240,000 Credit Union Customers Exposed As Hackers Access Trove of Sensitive Data: Report

A South Carolina credit union says 240,000 customers have been exposed in an apparent cyberattack.

SRP Federal Credit Union, one of the largest in the state with over $1.6 billion in assets as of 2022, filed breach notifications with regulators in Maine and Texas on December 13th, The Record reports .

A law enforcement investigation discovered hackers had accessed the bank’s internal systems multiple times between September 5th and November 4th, 2024. SRP says the hackers “potentially acquired certain files from our network during that time.”

While SRP hasn’t publicly stated what specific information was stolen from them, The Record reports that the credit union told Texas regulators that Social Security numbers, driver’s license numbers, dates of birth and financial information like account numbers as well as credit or debit card numbers are compromised.

According to cyber security management and threat analysis firm Hackmanac, a well-known ransomware group called Nitrogen took credit for the attack, which claimed to also have customers’ full names and credit ratings.

“Nitrogen ransomware group claims to have breached SRP Federal Credit Union.

Allegedly, 650 GB of confidential customer data, including full names, SSNs, DOBs, addresses, account numbers, and credit ratings, were exfiltrated.”

Despite Nitrogen’s claims, SRP has not said whether it was a ransomware attack, and reportedly told regulators that the hack didn’t impact its online banking system or core processing systems.

Earlier this year, Nitrogen took credit for six other victims , including five US firms and one Canadian company, according to Hackmanac.

Several law firms are now investigating claims from SRP customers in regard to the breach.

Generated Image: Midjourney