November 9, 2026: The Atlantic Federal Credit Union mailed members about a breach at Mercadien, P.C. CPAs, an accounting and advisory firm it uses. The letter says member information, including names, "may have been impacted." AFCU does not describe its own systems as reached, and it has not said how many members are affected. See the Atlantic FCU breach record.
A sample of the letter was posted by Massachusetts regulators as notice 2026-1973. Massachusetts law limits what these letters can say about an incident, and the posted sample hides the other data fields behind a placeholder. AFCU is offering Experian IdentityWorks, with enrollment open until February 26, 2027.
This is not a new attack on Mercadien. The letter ties AFCU members to a Mercadien incident that the firm had already reported to state regulators.
What happened in the Atlantic FCU data breach?
AFCU shared member data with Mercadien for accounting and advisory work. Mercadien investigated a breach of its own systems and then told AFCU. The credit union reviewed the affected files and mailed members on November 9.
Mercadien has filed two notices with the California Attorney General. In the first notice, the firm said it detected an intrusion on November 7, 2025. On August 13, 2026, it found that the stolen files included data from financial institutions.
In the second notice, Mercadien said an attacker exploited a security weakness between September 17 and October 8, 2025. AFCU's letter does not say which of the two incidents involved its members. All of Mercadien's notices are on the Mercadien company page.
What data was exposed?
The AFCU sample confirms member names and lists other details that are hidden in the public copy. Mercadien's California notices give a fuller picture of what the firm held:
- First notice: names and Social Security numbers from financial institution work.
- Second notice: names and Social Security numbers, plus driver's license numbers, dates of birth and bank account numbers in some cases.
Not every AFCU member will have all of these fields exposed. Your own letter lists the data that applies to you.
Who is affected?
The affected group is AFCU members whose data was in Mercadien's files and who received a November 9 letter. Staff records are not mentioned in the sample.
Other banks and credit unions also used Mercadien. If you never banked at AFCU, you may still be covered by Mercadien's own notices if another institution sent the firm your file.
Was Atlantic FCU itself hacked?
Not according to the current letter. AFCU describes an incident at Mercadien after the credit union provided data for accounting work. Nothing in the letter says AFCU's online banking or branch systems were reached.
What should Atlantic FCU members do?
- Keep the November 9 letter and enroll in Experian IdentityWorks before February 26, 2027.
- Call Experian at 833-918-4029, Monday to Friday from 8 a.m. to 8 p.m. Central, with the engagement number from your letter.
- Place a free credit freeze if your letter lists a Social Security number or account number.
- Review your AFCU statements for withdrawals you do not recognize.
- Ignore texts asking for your online banking password to "fix" the Mercadien issue. AFCU and Mercadien will not ask for it that way.
Identity restoration help is available without enrolling, but credit monitoring needs the activation code from the letter. Similar vendor notices this month include the Missoula schools Frontline breach and the Baker Tilly third-party platform breach.
Frequently asked questions
How many Atlantic FCU members were affected?
Atlantic FCU has not said how many members are affected. The credit union mailed letters on November 9, 2026, to members whose data was in files held by its accounting vendor, Mercadien. Mercadien's own notices also do not give a total for AFCU members.
Were Social Security numbers involved in the Atlantic FCU breach?
The public sample of AFCU's letter hides every field except names. Mercadien's California notices say Social Security numbers were in files from its financial institution work, and some files also held bank account numbers. Check your own letter to see which details apply to you.
Is this a new Mercadien breach?
No. AFCU's letter describes a Mercadien incident that the firm already reported. Mercadien detected one intrusion on November 7, 2025, and reported a separate weakness exploited between September and October 2025. AFCU's letter does not say which incident involved its members.
Should I change my Atlantic FCU password?
The letter does not say AFCU's own systems were reached, so the breach did not expose online banking passwords. Using a unique password is still good practice. Review your statements, consider a credit freeze if your letter lists an SSN, and enroll in the free Experian monitoring.