SEATAC, Wash.— Alaska Air Group Federal Credit Union disclosed a data breach tied to a third-party IT service provider that affected more than 10,000 individuals nationwide, according to reporting by ClaimDepot.
The breach originated on or about March 5, 2026, when a vendor providing information technology services to the credit union experienced a cybersecurity incident, ClaimDepot reported. Unauthorized actors initially compromised the third-party provider and then leveraged that access to infiltrate the $129.8-million AAGCU’s internal systems.
According to ClaimDepot, approximately 10,705 people in the United States were impacted.
Files Allegedly Copied
An investigation found that the attackers may have accessed and copied certain files stored on the credit union’s systems. The potentially exposed data includes highly sensitive personal and financial information, ClaimDepot reported, including:
- Social Security numbers
- Account numbers
- Dates of birth
- Driver’s license numbers
- Passport numbers
- Routing numbers
- Tax identification numbers
Breach Disclosed by Attorneys General
The breach was disclosed to the California and Maine attorneys general on April 17, with eight Maine residents identified among those affected, according to ClaimDepot. The credit union began notifying impacted individuals in writing on April 16.
Response and Consumer Protections
AAGCU said it is not aware of any attempted or actual misuse of the compromised information, ClaimDepot reported. However, due to the sensitivity of the data involved, the credit union is offering affected individuals 24 months of complimentary credit monitoring and identity protection services through Experian IdentityWorks.
The services include:
- Monitoring of Experian credit files
- A credit report at enrollment
- Access to identity restoration specialists
- Up to $1 million in identity theft insurance
Other Services Offered
ClaimDepot reported that participants will also receive extended identity restoration support through Experian’s ExtendCare program after the initial 24-month coverage period ends.
Affected individuals can enroll in the services by visiting the Experian IdentityWorks enrollment page or calling a dedicated support line. The deadline to enroll is July 31, 2026, and an activation code provided in notification letters is required to complete registration, according to ClaimDepot.
