Quarter of a million exposed in US credit union digital heist

Cybercrooks accessed the personal details of hundreds of thousands of customers of SRP Federal Credit Union, a US-based financial institution.

Many SRP customers received a data breach notice this month alongside their usual account statement. The financial institution recently suffered a two-month-long data breach.

According to filings that SRP submitted to the Maine Attorney General, over 240,000 individuals were exposed in the cyberattack. This is an astounding number of victims, given that SRP claims the total number of credit union members is 195,000.

An inquiry into the attack revealed that attackers roamed the company’s computer from September 5th until November 4th, 2024. SRP’s notice claims that the company has “no reason to believe that your personal information has been misused for the purpose of committing fraud or identity theft.”

SRP omitted exactly what type of details were exposed, only indicating that names and government issued IDs were impacted in the cyberattack. However, as the credit union will provide impacted individuals with free-of-charge identity theft protection services, attackers could have obtained enough details to carry out attacks of this nature.

“While we have no evidence that your personal information has been misused, we encourage you to take advantage of the complimentary credit monitoring included in this letter,” reads the breach notification letter.

Operating from South Carolina, the credit union reported its managing assets as worth $1.6 billion in 2022.