First Federal Savings & Loan 2026 Data Breach
Financial Services / Community Bank (savings & loan association) / Retail banking / United States
First Federal Savings & Loan 2026 Data Breach
US community savings-and-loan association providing retail banking, deposit and lending services (per CA AG filing: First Federal S&L Association of Pascagoula-Moss Point, MS).
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
98/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
55k rowsRecords
2026Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
Gov IDGovernment ID
FinancialFinancial Account (bank/card)
Breach Summary
An unauthorized party accessed First Federal Savings & Loan's network on or about February 9-10, 2025; the bank determined on December 5, 2025 that files may have been acquired and began notifying affected individuals and regulators (including a California Attorney General filing) in January 2026. Roughly 55,000 records are tracked as circulating here. Exposed data included names in combination with government-issued ID numbers and financial account and credit/debit card numbers. The threat actor and access method were not disclosed.
Full threat analysis, exploitation vectors, and principal guidance below.
9 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
55k rows records analyzed
About First Federal Savings & Loan
First Federal Savings & Loan is a US community savings-and-loan association providing retail banking, deposit and lending services to individuals and small businesses in its regional market. Per the California Attorney General filing, this record corresponds to First Federal Savings & Loan Association of Pascagoula-Moss Point, Mississippi.
Why They Hold Your Data
As a community bank, First Federal holds customer financial records including names, government-issued ID numbers, account numbers and credit/debit card numbers collected for deposit, lending and identity-verification purposes, a high-sensitivity combination of identity and financial data.
Recent Developments
First Federal's network was accessed between February 9 and 10, 2025; the bank determined on December 5, 2025 that personal data may have been acquired and notified regulators including the California Attorney General in January 2026, prompting law-firm investigations.
Data Points Exposed
3 verified field types
Financial Account (bank/card) High
Full Name
Government ID Critical
Breach Impact
A community-bank breach exposing government IDs together with bank and card numbers is high-severity, creating direct identity- and financial-fraud exposure, multi-state notification obligations and litigation exposure disproportionate to the bank's size. The long gap between intrusion (February 2025) and determination (December 2025) widens the window of undetected misuse.
Principal Risk Advisory
What this means for a principal
A financial-institution breach: account, wealth or payment data supports direct fraud and highly credible financial-impersonation scams. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation