{
  "id": "insight-credit-union-data",
  "url": "https://ohshit.app/incidents/insight-credit-union-data/",
  "title": "Insight Credit Union files a breach notice covering 67,487 people",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-06",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Insight Credit Union",
    "data breach",
    "financial services"
  ],
  "ecosystems": [],
  "summary": "Insight Credit Union’s Texas filing lists 67,487 affected people. It reports name, Social Security number, government ID and financial information categories. The credit union reports notifying consumers by mail. The filing gives no intrusion mechanism.",
  "splash": "People identified in Insight Credit Union’s mailed breach notices.",
  "wipe": "Verify the letter through the credit union, monitor financial activity, and review fraud alerts or credit freezes if applicable.",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify the letter and the fields specific to you",
      "hint": "Use the contact details from your existing banking app, account statement or the credit union’s official website. The official member line is 888-843-8328. Ask which identifiers and financial records were involved and whether the letter offers account-specific protections. Keep the letter and ignore unsolicited requests for passwords or codes."
    },
    {
      "title": "Review activity and report unauthorized transactions",
      "hint": "Check account and card statements and enable transaction alerts. If you find an unfamiliar transfer or payment, contact the institution’s fraud team through a verified channel to dispute it and ask whether account or card credentials need replacement. Insight lists option 2 on its member line for debit-card disputes."
    },
    {
      "title": "Review your credit if government identifiers were involved",
      "hint": "Request your credit reports at AnnualCreditReport.com. Consider a credit freeze with Equifax, Experian and TransUnion. If you find identity theft, keep evidence and report it through IdentityTheft.gov."
    }
  ],
  "sources": [
    {
      "name": "Texas Attorney General public breach register",
      "url": "https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage",
      "says": "Public record BR-0005499 lists the dates, national and Texas counts, data categories and notification by U.S. mail.",
      "primary": true
    },
    {
      "name": "Vermont Attorney General security breach register",
      "url": "https://ago.vermont.gov/categories/security-breach-notices?page=1",
      "says": "November 6 entry lists 16 Vermont residents and includes financial account codes and credit or debit account information.",
      "primary": true
    },
    {
      "name": "Insight Credit Union official contact page",
      "url": "https://www.insightcreditunion.com/contact-us",
      "says": "Publishes its general member line and the debit-card dispute menu option.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The public filings report a breach but do not give the access mechanism.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Sep 4–7, 2026",
      "title": "Incident window listed in Texas filing"
    },
    {
      "date": "Oct 13, 2026",
      "title": "Credit union discovers the breach according to its Texas filing"
    },
    {
      "date": "Nov 6, 2026",
      "title": "Texas and Vermont publish notifications",
      "body": "Texas lists 67,487 affected people overall and 656 in Texas. Vermont lists 16 affected residents."
    }
  ],
  "body_markdown": "Insight Credit Union’s Texas filing lists names, Social Security numbers, driver’s license numbers, other government-issued ID numbers and financial information. It gives bank account or payment card numbers as examples of the financial category. The filings give no universal list of fields for every affected person and no confirmed total of financial losses. The Texas and Vermont resident figures are subsets of the overall count. The public registers do not identify the affected system, initial access method or specific technical remediation."
}