New Mexico Judge Approves $1.6 Million Credit Union Data Breach Settlement

A New Mexico state judge ordered the final approval of a $1.6 million class action lawsuit settlement last month involving a data breach that affected members of the $913 million First Financial Credit Union in Albuquerque.

Between Jan.17 and Feb. 6 in 2022, an unauthorized individual or individuals accessed FFCU’s computer network.

The credit union discovered the data breach on March 9, 2022 and issued a public notice on April 6, according to the Attorney General’s office in Maine, which lists company data breaches that affect their residents. According to a notice the AG’s office received from FFCU, more than 200,000 persons and only 29 Maine residents were affected by the breach. At the time of the data breach in January and February 2022, FFCU was serving about 86,000 members, according to the credit union’s NCUA Call Report.

The credit union’s notice posted on FFCU’s website stated the information the cybercriminal extracted included members’ names, addresses, Social Security numbers, driver licenses or government ID number, financial account information, and credit and/or debit card information.

The cybercriminals claimed to have extracted 500 gigabytes of FFCU’s data and threatened to post the information on the dark web. The credit union said it was investigating the cybercriminals’ claims but did not mention whether the data breach was a ransomware attack, according to the lawsuit.

The lawsuit was filed by FFCU members Brenda Briscoe and Roberta Keast in May 2022. The credit union has denied all of the lawsuit’s claims and maintains it has done nothing wrong.

As the lawsuit’s class representatives, Briscoe and Keast will each receive a $2,000 service award for their work. The lawyers’ payday will amount to $533,333, according to court documents.

The settlement agreement will provide class members with the opportunity to select and make a claim for one or more of the following:

• Two years of credit monitoring and insurance services, which will provide 24 months of three bureau credit monitoring and identity theft insurance, and access to fraud resolution agents to help resolve identity thefts for those class members.
• Reimbursement of up to $150 per class member for certain documented out-of-pocket expenses resulting from the data breach.
• Reimbursement of up to 4.5 hours of lost time, at $25 an hour, if at least one-half hour of documented time was spent dealing with the data incident.
• Reimbursement of up to $5,000 per class member for extraordinary fraudulent charges or out-of-pocket losses resulting from the data breach.
• Cash payment in an amount to be determined in accordance with the terms of the settlement.

May 2 is the deadline for members affected by the breach to file a claim at ffcusettlement.com.