One hacked email exposes several thousand California credit unions’ customers

Attackers breached a single employee’s email at the California-based South Bay Credit Union (SBCU), leading to thousands of customers having their details exposed.

While company-wide protection is essential, securing employee emails is no less important. For example, it took hackers to breach one SBCU's employee email account to access troves of personal data.

According to a breach notification letter the company sent to the impacted individuals, third parties breached a single email account, potentially accessing details shared via the service. SBCU disclosed to the Maine Attorney General's Office that nearly 7,500 individuals had their personal details exposed, including names, surnames, and other data.

“On or about November 18, 2024, SBCU discovered suspicious activity related to one employee’s email account. Upon discovery, SBCU took immediate action to secure the account and engaged a team of third-party specialists to investigate the incident. The investigation determined that an unauthorized individual had gained access to one email account,” the letter reads.

The credit union explained that it has taken steps to strengthen its security posture and data security practices. SBCU also offered impacted individuals complimentary identity theft and credit monitoring services.

SBCU’s latest financial records state the credit union’s assets are worth over $144 million.