Fairmont Federal Credit Union fairmontfcu.com Fairmont Federal Credit Union data breach: what happened and what to do
Fairmont Federal Credit Union in West Virginia said an intruder had access between September 30 and October 18, 2023. In 2025 it notified at least 187,038 people. Names, Social Security numbers, ID numbers and financial information may be exposed.
View all 13,115 breaches- Breach date
- 30 Sept 2023
- Made public
- 11 Sept 2025
- Affected
- 187,038
- Data exposed
- Names, Dates of birth, Social security numbers, Government issued IDs, Financial account information, Health insurance information
- Last updated
What happened
Fairmont Federal Credit Union (FFCU), in West Virginia, said an unauthorized party had access to its systems between September 30 and October 18, 2023. It discovered the incident on January 23, 2024 and finished its investigation on August 17, 2025. A filing with Maine's attorney general lists at least 187,038 people.
What was exposed
The notice lists a long range of data that varies by person: names, dates of birth, Social Security numbers, driver's license and other government ID numbers, passport and tax ID numbers, financial account numbers, credit and debit card numbers with security codes, IRS PINs, and medical and health insurance information.
What it means for you
Because the notices came almost two years after the intrusion, the data has had a long time to be misused. IRS PINs and tax IDs raise the risk of fraudulent tax returns, and card numbers with security codes can be used for fraud until the card is replaced. FFCU said it isn't aware of any identity theft or financial fraud resulting from the incident.
The company's response
FFCU offered complimentary identity protection and credit monitoring through Experian IdentityWorks and set up a response line.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If FFCU sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as FFCU or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
- 6
Replace cards and get an IRS Identity Protection PIN
If a card number was in your notice, ask for a new one. If your Social Security number was, you can request an IRS Identity Protection PIN to block fake tax returns.
Frequently asked
Was I affected?
FFCU began mailing letters in September 2025. At least 187,038 people were affected. If you were a member and didn't get one, contact FFCU.
What was exposed?
It varies by person: names, dates of birth, Social Security numbers, ID numbers, financial account and card details, and medical or health insurance information.
Why did notices take so long?
FFCU said it discovered the incident in January 2024 and finished its investigation in August 2025.
Should I change my password?
The notice doesn't focus on passwords. Replace affected cards, freeze your credit and watch your statements.
Sources
- securityweek.com/west-virginia-credit-union-notifying-187000-people-impacted-by-2023-data-breach/
- securityaffairs.com/182217/data-breach/fairmont-federal-credit-union-2023-data-breach-impacted-187k-people.html
- teiss.co.uk/news/fairmont-federal-credit-union-data-breach-in-2023-hits-nearly-190000-people-16414
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
