Fairmont Federal Credit Union is notifying more than 187,000 people of a major data breach affecting their personal and financial information. The breach occurred two years ago.
The organization discovered the cybersecurity incident on January 23, 2024, and launched an immediate and thorough investigation, which was completed on August 17, 2025. The files stolen from its network contained personal information. The data breach had occurred four months prior to the discovery, with the attackers maintaining access to the credit union’s network between September 30 and October 18, 2023.
Fairmont Federal Credit Union: What data was affected?
Fairmont Federal Credit Union is informing its customers that hackers stole records containing their names, dates of birth, Social Security numbers, driver’s license numbers, government ID numbers, financial information, medical and health insurance information, and other personal data. More worryingly, the stolen information contains full credit/debit card details, including card numbers, security codes/PINs, and expiration dates. IRS PIN numbers, tax ID numbers, routing numbers , and full access credentials were also compromised.
See also: 500GB+ of sensitive data leaked from China's Great Firewall
“To date, FFCU is not aware of any incidents of identity theft or financial fraud as a result of the incident,” Fairmont Federal Credit Union says.
Late last week, the credit union informed the Maine Attorney General's Office that it is providing written notifications to 187,038 individuals affected by the data breach. Affected individuals have been provided with 12 or 24 months of identity theft protection and credit monitoring services (free).
The credit union did not say who was responsible for the data breach, but it appears to have discovered the incident the same day that ransomware group Black Basta added it to its leak site. One of the most prolific ransomware gangs, with over 500 victims worldwide and more than $100 million in ransom payments, Black Basta has been inactive since January 2025.
See also: DarkCloud Stealer targets financial institutions
The Fairmont Federal Credit Union case highlights once again how vulnerable the financial sector to sophisticated cyberattacks. The most concerning aspect here is not only the scope of the data breach – from Social Security numbers and driver’s licenses to full card details and tax PINs – but also the fact that the incident took nearly two years to become public. This raises serious questions about the speed of response, transparency towards members and the true preparedness of organizations that handle critical financial data.
The breach is not an isolated incident; it is part of a broader trend where ransomware-targeted organizations are facing not only data loss, but also extortion through a data breach. In Fairmont’s case, the possible involvement of the Black Basta group adds even more weight. The gang has already proven its effectiveness, forcing dozens of organizations to pay millions in ransom. The fact that Fairmont acknowledged the incident on the same day that Black Basta published the threat shows that organizations often only become aware of a breach after the data breach has already occurred.
From a customer perspective, offering 12 or 24 months of free identity protection services is a good first step, but it doesn’t offset the long-term risk of exposing such critical personal and financial data. Social Security numbers, for example, don’t “expire” after two years, and their misuse can continue for decades.
See also: New Yurei Ransomware encrypts files with ChaCha20
On an institutional level, this breach highlights the need for stricter regulatory transparency requirements and faster notification to consumers when personal data is compromised. The delay between the initial breach and notification can allow malicious actors to operate unhindered for a long time.
Finally, the Fairmont case should serve as a wake-up call for all credit unions and smaller financial institutions, which often have more limited resources than large banks. Investing in behavioral detection solutions, systematically training staff, and implementing regular simulated attacks (red teaming) are no longer luxuries, but necessities for survival in a landscape where ransomware and data breaches have become the norm.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
