Cross Valley Federal Credit Union Data Breach Details
The breach was discovered on December 4, 2024, and has been linked to an external hacking incident carried out by a threat actor identified as “BusinessDataLeaks.”
According to a notification from Wilson Elser Moskowitz Edelman and Dicker, LLP, who represent Cross Valley, the breach was detected following suspicious activity on the credit union’s network. Upon discovery, Cross Valley immediately took action to contain the intrusion and secure its systems. The credit union also engaged independent cybersecurity experts to conduct a full-scale investigation into the incident.
The investigation revealed that the unauthorized access occurred on November 19, 2024. During that time, threat actors may have accessed sensitive member data, including names, addresses, and Social Security Numbers.
While only two Maine residents were affected, all impacted individuals across the total population of 17,826 have either been notified or are in the process of being contacted. Notification letters were sent out on March 13, 2025.
Despite the sensitive nature of the compromised data, there has been no public indication so far that the stolen information has been used maliciously. Nevertheless, affected individuals are encouraged to remain vigilant by monitoring their accounts and considering additional protective measures such as credit freezes or fraud alerts.
What Information Was Compromised?
The compromised data may include:
- Names
- Dates of birth
- Addresses
- Social Security Number
- Payer identification numbers
- Government-issued IDs
