About Ellafi Federal Credit Union
Ellafi Federal Credit Union, a financial services organization located in Middletown, CT, experienced a data breach affecting over 17,627 individuals, including 40 residents from Maine. The breach occurred on October 14, 2025, and was discovered on November 20, 2025. The incident involved an external system breach through hacking, which compromised personal identifiers combined with sensitive information.
What Happened
On October 14, 2025, EFCU experienced a network disruption and immediately initiated an investigation of the matter. EFCU engaged cybersecurity experts to assist with the process. As a result of the investigation, EFCU determined that certain files may have been accessed and / or acquired without authorization. EFCU then undertook a comprehensive review of those files and, on or about November 20, 2025, learned that some of your personal information was contained within the potentially affected data which is the reason for this notification. Please note that EFCU has no evidence of the misuse, or attempted misuse, or any potentially impacted information.
The breach affected personal data of individuals, including names, Social Security numbers, and credit/debit card numbers. The breach was discovered over a month after it occurred, on November 20, 2025.
Next Steps
Affected users are encouraged to remain vigilant by reviewing their account statements and credit reports closely. Any suspicious activity should be promptly reported to the financial institution or company where the account is maintained. Additionally, users should report any fraudulent activity or suspected identity theft to law enforcement authorities, their state attorney general, and/or the Federal Trade Commission. Affected individuals are also advised to consider placing a fraud alert or security freeze on their credit files to prevent unauthorized credit access.
Identity Theft Protection Services
Ellafi Federal Credit Union is offering complimentary identity protection services through IDX to impacted individuals. These services include 12 months of credit monitoring, dark web monitoring, and a $1 million identity fraud loss reimbursement policy. In addition, fully managed identity theft recovery services are provided. The deadline to enroll in these services is March 23, 2026. Affected individuals must be over 18, have a Social Security number, and a U.S. residential address to enroll in these services.