Major data breach at SRP Federal Credit Union exposes sensitive information of 240,000 individuals

SRP Federal Credit Union, a South Carolina-based financial institution, has confirmed a significant data breach compromising the personal information of more than 240,000 individuals. The breach, part of a two-month-long cyberattack, was revealed through filings with regulators in Maine and Texas.

The credit union discovered suspicious activity within its network and alerted law enforcement. Investigations revealed that hackers had accessed sensitive files between September 5 and November 4, with the full scope of the breach determined by November 22. The attackers reportedly acquired personal information, including names, Social Security numbers, driver’s license numbers, dates of birth, and financial data such as account and credit card numbers. SRP has clarified that its online banking and core processing systems were unaffected.

The ransomware group Nitrogen has claimed responsibility for the breach, alleging it stole 650 GB of customer data. Ransomware attacks typically involve locking victims out of their systems or files until a ransom is paid. However, SRP has not confirmed Nitrogen’s involvement or provided further details on the attackers’ identities or motives.

The prolonged duration of the attack—spanning two months before detection—has raised questions about SRP’s cybersecurity measures and response protocols. The incident has drawn scrutiny from regulators and legal experts alike.

Murphy Law Firm, an Oklahoma City-based firm, is investigating potential claims on behalf of individuals impacted by the breach. The firm has encouraged affected parties to consider joining a class-action lawsuit to seek compensation for the exposure of their sensitive data.

To mitigate the fallout, SRP offers those affected free identity theft protection services. Impacted individuals are advised to use this service to safeguard their information and monitor their accounts for unauthorized activity.