NORTH HAVEN, Conn.— The $1-billion credit union has alerted tens of thousands of members that hackers accessed their personal and financial data during a breach in early June, Bleeping Computer reported.
In notification letters mailed to affected individuals (172,000) and filed with the Maine Attorney General’s office, Connex said it discovered the intrusion on June 3—just one day after its network was compromised, Bleeping Computer said.
"The investigation revealed that certain files may have been accessed or downloaded without authorization between June 2 and 3, 2025," the letter said. "On July 27, 2025, Connex identified certain individuals whose personal information may have been involved in the incident."
The nonprofit said it has found no evidence that the attackers accessed members’ funds or accounts. However, the breach did expose a mix of personal and financial data, including names, account numbers, debit card details, Social Security numbers, and government IDs, Bleeping Computer said.
Although the notification letters make no mention of the stolen data being used in further attacks, Connex has posted a scam alert on its website, warning members about phishing attempts by scammers posing as credit union employees, Bleeping Computer said.
"Please be aware that scammers are calling/texting members impersonating Connex employees. Connex will never call you and ask for PINs, passcodes, or account numbers," Connex warns. "If you receive a suspicious call or text, hang up and call us directly at 1-800-CR-UNION (203-603-5700)."
The disclosure comes on the heels of a wave of data breaches linked to the ShinyHunters extortion group, which targets Salesforce instances in vishing and social engineering attacks, impacting many high-profile companies, including Allianz Life, Adidas, Qantas, Louis Vuitton, Dior, Tiffany & Co., Chanel, and Google, Bleeping Computer added.