Partner Colorado Credit Union has told members that a data breach at one of its service providers involved their personal information. The credit union says the incident did not expose Social Security numbers, PINs or online banking logins.
Partner Colorado Credit Union’s Data Breach Investigation
Partner Colorado Credit Union, based in Arvada, Colorado, has notified individuals that a breach of security involving their personal information took place at Mercadien P.C. CPAs, an accounting firm that served as a service provider to the credit union. A copy of the notice letter, dated October 19, 2026, was filed with Massachusetts regulators and is posted on the state’s website. The incident occurred in the vendor’s systems, not in the credit union’s own network, according to the way the letter describes it.
The letter states that the breach occurred between September 17, 2025, and October 9, 2025. That period is more than a year before the date on the notice, which is a common pattern when a breach at a vendor has to be investigated, the affected files have to be analyzed, and each client has to work out which of its customers or members are named in the data before notifying anyone.
According to the letter, the information involved was limited to the recipient’s name and account number. The credit union states that sensitive credentials such as a PIN, a password and online banking login information were not exposed, and that Social Security numbers were not compromised. Those statements come from the credit union itself, and the public letter does not describe the underlying forensic findings that support them.
Mercadien has been named in notices from other financial institutions as well. Separate notices filed by other Mercadien clients say that Mercadien discovered possible unauthorized access to its systems on or around November 7, 2025, engaged cybersecurity experts, and notified law enforcement. Those notices say the vendor provides accounting and advisory services to financial institutions and received customer information in the course of those engagements. Each institution decides what to tell its own members, so the details in each letter differ.
The credit union has not said how many members received the letter, and no total has been published in the sources reviewed for this page. The notice also does not describe how an unauthorized person got into the vendor’s systems or whether files were copied. The Massachusetts-filed letter is focused mostly on explaining the right to a free security freeze. It does not mention complimentary credit monitoring.
A name combined with an account number may seem limited, but it can still be useful to a scammer. Criminals can use that pairing to make a phone call or a message look legitimate, for example by claiming to be from the credit union and asking a member to confirm other details. Members should treat unexpected calls, texts or emails that reference their account with caution, and should contact the credit union using a phone number from their card or statement.
The letter describes how to place a free security freeze with each of the three major credit reporting agencies, Equifax, Experian and TransUnion, and explains that a freeze blocks a credit bureau from releasing a credit report without the consumer’s written authorization. It notes that a freeze can delay new credit applications, and that under federal law there is no charge to place, lift or remove one. It also explains the right under Massachusetts law to obtain a police report related to the incident.
Anyone who received a letter from Partner Colorado Credit Union should keep it. Attorneys are looking into whether the credit union and its service provider took reasonable steps to protect member information, including how vendors were chosen and overseen and whether the data held by the vendor was limited to what was needed.
When Did This Breach Occur?
The letter states that the breach occurred between September 17, 2025, and October 9, 2025, at Mercadien P.C. CPAs. Other Mercadien clients’ notices say the vendor discovered possible unauthorized access on or around November 7, 2025. The credit union’s own letter to affected individuals is dated October 19, 2026.
What Information Was Breached?
According to the credit union, the information involved was limited to a member’s name and account number. The notice says that PINs, passwords and online banking login information were not exposed and that Social Security numbers were not compromised. No total number of affected people has been reported.
What You Can Do
If you received a notice related to Partner Colorado Credit Union or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Contact the credit union through a phone number printed on your card or statement, not one given in an unexpected call or message, if you want to ask about your account.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Partner Colorado Credit Union
If you received a notice from Partner Colorado Credit Union, or you believe your information was involved in the Mercadien incident, you may have legal options for holding the responsible parties accountable for how they protected your information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
