FAIRWINDS CREDIT UNION

Fairwinds Credit Union based in Orlando, Florida, a financial services entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-09-04 and reported on 2026-09-25. 1,126 Texas residents were affected. 172,566 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number. Consumers were notified via U.S. Mail.

Fairwinds Credit Union reported a data breach to the Indiana Attorney General. The breach occurred on 2025-09-07 and was reported on 2026-09-23. 223 Indiana residents were affected. 165,054 individuals affected in total.

Fairwinds Credit Union notified the NH Attorney General of a third-party cybersecurity incident involving vendor Mercadien. An unauthorized actor accessed Mercadien's systems between September 7, 2025, and November 7, 2025. Mercadien identified the incident on November 7, 2025, and notified Fairwinds on August 13, 2026. Personal information of 92 New Hampshire residents, including names, SSNs, financial account info, and driver's license numbers, may have been accessed. Fairwinds terminated its relationship with Mercadien and is providing 12 months of credit monitoring via Experian.

Fairwinds Credit Union notified members that an unauthorized actor accessed information within the systems of its external vendor, Mercadien, P.C. CPAs, between September 7 and November 7, 2025. Mercadien identified the incident on November 7, 2025, and notified Fairwinds on August 13, 2026. The incident did not involve a compromise of Fairwinds' own systems. Affected data may include personal information. Fairwinds terminated its relationship with Mercadien and is offering complimentary credit monitoring and identity restoration services through Experian.

FAIRWINDS Credit Union notified Massachusetts residents that an external vendor experienced an incident involving their personal information. Due to Massachusetts law requirements, specific details about the nature of the incident were not disclosed. No fraud or identity theft was known to be related to the event. The credit union offered 24 months of complimentary credit monitoring and identity restoration services through Experian. The incident is considered contained.