Suffolk Federal Credit Union

Suffolk Credit Union's member data was taken not from its own network but from Mercadien, P.C., CPAs, the accounting vendor it had already stopped using by the time anyone noticed. The intrusion ran from September 17 to October 9, 2025; how Mercadien's systems were breached is not stated. Names, Social Security numbers, driver's license numbers, and financial account numbers went out the vendor's door, nearly a year before the credit union got the final count. Ending a vendor relationship doesn't retroactively empty the digital file cabinet they were still holding.