A state resident has filed a proposed class action lawsuit against Ellafi Federal Credit Union, accusing the Middletown-based financial institution of failing to protect customers’ personal information in a data breach that affected more than 17,600 people last year.
The complaint, filed Jan. 7 in U.S. District Court in Connecticut, was brought by Joseph Fraulino, who is identified only as a Middlesex County resident and an Ellafi customer, on behalf of himself and others whose information the credit union is accused of compromising.
Court filings indicate the plaintiff is seeking at least $5 million in damages on behalf of the proposed class.
In a statement emailed Thursday by a company spokesperson, Ellafi said it dispute the allegations in the lawsuit and will defend itself “through the appropriate legal process.”
“Protecting the privacy and security of our members’ information is among our highest priorities,” the statement continued. “Upon learning of a potential network intrusion, Ellafi immediately began an investigation with experienced cybersecurity specialists. Based on that investigation, Ellafi determined that certain member information may have been accessed. Ellafi notified affected members within the regulatory required timeframe and provided complimentary credit monitoring services.”
According to the lawsuit, hackers gained access to Ellafi’s computer network on or about Oct. 14, 2025, and exported data that included names, Social Security numbers and credit or debit card numbers. Ellafi discovered the intrusion that month and completed an internal investigation on Nov. 20, the complaint states.
The lawsuit, however, claims that Ellafi did not notify affected customers until late December — about two months after the breach was detected — leaving them unaware that their personal data may have been stolen.
Fraulino said he received written notice around Dec. 23. The lawsuit claims Ellafi later reported to the Maine attorney general’s office that 17,627 individuals were affected.
Ellafi Federal Credit Union, known as Seasons Federal Credit Union until it rebranded in April last year, is a federally chartered, member-owned cooperative based at 524 South Main St. in Middletown. It also has a branch office at 1371 East Main St. in Meriden.
The lawsuit accuses Ellafi of negligence, breach of implied contract, unjust enrichment and violating consumer protection standards by failing to implement adequate cybersecurity measures and failing to promptly alert customers. It also claims Ellafi did not sufficiently explain how the breach occurred or what steps it took afterward to prevent future attacks.
The suit claims customers now face an increased risk of identity theft and fraud and have been forced to spend time and money monitoring their financial accounts and credit reports. It adds that Social Security numbers, unlike payment card numbers, cannot easily be replaced, creating long-term risks for victims.
The complaint states that Ellafi provided affected customers with “a free one-year subscription” to identity theft monitoring services and claims that offer is inadequate given the potential for ongoing misuse of stolen data. It instead seeks to expand the services to 10 years for each customer.
Ellafi, however, provided Hartford Business Journal with a sample copy of a letter about the data breach dated Dec. 23 that was sent to affected customers with an offer of much more comprehensive anti-fraud services. The letter’s offer includes “24 months of credit monitoring, dark web monitoring, a $1 million identity fraud loss-reimbursement policy and fully managed identity theft recovery services.” The letter also sets the deadline to enroll in these services as March 23.
The plaintiffs also are seeking class-action status, monetary damages, punitive damages, attorneys’ fees and court-ordered changes to Ellafi’s data security practices.
Note: This article was updated to reflect complete information about Ellafi’s offer of credit-monitoring services to its customers.
