Suffolk Credit Union, a Medford, New York-based financial institution serving Long Island, recently notified members that a former vendor experienced a data security incident that may have exposed some of their personal information. Financial institutions that rely on outside vendors to handle sensitive member data have a responsibility to ensure those vendors adequately protect it.
Suffolk Credit Union’s Data Breach Investigation
According to a notice filed with the California Attorney General’s office, Suffolk Credit Union was informed that Mercadien, P.C., CPAs, a former service provider to the credit union, detected unauthorized access to a portion of its computer environment. Mercadien’s investigation, conducted with the help of digital forensics and cybersecurity experts, determined that an unauthorized third party may have accessed certain data between September 17, 2025, and October 9, 2025. Suffolk Credit Union has stated that the incident was limited to Mercadien’s own computer systems and did not involve unauthorized access to any Suffolk Credit Union systems directly.
Mercadien completed its review of the potentially affected information and provided the results to Suffolk Credit Union on August 13, 2026, roughly ten months after the initial unauthorized access was detected. This kind of delay between an initial vendor-side detection and the completion of a data review is common in third-party vendor breaches, since the affected company must wait for the vendor to determine which records were involved before it can notify anyone.
Mercadien is not only Suffolk Credit Union’s vendor. Public disclosures show that Mercadien served as a data or audit-related vendor to multiple other financial institutions, and several of those institutions have separately confirmed that the same incident window exposed customer data including names, Social Security numbers, account numbers, government-issued identification numbers, and dates of birth. Suffolk Credit Union’s own notice to members describes the exposed information only in general terms, without a specific itemized list tied to its members.
Vendor breaches like this one highlight a growing risk in the financial services industry: even when a company’s own network defenses are strong, sensitive member data can still be exposed through a third party that maintains or processes it. Regulators and consumer advocates increasingly scrutinize how thoroughly companies vet the data-security practices of vendors before sharing customer information with them.
When Did This Breach Occur?
Mercadien detected unauthorized access to its computer environment on or about November 7, 2025. The investigation later determined that the unauthorized access itself may have occurred between September 17, 2025, and October 9, 2025. Mercadien completed its review of the affected data and shared the results with Suffolk Credit Union on August 13, 2026, after which the credit union began notifying affected members.
What Information Was Breached?
Suffolk Credit Union’s notice states that the incident may have involved unauthorized access to members’ personal information, without specifying the exact categories affected. Vendor incidents of this kind often involve names in combination with sensitive identifiers such as Social Security numbers, financial account numbers, or government-issued identification, since these are the types of records a financial-services vendor like an accounting or audit firm would typically handle on a client’s behalf.
What You Can Do
Suffolk Credit Union is offering affected individuals a complimentary one-year membership in Experian IdentityWorks Credit 3B, which includes credit monitoring across all three major credit bureaus and identity restoration support. If you received a notice, consider taking the following steps:
- Enroll in the complimentary credit monitoring offered in the notice before the enrollment deadline.
- Review your account statements and credit reports regularly for unfamiliar activity.
- Consider placing a fraud alert or credit freeze with the three major credit bureaus.
- Report any suspicious account activity to Suffolk Credit Union and, if necessary, to law enforcement.
File a Data Breach Lawsuit Against Suffolk Credit Union
If you received a data breach notification letter from Suffolk Credit Union, you may be entitled to compensation. Companies that collect and store sensitive personal information have a legal duty to protect it, whether that data is held directly or by a vendor acting on their behalf.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
