Fairwinds Credit Union disclosed in a notice dated September 23, 2026, that personal information relating to its members may have been accessed in a cybersecurity incident at Mercadien, P.C. CPAs, an external professional services firm. Mercadien identified the incident on November 7, 2025, and its investigation found that unauthorized access or acquisition may have occurred between September 7 and November 7, 2025. Mercadien notified Fairwinds on August 13, 2026, that member information was affected. Fairwinds said its own systems were not compromised.
The notice does not name the specific data elements; its data-elements section contains a placeholder. The total number of affected Fairwinds members has not been disclosed. The notice says approximately 39 Rhode Island residents may be affected. Official notices also identify California and Massachusetts, but do not state counts for those states. No clinical medical information, financial account data, or Social Security numbers are specifically identified in the notices.
The available notices do not provide an overall affected count or further detail about the information involved. Further details may emerge as notifications and reporting continue.