2dVerified

Name: FAIRWINDS CREDIT UNION
norm: fairwinds credit union

Name: FAIRWINDS CREDIT UNION
norm: fairwinds credit union
Industry: Financial Servicesllm

Discovered: Aug 13, 2026
Breach occurred: Sep 7, 2025 – Nov 7, 2025
Undetected for: 340 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via Mercadien, P.C. CPAs
Initial access: trusted_relationship

During the incident: Terminated relationship with Mercadien
Providing complimentary credit monitoring, identity restoration, and identity theft insurance services through Experian
Undertook additional review to validate impacted population
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 23 · first

New Hampshire State AGSep 23 · first

California State AGSep 23 · first · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-630165
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2026
Raw hash: df8f9deab6ef4e73dcd91ef637f3a2eebbbbe5966b3099216e514cb3e671c894

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFAIRWINDS CREDIT UNION

Victim entityFAIRWINDS CREDIT UNION

Incidentdiscovered Aug 13, 2026

Stated responseTerminated relationship with Mercadien

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov