POLAM Federal Credit Union Data Breach Analysis

Summary

POLAM Federal Credit Union, a Los Angeles-based institution serving the Polish-American community, has notified members that a former employee accessed and potentially exfiltrated internal documents containing personal information. Unlike the ransomware and third-party vendor incidents that dominate financial sector breach disclosures, this is a straightforward insider threat case: no external attacker, no malware, no compromised vendor — just a departed employee with lingering access to sensitive files.

Key facts:

Company: POLAM Federal Credit Union
Attack vector: Insider (former employee)
Data exposed: Full names (letter indicates additional data types were involved, though the notification template obscures specifics)
Records affected: Undisclosed
Discovery: On or about May 20, 2025
Confirmation of impacted data: August 10, 2026 — nearly 15 months after discovery
Notification vendor: Cyberscout (a TransUnion company)

The gap between discovery and confirmed notification is the standout detail here, and it's one every compliance officer reading this should flag immediately.

Timeline of Events

May 20, 2025 — POLAM FCU learned that a former employee had potentially accessed and/or exfiltrated a limited number of documents without authorization. The notification letter is vague on how this was discovered — whether through access log review, a tip, or unrelated litigation — which itself is a gap worth noting for any credit union modeling its own incident response plan against this case.

Following discovery — The credit union states it "immediately commenced a prompt and thorough investigation" and engaged external cybersecurity professionals. Standard language, but the timeline that follows undercuts the "prompt" framing.

August 10, 2026 — Roughly 15 months after the incident was first identified, POLAM FCU completed "a thorough forensic investigation and extensive manual document review" and determined that the accessed files contained members' personal information.

Notification date — Letters went out shortly after the August 2026 determination, consistent with the pattern of notifying "without unreasonable delay" once the scope is confirmed — but the 15-month gap between discovery and confirmation is the real story.

This timeline mirrors a pattern we've tracked across smaller credit unions: limited IT security staffing means forensic review of insider-access incidents — which often require manual document-by-document classification rather than automated scanning — drags on far longer than consumer-facing breaches at larger institutions. For comparison, see how Anderson Bancshares' vendor-driven breach moved from discovery to notification in a fraction of the time once a third-party forensic vendor was engaged early.

What Data Was Exposed

The notification letter confirms full name was among the exposed data elements, with the surrounding text suggesting additional data categories were listed in the personalized version of the letter sent to individual members (a common artifact of mail-merge templates where the specific data-element list didn't survive to the public-facing copy).

For a credit union, "limited amount of documents" accessed by a former employee is a phrase that deserves scrutiny rather than reassurance. Employees in financial institutions routinely have access to:

Member account numbers and balances
Loan application files (income, SSN, employment history)
Wire transfer records
Internal risk and fraud-flag notes

Even a "limited" document set pulled from a credit union's internal systems can contain far more sensitive financial data than a name alone. Name-only exposure carries lower identity-theft risk than SSN or account-number exposure, but it still enables targeted phishing and social engineering — particularly when paired with the knowledge that the target is a POLAM FCU member, which signals ethnicity, community ties, and likely account relationships that make spear-phishing more effective.

How the Attack Happened

This is a textbook insider threat scenario: a former employee with retained or unrevoked access — or access exercised before termination that wasn't detected until later — obtained documents outside authorized use. The letter does not specify:

Whether access occurred before or after termination
Whether credentials were properly deprovisioned at separation
What systems or repositories were involved (network file shares, core banking system, email)
Whether exfiltration was confirmed or only "potential"

The ambiguity around "potentially accessed and/or exfiltrated" is notable. It suggests POLAM FCU could not definitively determine whether data left the network — likely because logging was insufficient to distinguish access from exfiltration, a common gap in smaller institutions' security stacks.

Insider incidents like this are one of the hardest categories to prevent technically, because the actor already has legitimate credentials. The controls that matter are procedural: offboarding checklists, access reviews, and data loss prevention (DLP) tooling that flags bulk downloads or unusual file access patterns before an employee's last day — not after.

Regulatory Implications

As a federally chartered credit union, POLAM FCU falls under NCUA supervision rather than FDIC or OCC, but the underlying safeguards obligations are analogous:

GLBA Safeguards Rule (16 CFR Part 314): The FTC's amended Safeguards Rule requires financial institutions to maintain access controls, including "authenticat[ing] and permit[ting] access only to authorized users" and to promptly terminate access when it's no longer needed — squarely relevant to an insider-access incident involving a former employee. NCUA-supervised credit unions are held to comparable standards under NCUA's own guidelines for member information security (12 CFR Part 748, Appendix A), which mirrors GLBA's administrative, technical, and physical safeguard requirements.
NCUA Reporting: Credit unions experiencing a security incident that could jeopardize member information are required to notify NCUA under the agency's incident notification rule, which took effect in September 2023 — generally within 72 hours of determining a reportable cyber incident occurred. Whether POLAM FCU's 15-month investigation window intersects with that reporting clock is a question examiners are likely to ask.
California data breach notification law (Cal. Civ. Code § 1798.82): Given POLAM FCU's Los Angeles headquarters and likely California-resident membership, state notification timing requirements apply — generally "in the most expedient time possible and without unreasonable delay." A regulator or plaintiff's attorney could reasonably question whether a 15-month gap between discovery and notification satisfies that standard, even accounting for legitimate forensic investigation time.
NY DFS Part 500: Not directly applicable unless POLAM FCU does business with New York residents in a way that triggers coverage, but the access-control and termination provisions in Part 500.7 reflect the same industry-standard expectation: revoke access promptly upon separation and monitor for anomalous activity by departed personnel.

Smaller credit unions frequently underestimate how closely insider-access incidents are scrutinized relative to external breaches — regulators view unauthorized internal access as a control failure (access management, offboarding, monitoring) rather than an unavoidable external attack, which can shape enforcement posture.

The Bigger Picture

Insider threats remain a persistent, underreported category in financial sector breach data. Unlike vendor compromises — which have generated a wave of disclosures tied to platforms like Marquis affecting credit unions nationwide — insider incidents tend to surface individually and quietly, often with long investigation timelines because they require reconstructing exactly what an authorized user did with legitimate access.

The 15-month gap between discovery and confirmed data exposure in this case is longer than typical but not unprecedented among smaller institutions without dedicated digital forensics capability. It underscores a structural problem in the credit union sector: institutions with limited IT security budgets — often community-focused credit unions like POLAM FCU — lack the logging infrastructure to quickly answer "what exactly did this person access or take," turning what should be a weeks-long investigation into more than a year.

Action Items for Peer Institutions

Audit offboarding procedures now. Confirm that access revocation for departing employees — network shares, core banking systems, email, VPN — happens on or before the last day of employment, not days or weeks later.
Deploy access logging sufficient to distinguish "viewed" from "downloaded/exfiltrated." If your institution cannot definitively answer whether data left the network after an insider incident, your logging is inadequate for GLBA Safeguards Rule compliance and for NCUA incident reporting obligations.
Review your NCUA 72-hour incident reporting readiness. Map out internally how your institution would determine "reportable cyber incident" status quickly enough to meet the notification clock, even while a fuller forensic investigation continues.
Implement anomalous access alerting for privileged and soon-to-depart employees. Bulk document access or downloads in the weeks before a resignation or termination date should trigger review before the employee's last day, not during a post-incident investigation.
Set internal SLAs for forensic investigation timelines. A 15-month gap between discovery and notification invites regulatory and reputational scrutiny regardless of the underlying facts. Engage external forensic support early enough to keep investigation windows to weeks, not quarters, and document the reasons for any extended timeline in case examiners ask.