ST. LOUIS—The $545-million Neighbors Credit Union has reported a data breach that apparently was the result of the ransomware group known as BLACK SUIT, Claim Depot reported.
According to disclosures filed with the Massachusetts Attorney General's office and the Texas Attorney General's office, on Sept. 20 and 21, 2024, an unauthorized third party accessed the credit union’s computer systems and exfiltrated sensitive files.
BLACK SUIT later claimed responsibility and posted the incident on a dark web site hosted on the Tor network, Claim Depot reported.
The breach affected at least 2,406 individuals in Texas and 1,727 in Massachusetts, with the total number likely higher across other states. The compromised data includes a wide range of personally identifiable information (PII) and protected health information (PHI): names, Social Security numbers, driver’s license numbers, dates of birth, financial account numbers, credit and debit card numbers, and medical information, Claim Depot said.
The attackers were able to acquire this information by infiltrating Neighbors Credit Union’s network and copying files during the two-day window, Claim Depot said.
“The severity of this incident is heightened by the nature of the stolen data—much of it highly sensitive and valuable for identity theft or financial fraud. The ransomware attack was sophisticated enough to bypass existing security measures, prompting the credit union to immediately involve law enforcement and cybersecurity experts to investigate and contain the breach,” Claim Depot stated.
In the wake of the breach, Neighbors Credit Union took several steps to secure its systems and support affected members. The company initiated an internal investigation, engaged a forensic security firm to analyze the incident, and notified law enforcement, Claim Depot said.