Ellafi Federal Credit Union Hit by Akira Ransomware Attack, Exposing Sensitive Data of 17,627 Individuals Ellafi Federal Credit Union, a Connecticut-based not-for-profit financial institution focused on financial equity for women and underserved communities, confirmed a data breach after a ransomware attack in October 2025. The incident exposed sensitive personal and financial information of 17,627 individuals across the U.S., including 40 in Maine. On October 14, 2025, Ellafi detected a network disruption and launched an investigation with cybersecurity experts. By November 20, the credit union determined that unauthorized parties had accessed files containing names, Social Security numbers, credit card numbers, and debit card numbers. The ransomware group Akira later claimed responsibility, asserting it had stolen 17 GB of data, including employee records, customer information, W-9 forms, contracts, financial documents, and HR files. The breach was first posted on the dark web on November 3. Affected individuals began receiving electronic notifications on December 23, 2025, and the incident was reported to the Maine Attorney General’s office on December 27. Ellafi is offering 12 months of free credit monitoring, dark web monitoring, and identity theft recovery services through IDX, with an enrollment deadline of March 23, 2026. The law firm Shamis & Gentile P.A. is investigating potential legal claims for those impacted, citing possible eligibility for compensation. The breach underscores the growing threat of ransomware attacks targeting financial institutions and the exposure of highly sensitive consumer data.