Blackpool Credit Union members' data may be on the dark web

Credit union said it believed that some of the files accessed included personal data such as names of members, addresses, contact numbers, date of birth, and credit union account information

The dark web is a part of the internet that cannot be accessed by standard search engines and can only be visited using highly specialised computer programs.

Members of one of Cork’s largest credit unions have been warned to be vigilant against financial scams after a major cyberattack saw the personal details of thousands of members, including their names, addresses, dates of birth, and account information stolen and possibly shared on the dark web.

Blackpool Credit Union, on the city’s northside, said technical experts were called in to perform a forensic investigation of the hack as soon as they became aware of it, adding that the matter has been reported to the Central Bank, the Data Protection Commission (DPC), and An Garda Síochána.

The lender confirmed that its main banking system was not impacted by the attack, and that no money was removed from any member accounts.

It also confirmed that no PINs were compromised.

However, the credit union said it believed that some of the files accessed did include personal data, including the names of members, addresses, contact numbers, dates of birth, and credit union account information.

Blackpool Credit Union is one of the city’s largest, with around 6,500 members.

Its latest annual report showed a surplus of €507,722 for the 12 months to the end of September 2024, with the credit union issuing loans of approximately €5m in that period.

The credit union’s current assets amount to more than €36m, and it is considered a major lender in the city having been established in 1963.

In a statement, the credit union confirmed details of the cyberattack to the Irish Examiner.

“We take our data protection responsibilities very seriously, and it is a matter of great regret to us that this has happened,” it said.

“We will also be directly contacting affected individuals where necessary following this incident,” it said.

In a letter to customers this week, the credit union said: “We are writing to let you know that on Friday, August 22, 2025, Blackpool Credit Union was the victim of a cyberattack, and we believe some of your personal data may have unfortunately been accessed.

“Immediate steps were taken to prevent further attacks, and also to bring our systems back online so that members did not experience any loss of service.”

The credit union said there is also a risk that members’ information could be disclosed on the dark web.

The dark web is a part of the internet that cannot be accessed by standard search engines, and it can only be visited using highly specialised computer programs.

Information shared on the dark web is often used for criminal purposes, including financial scams.

“Data on the dark web is at risk of being used by fraudsters to try to trick those individuals whose data is on the dark web,” the credit union told members.

“We wanted to inform you of this incident so that you can exercise increased vigilance in relation to ‘phishing’ or any other unsolicited or suspicious communications you may receive, including any that purport to have been sent by or on behalf of Blackpool Credit Union,” the branch added.

The Central Bank of Ireland confirmed to the Irish Examiner that it has been informed of the cyberattack, adding that it is continuing to engage with Blackpool Credit Union in relation to the matter.

The Data Protection Commission also said it received a breach notification from Blackpool Credit Union, which “is currently under assessment”.

The commission can investigate such breaches and enforce data protection laws through corrective powers and potential fines.