Fairwinds Credit Union Data Breach, Vendor Mercadien May Have Exposed Social Security Numbers and Financial Account Information

Fairwinds Credit Union is notifying members that their personal information may have been accessed in a cybersecurity incident at Mercadien, P.C. CPAs, an outside accounting and professional-services vendor. According to the credit union’s breach notice filed with the California Attorney General, the incident did not involve a compromise of Fairwinds’ own systems.

Fairwinds is offering affected members free Experian IdentityWorks monitoring, with enrollment due by December 31, 2026. As of October 1, 2026, no Fairwinds data-breach lawsuit, settlement or claim form could be verified. Law firms have announced investigations, but an investigation is not a filed lawsuit.

Fairwinds Credit Union Data Breach: Quick Facts

Detail	Information
Organization	Fairwinds Credit Union, Orlando, Florida
Vendor involved	Mercadien, P.C. CPAs
Where it happened	Mercadien’s systems, not Fairwinds’ systems
Possible unauthorized access	September 7, 2025 to November 7, 2025
Mercadien discovered the incident	November 7, 2025
Mercadien notified Fairwinds	August 13, 2026
Fairwinds finished its member review	September 4, 2026
Member notices dated	September 23, 2026
Information potentially involved	Social Security numbers, financial account information and, in some cases, driver’s license numbers
Misuse reported by Fairwinds	None at the time of the notice
Free protection offered	Experian IdentityWorks: credit monitoring, identity restoration and identity-theft insurance
Enrollment deadline	December 31, 2026, 11:59 p.m. UTC
Lawsuit	None verified as of October 1, 2026
Settlement or claim form	None verified

What Happened to Fairwinds Credit Union Member Information at Mercadien?

Fairwinds hired Mercadien to perform an independent assessment tied to routine quality-control and regulatory requirements for credit unions, and shared the information needed for that work. Mercadien later found suspicious activity in its own systems.

According to Fairwinds’ notice, Mercadien’s investigation determined that an unauthorized person may have accessed or acquired information in its systems between September 7 and November 7, 2025. Mercadien did not tell Fairwinds that member information was affected until August 13, 2026. Fairwinds finished its own review on September 4, 2026, and its notices went out dated September 23, 2026. California’s Attorney General breach database lists the September 23 report.

What Personal Information May Have Been Exposed in the Fairwinds Credit Union Breach?

The exact data varies by person, so rely on your own notice. State filings and notices identify these possible categories:

• Names
• Social Security numbers
• Financial account information
• Driver’s license numbers, in limited circumstances

Do not assume every member had every category exposed.

How Many People Were Affected by the Fairwinds Credit Union Data Breach?

No single, verified nationwide count appears in the Fairwinds notices reviewed. A Texas filing reportedly lists 1,126 Texas residents, and filings were also made in California, Massachusetts and New Hampshire. Because there is no confirmed total, this article does not state one.

What Is Fairwinds Credit Union Doing After the Mercadien Breach?

Fairwinds says it has ended its relationship with Mercadien. It also says it had no indication that the information had been fraudulently used when notices went out. That does not eliminate risk: a Social Security number can be misused long after a breach.

Affected members are offered complimentary Experian IdentityWorks services, including credit monitoring, identity restoration and identity-theft insurance of up to $1 million, subject to policy terms. The Massachusetts notice says Massachusetts residents receive 24 months of coverage. Fairwinds cannot enroll members automatically, and no credit card is required.

How Do Fairwinds Credit Union Members Enroll in Free Credit Monitoring?

Use the enrollment instructions and activation code in your individual notice, and keep the letter until you finish enrolling. The deadline is December 31, 2026, at 11:59 p.m. UTC. Fairwinds lists 833-918-1115 for questions about the notice. Its official number for validating or reporting suspicious communications is 800-443-6887.

What Should Fairwinds Credit Union Members Do After the Data Breach?

1. Enroll in Experian IdentityWorks before December 31, 2026.
2. Review statements and credit reports for unfamiliar activity, as Fairwinds recommends.
3. Consider a credit freeze with Equifax, Experian and TransUnion. Federal law prohibits charging for a security freeze, though a freeze can affect new credit applications until lifted.
4. Consider a fraud alert, which asks lenders to verify your identity before opening new credit.
5. Set up account transaction alerts with your financial institutions.
6. Report unrecognized activity to the institution using the number on your statement, and file an identity-theft report with the FTC at IdentityTheft.gov.
7. Watch for scams. Fairwinds says it will not ask for your online-banking username, password or multifactor-authentication code. Do not respond to unexpected emails or texts asking for them.

Has Fairwinds Credit Union Been Sued Over the Mercadien Data Breach?

No Fairwinds data-breach lawsuit was verified in the sources reviewed as of October 1, 2026. At least two law firms have announced investigations. That means there is currently no verified:

• Putative class action filed in court
• Court-approved class or settlement
• Settlement payment or claim form
• Court-set claim deadline

Be careful with websites that describe a “Fairwinds class action” as if a case already exists. For comparison, see data-breach cases where complaints were actually filed: Beacon Mutual Insurance Data Breach Lawsuit, Did the January 2026 Ransomware Attack Expose Your Personal Information? DiMeo v. The Beacon Mutual Insurance Company and Malloy v. The Beacon Mutual Insurance Company and Lennar Data Breach Lawsuit, Were You Affected? DiMeglio v. Lennar Corporation, et al., No. 1:26-cv-25575.

What Laws Protect Fairwinds Credit Union Members After a Vendor Data Breach?

Two laws are commonly relevant. The Florida Information Protection Act (Fla. Stat. § 501.171) requires covered entities to take reasonable measures to protect personal information and to notify affected Florida residents. The Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) requires financial institutions to safeguard customer information, including when vendors handle it.

If a lawsuit is later filed, the claims could address how Fairwinds oversaw Mercadien and what security measures protected the data. Those are possible issues, not findings. No court has ruled that Fairwinds or Mercadien violated any law in connection with this incident.

What Happens If a Fairwinds Credit Union Class Action Is Filed?

If a putative class action is filed and later settled, class members would generally have options under Federal Rule of Civil Procedure 23(e): submit a claim for documented losses or other benefits, opt out to keep the right to sue individually, or object to the terms in writing. Attorney fees in a class settlement require court approval.

None of that exists yet for Fairwinds, so there is nothing to file and no deadline other than the December 31, 2026 monitoring enrollment.

Are Free Credit Monitoring Services From a Data Breach Taxable?

Under IRS Announcement 2015-22, the IRS said it would not assert that identity-protection services provided to data breach victims by the organization that held their data are taxable income. Cash settlement payments are a different matter and can have different tax treatment, so ask a tax professional if one is ever paid.

Fairwinds Credit Union Data Breach FAQ

Did the Fairwinds Credit Union breach happen on Fairwinds’ own network?

No. Fairwinds’ notice says it occurred in its vendor Mercadien’s systems and did not involve a compromise of Fairwinds’ systems.

What information was exposed in the Fairwinds Credit Union breach?

Potentially Social Security numbers, financial account information and, in limited cases, driver’s license numbers. It varies by person, so check your notice.

When did the Fairwinds Credit Union data breach occur?

An unauthorized person may have accessed or acquired information between September 7 and November 7, 2025. Mercadien discovered the incident on November 7, 2025.

When did Fairwinds learn member information was affected?

Mercadien notified Fairwinds on August 13, 2026.

Is there a Fairwinds Credit Union data breach settlement?

No settlement was verified as of October 1, 2026.

Is there a Fairwinds Credit Union class action lawsuit?

No filed class action was verified. Law firms have announced investigations only.

Does Fairwinds offer free credit monitoring after the breach?

Yes. Fairwinds offers complimentary Experian IdentityWorks, with enrollment due by December 31, 2026.

Should Fairwinds members freeze their credit?

It is a reasonable option if your Social Security number may have been exposed. Freezes are free under federal law.

Can Fairwinds members file a claim for money from this breach?

Not currently. There is no verified settlement claim form or compensation program.

Fairwinds Credit Union Data Breach Key Dates

Date	Event
September 7, 2025	Start of the reported unauthorized-access period
November 7, 2025	Mercadien identifies the incident
August 13, 2026	Mercadien notifies Fairwinds that member information was affected
September 4, 2026	Fairwinds completes its member review
September 23, 2026	Notices dated; regulatory filings reported
December 31, 2026	Deadline to enroll in complimentary Experian service

Bottom Line on the Fairwinds Credit Union Mercadien Breach

A vendor’s systems, not Fairwinds’, were involved, but Fairwinds members’ Social Security numbers and financial account information may have been exposed. The most useful action today is to read your notice, enroll in free Experian monitoring by December 31, 2026, and consider a credit freeze. There is no verified lawsuit, settlement or claim form, and anyone describing one as already filed is overstating the legal status.

This article is general information, not legal advice. AllAboutLawyer.com is not a law firm. If you received a notice, rely on it for the details that apply to you.

Sources: Fairwinds Credit Union Notice of Data Event filed with the California Attorney General; Massachusetts Attorney General breach notification filing (Fairwinds Credit Union); California Attorney General data breach database; Texas and New Hampshire notice filings; Dapeer Law data breach investigation page; Fla. Stat. § 501.171; 15 U.S.C. § 6801 et seq.; IRS Announcement 2015-22.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the Fairwinds Credit Union notice filed with the California Attorney General, the Massachusetts Attorney General filing and the California breach database, as of October 1, 2026. Last Updated: October 1, 2026.