BECU becu.org BECU data breach: what happened and what to do
BECU, a Washington credit union, said a vendor that prints member statements had a network security incident in May 2022. BECU began notifying affected members on July 25, 2022. CU Times reported names, Social Security numbers, addresses and account information were involved.
View all 13,177 breaches- Breach date
- 18 May 2022
- Data exposed
- Names, Social security numbers, Physical addresses, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
BECU, formerly Boeing Employees' Credit Union, said the incident did not happen on its own network. A vendor that prints monthly statements for members had a network security incident that involved unauthorized access to some members' data. BECU says it learned of it on June 6, 2022, and suspended its services with the vendor.
Timeline
The California attorney general's list shows a breach date of May 18, 2022 and a report date in late July. BECU determined on July 5, 2022, after an independent forensics firm finished its work, that member information was involved. It began notifying members on July 25, 2022.
What was exposed
CU Times reported that the exposed data included names, Social Security numbers, addresses and account information. BECU did not publish a total number of affected members, so no figure is stated here.
Why a printing vendor matters
Monthly statements are full of personal data: your name, address and account details. When the company that prints them is breached, you may be affected even though you did nothing wrong and the credit union's own systems were fine. Statement data plus a Social Security number is enough to attempt account takeover or open new credit.
The steps below follow FTC guidance for people whose Social Security number or account details were exposed.
Sources checked: cutimes.com, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts being opened in your name. Ask Equifax, Experian and TransUnion separately, as the FTC explains at consumer.ftc.gov. You can lift it whenever you need to apply for credit.
- 2
Watch your BECU accounts
Review statements and set up account alerts in your online banking. Call BECU on the number on your card if a transaction looks wrong.
- 3
Watch your statements and credit reports
Check your bank and card statements for charges you don't recognize, and pull your free reports at annualcreditreport.com. If something looks wrong, report it at IdentityTheft.gov, the FTC's reporting site.
- 4
Expect phishing that mentions the breach
Scammers use real names and addresses to sound credible. Don't click links in unexpected emails or texts, and contact the organization using the number on its official website.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases and the dark web for your email and phone number and tells you what to do next. Serus can't remove data from a breach, but it alerts you when your details turn up.
Frequently asked
Was I affected by the BECU data breach?
BECU notified affected members directly, starting July 25, 2022. If you got a letter, you were affected.
Did hackers get into BECU's own systems?
No. BECU said a vendor that prints member statements had the incident, and it stopped using that vendor.
What was exposed?
CU Times reported names, Social Security numbers, addresses and account information. Check your notice letter for what applies to you.
Should I freeze my credit?
Yes, if your notice lists your Social Security number. A credit freeze is free.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
