Via Credit Union is a member-owned financial institution serving 12 counties in Indiana. Reports have emerged that a ransomware group claims to have attacked the credit union.
Here is what has been reported so far, what remains unknown, and what you can do if you may be affected.
Via Credit Union’s Data Breach Investigation
Via Credit Union, also known as ViaCU, is a member-owned financial institution that serves 12 counties in Indiana. In October 2026, monitoring sites that track ransomware activity began reporting that the credit union may have been the target of a cyberattack.
According to an October 16, 2026 post on Ransomware.live, a dark web monitoring site, a hacker group calling itself Qilin was behind the suspected attack, which the site estimated had taken place the same day. A second cybersecurity blog, HookPhish, similarly reported that Qilin claimed responsibility for an attack on the Indiana credit union.
These reports rest on the attackers’ own claim. As of the sources reviewed, Via Credit Union had not publicly confirmed that a new breach occurred, had not described how any intrusion happened, and had not said whether member or employee information was taken. No notification letters, regulatory filings or company statements about this claim were found.
The scope of the incident is also unknown. The sources reviewed do not say how many people could be affected, what kinds of records might be involved, or whether the group has published or offered any data. Claims posted by ransomware groups can later turn out to be exaggerated, partial or accurate, which is why a confirmation from the credit union itself matters.
This is not the first security incident the credit union has disclosed. Via Credit Union previously reported a separate data breach that occurred in January 2025 and affected more than 60,000 people. That earlier incident is a different event, and nothing in the sources reviewed ties the two together.
Financial institutions are frequent targets for ransomware groups because they hold identity details, account information and contact records in one place. When that kind of information is exposed, it can be used for identity theft, account takeover fraud and convincing phishing messages. This is general context about the sector and is not a statement about what happened in this specific incident.
State and federal breach notification laws generally require organizations to notify affected people, and often regulators, once a breach involving personal information is confirmed. Notices tend to arrive in stages, and details can change as an investigation moves forward. If the credit union later confirms an incident, the facts on this page may change.
In the meantime, it is reasonable for anyone connected to the credit union to watch for a notice in the mail, keep any letter they receive, and take basic protective steps early rather than waiting for confirmation.
When Did This Breach Occur?
A post dated October 16, 2026 on Ransomware.live reported that the Qilin group claimed the attack, and that site estimated the suspected attack occurred the same day.
The sources reviewed do not say when any unauthorized access began or ended, and the credit union has not confirmed the incident.
What Information Was Breached?
The sources reviewed do not say what information was involved in the claimed October 2026 attack. The credit union has not disclosed any categories of data, and the reports describe the impacted data as not yet known.
If a confirmed notice is issued, it should explain what applies to you. Until then, this page does not state which types of information may have been exposed.
What You Can Do
If you received a notice related to Via Credit Union or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you are a member, or you are a current or former employee, watch for a notice from the credit union.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Via Credit Union
If your personal or financial information was exposed in this incident, you may have legal options. Organizations that hold sensitive member data are expected to protect it, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
