Suffolk Credit Union was recently notified that Mercadien, P.C., CPAs (“Mercadien”), a former service provider to Suffolk Credit Union, sustained a data security incident that may have involved the personal information of certain members or other individuals associated with Suffolk Credit Union.
According to Mercadien, on or about November 7, 2025, Mercadien detected unauthorized access to a portion of its computer environment. Upon discovering the incident, it took immediate steps to secure its environment and began an investigation with assistance from digital forensics and cybersecurity experts. Mercadien’s investigation determined that an unauthorized third party may have accessed certain data at times between September 17, 2025, and October 9, 2025.
Importantly, the incident was limited to Mercadien’s computer systems and did not involve unauthorized access to any Suffolk Credit Union computer systems.
Following its forensic investigation, Mercadien conducted a review of the information that may have been accessed by the unauthorized third party to determine if it contained any personal information. On August 13, 2026, Mercadien provided Suffolk Credit Union with the completed results of that review. Mercadien’s review determined that the incident may have involved unauthorized access to certain individuals’ personal information. Depending on the individual, the personal information may include their name, address, date of birth, Social Security number, driver’s license number, and/or financial account number. On September 11, 2026, Suffolk Credit Union began mailing notification letters to those potentially affected individuals for whom Suffolk Credit Union has a valid mailing address.
Notified individuals should refer to the notice they will receive in the mail regarding steps they can take to protect themselves. Although Suffolk Credit Union has no evidence that any information has been misused as a result of this incident, as described in those letters, Suffolk Credit Union has arranged for complimentary identity theft protection services for those individuals whose Social Security numbers may have been involved in the incident. As a precautionary measure, individuals should remain vigilant to protect against potential fraud and/or identity theft by, among other things, reviewing their account statements and monitoring credit reports closely. If individuals detect any suspicious activity on an account, they should promptly notify the financial institution or company with which the account is maintained. They should also promptly report any fraudulent activity or any suspected incidents of identity theft to proper law enforcement authorities, including the police and their state’s attorney general. Notified individuals may also wish to review the tips provided by the Federal Trade Commission (“FTC”) on fraud alerts, security/credit freezes and steps that they can take to avoid identity theft. For more information and to contact the FTC, please visit www.identitytheft.gov or call 1-877-ID-THEFT (1-877-438-4338). Notified individuals may also contact the FTC at: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580.
Contact information for the three national credit reporting agencies is as follows:
Equifax 1-888-378-4329 P.O. Box 740241 Atlanta, GA 30374 | Experian 1-888-397-3742 P.O. Box 2002 Allen, TX 75013 | TransUnion 1-800-888-4213 P.O. Box 1000 Chester, PA 19016 |
New York residents can obtain information about preventing identity theft from the New York Attorney General’s Office at: Office of the Attorney General for the State of New York, Bureau of Consumer Frauds & Protection, The Capitol, Albany, New York 12224-0341; https://ag.ny.gov/publications/identity-theft; (800) 771-7755.
For further information about the incident, please call 833-931-4400 from 9:00 a.m. – 9:00 p.m. Eastern Time, Monday through Friday, to speak with a representative specially trained to answer questions about the incident.