Suffolk Credit Union Data Breach: Edelson Lechtzin LLP Launches Investigation Into Exposure of Personal Information

National class action firm Edelson Lechtzin LLP is offering free case evaluations to individuals affected by the Suffolk Credit Union data breach, which stemmed from a cybersecurity incident at a former vendor and may have exposed Social Security numbers and financial account information.

MEDFORD, N.Y., Sept. 16, 2026 /PRNewswire/ -- Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Suffolk Credit Union data breach. The incident originated at Mercadien, P.C., CPAs, a former Suffolk Credit Union service provider. Suffolk Credit Union began notifying affected individuals on September 11, 2026.

Key Facts at a Glance

• Company: Suffolk Credit Union — a member-owned, not-for-profit financial institution.
• Source of the breach: A third-party vendor incident at Mercadien, P.C., CPAs. Suffolk Credit Union's own systems were not accessed.
• When access occurred: Between September 17, 2025 and October 9, 2025.
• When detected: On or about November 7, 2025.
• Review completed: Mercadien provided results to Suffolk Credit Union on August 13, 2026.
• Individuals notified: Beginning September 11, 2026.
• Information exposed: Names, Social Security numbers, financial account numbers, government-issued identification numbers, and other identity verification information.
• People affected: Not publicly disclosed; likely current and former members across multiple states.
• Regulators notified: Delaware, California, and Vermont Attorneys General and the Hawaii Office of Consumer Protection.

What Happened

Mercadien, P.C., CPAs, a former service provider to Suffolk Credit Union, detected unauthorized access to part of its computer environment on or about November 7, 2025. Its investigation determined that an unauthorized third party may have accessed certain data between September 17, 2025, and October 9, 2025. The incident was limited to Mercadien's systems and did not involve Suffolk Credit Union's own network. Mercadien provided its completed review to Suffolk Credit Union on August 13, 2026, and Suffolk began notifying affected individuals on September 11, 2026.

What Information Was Exposed
The breach may have compromised names, Social Security numbers, financial account numbers, government-issued identification numbers, and other information used to verify identity. Because these records are especially sensitive, affected individuals face an increased risk of identity theft, account fraud, and targeted phishing.

Suffolk Credit Union's Response
Suffolk Credit Union states it has no evidence of misuse and has offered affected members a complimentary two-year membership in Experian IdentityWorks Credit 3B, which includes credit monitoring, identity restoration, and up to $1 million in identity theft insurance. The enrollment deadline is December 31, 2026.

Your Legal Options
Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies on behalf of individuals whose sensitive personal data may have been compromised in the Suffolk Credit Union breach. The firm will evaluate your rights and potential claims at no cost.

Recommended Protective Steps

• Preserve your breach notification letter and enroll in the Experian IdentityWorks membership before the December 31, 2026 deadline.
• Review account statements and credit reports regularly and remain vigilant for suspicious activity.
• Consider placing a fraud alert or credit freeze, and be cautious of phishing messages referencing your accounts.

Contact Us for a Free Case Evaluation
Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: [email protected]; Web: www.edelson-law.com. Or click HERE to request a free consultation.

About Edelson Lechtzin LLP
Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions.

SOURCE Edelson Lechtzin LLP