On August 24, 2023, Chevron Federal Credit Union (“CFCU”) filed a notice of data breach with the Attorney General of Maine after discovering that MOVEit, a file-sharing application used by CFCU, contained a critical vulnerability. In this notice, CFCU explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names and financial account information. Upon completing its investigation, CFCU began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.
If you received a data breach notification from Chevron Federal Credit Union, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft, as well as discuss your legal options following the Chevron Federal Credit Union MOVEit data breach. For more information, please see our recent piece on the topic here.
What Caused the Data Breach Affecting Chevron Federal Credit Union Customers?
The data breach affecting Chevron Federal Credit Union was only recently announced, and more information is expected in the near future. However, CFCU’s filing with the Attorney General of Maine provides some important information on what led up to the breach. According to this source, CFCU uses a file-sharing application called MOVEit to securely move files. MOVEit is a product of Progress Software.
On May 31, 2023, Progress Software notified CFCU that MOVEit was discovered to contain a critical vulnerability. In response, CFCU remediated the vulnerability and then launched an investigation into the incident to determine what, if any, consumer information was leaked.
Chevron Federal Credit Union concluded its initial investigation, failing to find any unauthorized access. However, in late July 2023, new methodologies became available to detect unauthorized access. In light of this development, CFCU re-opened its investigation. This time, CFCU was able to determine that an unauthorized party was able to decrypt and download some of the data in CFCU’s MOVEit application between May 30, 2023 and May 31, 2023.
After learning that sensitive consumer data was accessible to an unauthorized party, Chevron Federal Credit Union reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name and financial account information.
On August 24, 2023, Chevron Federal Credit Union sent out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.
More Information About Chevron Federal Credit Union
Founded in 1935, Chevron Federal Credit Union is a not-for-profit financial institution based out of Oakland, California. CFCU offers its customers traditional financial products and services offered by other banks and credit unions, including checking and savings accounts, vehicle loans, home mortgages, IRAs, personal loans and credit cards. Chevron Federal Credit Union employs more than 297 people and generates approximately $139 million in annual revenue.
