FAIRWINDS Credit Union data breach: member data exposed at its assessor, Mercadien

Why did FAIRWINDS members get a breach letter?

FAIRWINDS gave Mercadien member information so the firm could carry out an independent assessment, which the letter describes as part of routine quality control and the regulatory requirements credit unions face. The breach happened in Mercadien's systems; FAIRWINDS says its own systems were not compromised.

Mercadien has sent letters of its own to people whose data it held for financial institutions; its entry covers that notice, which Indiana records at 488,893 people. FAIRWINDS filed separately, under its own name, and Indiana lists the two reports as separate rows. Neither record says whether any of FAIRWINDS' 165,054 are also counted in Mercadien's total. The guide to letters from a CPA or advisory firm explains how this kind of vendor notice reaches people, and the guide to vendor breach notices compares how other institutions describe their vendors.

When did it happen, and how long did notice take?

Date	What happened	Source
September 7 to November 7, 2025	Unauthorized actor may access or take information in Mercadien's systems	FAIRWINDS letter, California AG record
November 7, 2025	Mercadien identifies the incident	FAIRWINDS letter
August 13, 2026	Mercadien tells FAIRWINDS its members' information was affected	FAIRWINDS letter
September 4, 2026	FAIRWINDS finishes checking who was affected	FAIRWINDS letter
September 23, 2026	Letter date; notice sent, per Indiana; logged in Massachusetts	Letter, Indiana AG, Massachusetts list
September 25, 2026	Published by Texas	Texas AG list
December 31, 2026	Last day to enrol in Experian IdentityWorks	FAIRWINDS letter

Mercadien found the incident on November 7, 2025 and began an investigation, which put the access window at September 7 to November 7, 2025. More than nine months passed before Mercadien told FAIRWINDS. FAIRWINDS then ran its own check of the affected population and finished it on September 4, 2026. From the start of the access to the letters took more than a year. The guide to how long organizations take to notify shows how that compares.

How many members were affected?

Record	People counted
Indiana attorney general, total	165,054
Texas residents	1,126
Massachusetts residents	271
Indiana residents	223
Rhode Island residents (letter)	about 39

Texas published its report on September 25, 2026. Massachusetts logged its report on September 23, 2026, as a bank or credit union. The letter's Rhode Island paragraph gives about 39. The total places FAIRWINDS in the ranking of 2026 breaches by people affected.

What member information was involved?

The California copy leaves the list as a field, "[Data Elements]". The state records name the types:

• Texas lists names, addresses, Social Security numbers and driver's license numbers.
• Massachusetts marks Social Security numbers, financial account numbers and driver's license numbers as breached for its residents.

The Massachusetts copy of the letter gives no detail on the incident at all. It says Massachusetts law prevents FAIRWINDS from describing its nature, and goes straight to the offer. FAIRWINDS says it knows of no fraud or identity theft tied to the event.

What is FAIRWINDS offering?

Experian IdentityWorks, with credit monitoring, identity restoration and identity theft insurance. The California copy leaves the length as "## months". The Massachusetts copy says 24 months. Members have to enrol themselves, by 11:59 pm UTC on December 31, 2026. The guide to credit-monitoring offers compares this term with others.

Was my information in the FAIRWINDS data breach?

A letter from FAIRWINDS dated September 23, 2026 means the credit union's check found your information among the data Mercadien held. The assistance line is 833-918-1115, and FAIRWINDS also takes post at 3087 N. Alafaya Trail, Orlando, FL 32826. The letter warns that FAIRWINDS will never ask for online banking usernames, passwords or one-time codes. It asks members to check any suspicious call, text or email with the credit union at (800) 443-6887.

What the notice leaves open

• How the intruder got into Mercadien's systems.
• The letter does not explain the nine months between Mercadien finding the incident and telling FAIRWINDS.
• Whether FAIRWINDS members are also counted in Mercadien's own 488,893.
• Which data each member lost; the filed copies leave the list blank.