Communication Federal Credit Union (CFCU) suffered a targeted cyberattack between Dec. 31, 2023, and Jan. 11, 2024, exposing sensitive personal and financial data of customers. The breach compromised names, dates of birth, addresses, Social Security numbers, driver’s license numbers, bank account details, and bank card numbers. The incident led to a $2.9 million class-action settlement, offering affected individuals up to $7,500 in reimbursement for out-of-pocket losses (e.g., credit monitoring, identity theft recovery) or a pro rata cash payment (~$125). Additionally, CFCU agreed to provide three years of identity theft protection and credit monitoring (including $1M insurance) and invest $986,000 over five years in cybersecurity improvements. The lawsuit alleged negligence in safeguarding data, though CFCU denied wrongdoing. The breach notification impacted U.S. residents tied to the incident, with claims processed until Dec. 22, 2025.
Source: https://www.claimdepot.com/settlements/cfcu-data-incident-settlement
TPRM report: https://www.rankiteo.com/company/communication-federal-credit-union
"id": "com3592435102925",
"linkid": "communication-federal-credit-union",
"type": "Cyber Attack",
"date": "6/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'U.S. residents whose data was '
'exposed (Dec. 31, 2023 – Jan. '
'11, 2024)',
'industry': 'Financial Services',
'location': 'United States',
'name': 'Communication Federal Credit Union (CFCU)',
'type': 'Credit Union'}],
'customer_advisories': 'Eligible individuals can claim: (1) 3 years of credit '
'monitoring + $1M identity theft insurance, or (2) '
'cash payment (up to $7,500 for out-of-pocket losses '
'or pro rata share). Claim deadline: Dec. 22, 2025.',
'data_breach': {'data_exfiltration': 'Likely (data exposed in breach)',
'personally_identifiable_information': ['Names',
'Dates of birth',
'Addresses',
'Social Security '
'numbers',
'Driver’s license '
'numbers'],
'sensitivity_of_data': 'High (includes SSNs, driver’s '
'licenses, bank details)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Financial Data']},
'description': 'Communication Federal Credit Union (CFCU) agreed to pay $2.9 '
'million to resolve a class action lawsuit alleging it failed '
'to adequately safeguard personal information during a '
'targeted cyberattack. The breach exposed sensitive data, '
'including names, dates of birth, addresses, Social Security '
'numbers, driver’s license numbers, bank account details, and '
'bank card numbers. Affected individuals may claim up to '
'$7,500 in reimbursement for out-of-pocket losses or a pro '
'rata cash payment (~$125) from the settlement fund. The '
'incident occurred between Dec. 31, 2023, and Jan. 11, '
'2024.',
'impact': {'brand_reputation_impact': 'Class action lawsuit and settlement '
'indicate reputational damage',
'data_compromised': ['Names',
'Dates of birth',
'Addresses',
'Social Security numbers',
'Driver’s license numbers',
'Bank account details',
'Bank card numbers'],
'financial_loss': {'attorneys_expenses': 'Up to $35,000',
'attorneys_fees': 'Up to $966,667',
'business_practice_enhancements': '$986,000 '
'(over 5 '
'years)',
'individual_claims': {'max_out_of_pocket_reimbursement': '$7,500',
'pro_rata_cash_payment': '~$125 '
'(estimated)'},
'service_awards': 'Up to $2,500 each (class '
'representatives)',
'settlement_fund': '$2.9 million'},
'identity_theft_risk': 'High (exposed PII includes SSNs, driver’s '
'license numbers, bank details)',
'legal_liabilities': '$2.9 million settlement + business practice '
'enhancements',
'payment_information_risk': 'High (bank account and card numbers '
'exposed)'},
'investigation_status': 'Settled (final approval hearing on Jan. 7, 2026)',
'post_incident_analysis': {'corrective_actions': '$986,000 allocated for '
'business practice '
'enhancements (e.g., '
'additional personnel, '
'security improvements)',
'root_causes': 'Alleged failure to adequately '
'safeguard personal information '
'(specific vulnerabilities '
'undisclosed)'},
'references': [{'source': 'Class Action Settlement Notice'},
{'source': 'Settlement Administrator Contact'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit settled for '
'$2.9 million'},
'response': {'communication_strategy': 'Breach notification letters sent to '
'affected individuals; settlement '
'website and helpline established',
'recovery_measures': '$2.9 million settlement fund for affected '
'individuals (credit monitoring, cash '
'payments)',
'remediation_measures': 'Business practice enhancements '
'(additional personnel, unspecified '
'security improvements)'},
'stakeholder_advisories': 'Breach notification letters sent to affected '
'individuals; settlement claims process established '
'(online/mail)',
'title': 'Communication Federal Credit Union Data Breach',
'type': 'Data Breach'}