ROCKVILLE, Md.– Lafayette Federal Credit Union has filed a notice of data breach with the Attorney General of California after reporting it has discovered an unauthorized party gained access to an employee’s email account. 

In its notice, LFCU said the incident resulted in an unauthorized party being able to access consumers’ sensitive information and said that upon completing its investigation it began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident, according to JDSupra.com. 

The $2-billion Lafayette Federal Credit Union said that in response, to discovering the penetration said it secured the affected account, launched an internal investigation and brought on a team of cybersecurity experts to confirm the security of the company’s email system and assist with the investigation.

Breach is Confirmed

“Through its investigation, LFCU confirmed that an unauthorized party was able to access the employee’s email account—including emails and attachments containing confidential consumer information—on September 16, 2024,” JDSupra stated. “After learning that sensitive consumer data was accessible to an unauthorized party, Lafayette Federal Credit Union reviewed the compromised files to determine what information was leaked and which consumers were impacted. LFCU completed this process on Feb. 5, 2025.”

JDSupra noted that while the publicly available data breach letter posted on the California Attorney General’s “Search Data Security Breaches” web page doesn’t mention what data types were leaked, on March 20, 2025, Lafayette FCU sent personalized data breach letters to anyone who was affected by the incident, and noted that the personalized letters should provide victims with a list of what information belonging to them was compromised.

Lafayette FCU has approximately 57,500 members.