Anatomy of the Credit Union Breach Wave: 2025–2026

It's tempting to treat each credit union breach headline as an isolated story. Lined up together, they're not.

 

If you've noticed more credit union breach notifications landing in your inbox or your local news over the past year, that's not a perception problem. Between May 2024 and April 2025 alone, NCUA logged 539 reported cyber incidents across the credit union system — tied to ATM jackpotting, business email compromise and phishing, ransomware, and third-party providers.Since then, the named incidents have kept coming. Here's what actually happened, credit union by credit union, and what connects it.

 

The Direct Hits

 

Connex Credit Union (Connecticut, roughly 70,000 members) detected an intrusion on June 3, 2025. By the time the investigation closed, 172,000 people had data exposed — Social Security numbers, account numbers, debit card data, and government ID information.

 

Georgia Heritage Federal Credit Union was hit by ransomware starting around January 25, 2025, discovered two weeks later, and disclosed to members in January 2026. The exposure ran deep: Social Security numbers, dates of birth, driver's license and passport data, and financial account information for 43,077 people.

 

MetroWest FCU disclosed a breach in March 2026 affecting more than 20,000 people, with Social Security numbers, account and routing numbers, and card data exposed.[

 

MemberSource Credit Union disclosed its own breach in May 2026 — a breach that had actually occurred nearly a year earlier — affecting 22,000 people with unencrypted personal data exposed.

 

Gale Credit Union in Illinois disclosed an Akira ransomware incident on September 4, 2026, with Social Security numbers, account numbers, and card data among the data taken.

 

Five different credit unions, five different sizes, five different timelines. The common thread isn't the attacker — it's how much member data each one was sitting on, and how it got taken.

 

The Vendor Problem

 

 

Marquis Software Solutions, which serves more than 700 banks and credit unions, was breached in August 2025 after attackers exploited a SonicWall firewall vulnerability. By the time the full scope was confirmed in a March 2026 disclosure, roughly 672,000 individuals across 74 financial institutions had data exposed — Social Security numbers, dates of birth, and financial account information.

 

TruStage, a major credit union insurance and services vendor, took its network offline on July 15, 2026 following a breach. Two days later, Bessemer System FCU filed a lawsuit alleging TruStage's security claims had been false — an unusually direct signal of how seriously credit unions are now taking their vendors' security posture, not just their own.

 

Navy Federal Credit Union is worth including with an important caveat: in September 2025, a security researcher discovered an unsecured, vendor-hosted backup database — roughly 378GB of internal operational data, including employee emails, KPI templates, and system logs. Navy Federal confirmed no member data was exposed, and the vendor secured the exposure within hours.  It's a smaller story than the others, but it illustrates the same underlying issue: even data that never touches a member's account can sit exposed on a vendor's infrastructure, outside your own security team's direct control.

 

The Common Thread

 

None of this reads as one credit union's bad luck. It reads as a system where a meaningful share of the exposure sits outside the credit union's own walls — with core processors, insurance and services vendors, and software providers that serve dozens or hundreds of institutions at once. NCUA's own resilience report flags exactly this: ransomware-as-a-service and third-party/supply-chain risk as top current concerns, alongside AI-enabled attack techniques that are lowering the skill bar for attackers going after smaller institutions.

 

That's a meaningfully different risk picture than "keep our own systems patched." It means a credit union's actual exposure is only as strong as the weakest vendor it depends on — and vendor risk assessments that get filed once a year and not revisited are increasingly the gap attackers are finding first.

 

What This Means for Your Credit Union

 

A few things worth taking from this pattern rather than treating each headline as someone else's problem:

 

Your vendor list is your attack surface, not just your org chart. Every incident above involving a vendor — Marquis, TruStage, and even the Navy Federal exposure — originated outside the credit union's own infrastructure. A risk assessment that doesn't actively track and reassess vendor risk is missing where the exposure is actually showing up.

 

Scale doesn't protect you. Navy Federal is the largest credit union in the country; Connex and Georgia Heritage are far smaller. The incidents above span the full size range, which tracks with attackers increasingly going after whichever vendor or institution has the weakest control, not the biggest name.

 

Detection speed matters as much as prevention. Georgia Heritage's incident began in January 2025 and wasn't disclosed to members until a year later. The gap between when an incident starts and when it's caught is often where the real damage accumulates.

 

---

 

InfoSight has spent more than 25 years building risk assessments, vendor oversight programs, and security testing specifically for financial institutions — the kind of work that's meant to catch exactly this pattern before it becomes your credit union's name in a breach notice. If your vendor risk process hasn't been revisited since before this year's incidents, that's worth a conversation now rather than after the fact.

 

 

Sources

This post is for informational purposes only and does not constitute legal or regulatory compliance advice.

1. NCUA, "2025 Cybersecurity and Credit Union System Resilience Report," published April 2026 — 539 reported cyber incidents, May 2024–April 2025.
2. SecurityWeek, "Connex Credit Union Data Breach Impacts 172,000 People".
3. CUToday, "Georgia Heritage FCU Discloses Data Breach Affecting More Than 43,000 Members".
4. CU Times, "MetroWest FCU Reports Breach Affecting More Than 20,000," March 17, 2026.
5. CU Times, "MemberSource CU Breach Exposes Unencrypted Data of 22,000 Persons," May 2026.
6. ClaimDepot, "Gale Credit Union Data Breach," 2026.
7. SecurityWeek, "Marquis Data Breach Affects 672,000 Individuals"; The Record, "Marquis bank vendor data breach".
8. American Banker, "Credit union sues TruStage over cybersecurity incident".
9. American Banker, "Navy Federal secures operational data after exposure"; additional detail from Security Magazine and BankInfoSecurity.