Notice of Data Security Incident

LEHIGH VALLEY, PENNSLYVANIA: August 2, 2024 – First Commonwealth Federal Credit Union (“First Commonwealth”) is a credit union located in Lehigh Valley, Pennsylvania, which experienced a data security incident that may have involved personal information belonging to certain individuals who are either current, or former, members.  First Commonwealth is sending notification of this incident via U.S. Mail to potentially impacted individuals and provided resources to assist them.  However, First Commonwealth after a diligent search was not readily in possession of mailing addresses for all potentially impacted individuals, and accordingly, this notice is being provided for the benefit of those individuals that could not be contacted via U.S. Mail.

On June 27, 2024, First Commonwealth discovered unusual network activity. In response, it immediately took steps to contain it and initiated an investigation with the assistance of independent cybersecurity experts. The investigation revealed that an unknown actor gained access to and obtained data from the First Commonwealth network without authorization on or around June 26, 2024.  On July 1, 2024, after a comprehensive review of the potentially impacted data, First Commonwealth determined that personal information may have been involved.  Since that time, First Commonwealth has worked diligently to identify current contact information needed to notify all potentially affected individuals.   

First Commonwealth is not aware of any evidence of the misuse of any information potentially involved in this incident.  However, on August 2, 2024, First Commonwealth provided notice of this incident to potentially impacted individuals whose address information could be verified.  In so doing, First Commonwealth provided information about the incident and about steps that potentially impacted individuals can take to protect their information.  First Commonwealth takes the security and privacy of information in its possession very seriously and is taking steps to prevent a similar event from occurring in the future.       

The following information may have been involved in the incident: names, addresses, Social Security numbers, dates of birth, or account numbers.

First Commonwealth has established a toll-free call center to answer questions about the incident and to address related concerns.  Call center representatives are available at 1-888-461-3349, Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time.  Or for enrollment assistance, please call 1-888-461-3349 or visit https://response.idx.us/fcfcu.  We also encourage members to enable the security features and alerts available in the First Commonwealth Federal Credit Union Digital Banking application. These can be found in the Digital Banking User Guide located at www.firstcomcu.org/digitalbanking.

The privacy and protection of personal information is a top priority for First Commonwealth, which deeply regrets any inconvenience or concern this incident may cause.

Steps You Can Take to Protect Your Information

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (FTC).

Request a Copy of Your Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting https://www.annualcreditreport.com, calling toll-free 1-877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You also can contact one of the following three national credit reporting agencies:

Equifax
P.O. Box 105851
Atlanta, GA 30348
1-800-525-6285
www.equifax.com

Experian
P.O. Box 9532
Allen, TX 75013
1-888-397-3742
www.experian.com

TransUnion
P.O. Box 1000
Chester, PA 19016
1-800-916-8800
www.transunion.com

Place a Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least one year. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at https://www.annualcreditreport.com.

Put a Security Freeze: You have the right to put a security freeze on your credit file for up to one year at no cost.  This will prevent new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you, including your full name, Social Security Number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your respective state Attorney General about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the Attorney General in your state.

Federal Trade Commission (FTC)
600 Pennsylvania Ave, NW
Washington, DC 20580
consumer.ftc.gov and www.ftc.gov/idtheft
1-877-438-4338

Maryland Attorney General
200 St. Paul Place
Baltimore, MD 21202
marylandattorneygeneral.gov
1-888-743-0023

New York Attorney General
Bureau of Internet and Technology Resources
28 Liberty Street
New York, NY 10005
1-212-416-8433

North Carolina Attorney General
9001 Mail Service Center
Raleigh, NC 27699
ncdoj.gov
1-877-566-7226

Rhode Island Attorney General
150 South Main Street
Providence, RI 02903
riag.ri.gov
1-401-274-4400

Washington D.C. Attorney General
441 4th Street, NW
Washington, DC 20001
oag.dc.gov
1-202-727-3400

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include to know what is in your file; to dispute incomplete or inaccurate information; to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information; as well as other rights. For more information about the FCRA and your rights pursuant to the FCRA, please visit https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf.