Glover v. America's First Federal Credit Union

On August 29, 2025, a class action lawsuit was filed in the United States against America's First Federal Credit Union. The lead plaintiff, James Glover, alleges the credit union failed to implement adequate cybersecurity measures, resulting in a massive data breach that exposed sensitive personal and financial information of over 300,000 members. The complaint asserts claims for negligence, breach of fiduciary duty, and violations of state consumer protection laws, alleging that stolen data, including Social Security numbers and account details, was actively sold on the dark web, leading to widespread identity theft and fraudulent transactions affecting the plaintiff class.

As of the current date, the case is in early procedural stages. The credit union has filed a motion to dismiss, arguing that the plaintiffs lack standing because speculative future harm does not establish concrete injury. The court has yet to rule on class certification or the motion to dismiss.

The central dispute is whether America's First Federal Credit Union breached its duty of care by maintaining inadequate data security protocols. The litigation focuses on the institution's liability for consequential damages from identity theft and whether its security posture met industry standards at the time of the intrusion.

The case has intensified public scrutiny on cybersecurity practices within smaller financial institutions and credit unions, which are increasingly targeted by ransomware groups. It has prompted consumer advocacy groups to call for stricter federal data security standards akin to those imposed on large banks, highlighting the vulnerability of personal data in the interconnected financial ecosystem.