SRP Federal Credit Union is notifying over 240,000 people that their personal information was stolen in a recent cyberattack.
According to the credit union, a threat actor had access to its systems from at least September 5, 2024, until November 4, 2024, and “potentially acquired certain files from our network during that time”.
After securing its systems and notifying law enforcement, SRP Federal Credit Union reviewed the contents of the compromised files and discovered that they contained personal information.
The organization informed the Office of the Attorney General of Texas that the potentially stolen information includes names, dates of birth, driver’s license numbers, Social Security numbers, and financial information.
It also told the Maine Attorney General’s Office that it is sending written notifications to 240,742 individuals who might have been affected by the data breach.
The credit union is providing the potentially affected individuals with one year of free identity protection services, although it says it is not aware of any stolen information being misused.
“While we have no evidence that your personal information has been misused, we encourage you to take advantage of the complimentary credit monitoring included in this letter,” the notification reads.
SRP Federal Credit Union did not share information on the type of cyberattack it fell victim to, but the public disclosure was made around the same time that the ransomware group Nitrogen added the organization to its Tor-based leak site.
Nitrogen claims to have stolen roughly 650 gigabytes of data from SRP Federal Credit Union, including customers’ personal information, and is offering the data for sale.
A fresh ransomware gang initially spotted in late September, Nitrogen has claimed responsibility for cyberattacks on multiple US and Canadian organizations. The group has leaked the data of multiple organizations over the past two months.
Founded in 1960 and headquartered in North Augusta, South Carolina, SRP Federal Credit Union provides financial services to approximately 200,000 individuals in Georgia and South Carolina, and has over 400 employees.
Related: Phishing: The Silent Precursor to Data Breaches
Related: Anna Jaques Hospital Data Breach Impacts 316,000 People
Related: Swedish Insurer Folksam Exposes Data on 1 Million Customers
