Email Incident

Notice of an Email Phishing Incident

New Horizons Credit Union (“NHCU”) is committed to protecting the privacy of the information entrusted to us and takes this responsibility seriously.  This commitment extends to notifying individuals when their information may be at risk.  Although we have no reason to believe that personal information has been used to commit fraud or identity theft, NHCU is notifying the public about a recent email phishing incident.  NHCU discovered that on August 7, 2019, someone outside of NHCU temporarily accessed NHCU employee email accounts without authorization.

Upon learning of the incident, NHCU promptly contained the incident by securing the email accounts to prevent further access, conducted an internal investigation, and hired a leading forensic security firm to investigate the incident and confirm the security of NHCU’s computer systems and network.  

The investigation concluded on April 8, 2020 and determined that the phished email accounts contained some personal information, including individuals’ names, addresses, and dates of birth, Social Security numbers, driver’s license information, passport numbers, financial information such as an account or credit card numbers, limited medical information, electronic signatures, and/or usernames and passwords.

At this point, we do not believe that the unauthorized third party’s motivation was to access individuals’ personal information contained within the email accounts and have no indication that any such information has been used for fraud or identity theft purposes.  Nevertheless, On June 15, 2020, NHCU mailed notification letters to impacted individuals for whom it had a valid mailing address.    

Affected individuals should refer to the notice they receive in the mail regarding the steps they can take to protect themselves.  Individuals who did not receive a letter but believe they may have been affected can obtain additional information by calling NHCU’s toll free Incident Response Call Center line at 1-844-963-2702, Monday through Friday, 8:00 a.m. – 5:30 p.m. CST.

NHCU encourages individuals to remain vigilant to the possibility of fraud and identity theft by reviewing credit card, bank, and other financial statements for any unauthorized activity. If individuals detect any suspicious activity, they should notify the entity with which the account is maintained, and promptly report the suspicious activity to appropriate law enforcement authorities, including the police and their state attorney general. In addition, anyone looking for information on fraud prevention can review tips provided by the FTC at www.ftc.gov/idtheft.

NHCU takes the security of its information seriously and sincerely apologizes for any inconvenience this incident may cause.  NHCU is committed to taking steps to help prevent this from happening again, including reviewing its technical controls.

Posted on June 15, 2020