MERIDIAN, Conn.— Ellafi Federal Credit Union has been hit with a second proposed class action lawsuit over a cybersecurity breach that exposed the personal information of thousands of its members.
As the CU Daily reported here, in December Ellafi said a ransomware attack exposed the personal and financial information of more than 17,000 people, according to disclosures filed with Maine regulators.
The credit union said it detected a network disruption on Oct. 14, 2025, and launched an investigation with outside cybersecurity specialists. The review later determined that unauthorized actors had accessed the credit union’s systems and may have obtained certain files. By Nov. 20, Ellafi confirmed the files contained personal information belonging to members and customers, according to ClaimDepot.com.
In a filing with the Maine Attorney General’s Office, Ellafi reported that 17,627 individuals nationwide were affected, including 40 Maine residents. Exposed information may have included names, Social Security numbers, credit card numbers and debit card numbers.
Ransomware Group Cited
ClaimDepot.com said the attack has been attributed to the Akira ransomware group, which publicly claimed responsibility on Nov. 3, 2025. In a posting on the Tor network, the group said it had obtained about 17 gigabytes of data. The materials allegedly included customer and employee records, W-9 forms, contracts, accounting and financial documents, human resources files and non-disclosure agreements, ClaimDepot.com added.
New Lawsuit
Now, in an action filed this week in federal court, the complaint alleges Ellafi Federal Credit Union failed to secure members’ information and delayed notifying affected individuals, contributing to heightened risk of identity theft and financial harm. It seeks class action status on behalf of those whose personal data was compromised, according to Law360.
The earlier lawsuit made similar allegations.
