Community Choice Credit Union in Colorado today confirmed it notified 8,465 people of a May 2025 data breach that compromised names, Social Security numbers, and account numbers.
“On May 28, 2025, we experienced a cybersecurity incident in which someone encrypted some of the files on our computer network,” says Community Choice’s notice to victims. “On June 1, 2025, we determined that an unauthorized third party acquired some information from our network. This activity occurred on or about May 25, 2025.”
Ransomware gang Play in June 2025 took credit for the attack. It claims to have stolen confidential data, client documents, budget, payroll, accounting, and tax info.
Community Choice Credit Union has not verified Play’s claim. We do not know if the credit union paid a ransom, how much Play demanded, or how attackers breached the bank’s network. Comparitech contacted Community Choice for comment and will update this article if it replies.
The credit union is offering eligible victims one year of free credit monitoring and identity theft protection through Experian.
Who is Play Ransomware?
Play is a ransomware group that has targeted organizations in healthcare finance, manufacturing, real estate, education, and more since June 2022. Its double-extortion model forces targets to pay a ransom both for a decryption key to restore infected systems and to not sell or publicly release stolen data.
Play has taken credit for 155 confirmed ransomware attacks since it began, compromising about 1.4 million records. 12 of those attacks hit businesses in the finance sector, with the attack on CCCU being the first confirmed in 2025.
In May 2025, Maryland financial consultant Lanigan Ryan notified 31,340 people of a data breach claimed by Play in December 2024. And in 2024, RRCA Accounts Management notified 115,837 people following a Play attack claim.
In 2025 to date, Play is one of the most prolific ransomware gangs with the fifth-highest number of attack claims out of all known ransomware groups.
Ransomware attacks on US finance
Comparitech researchers have logged 16 confirmed ransomware attacks on US finance businesses so far this year, compromising 97,036 records.
Other such attacks confirmed this week include:
- CRC Group notified at least 1,900 people of a February 2025 data breach claimed by LeakedData
- Robert H Clarkson Insurance Agency notified at least 722 people of a November 2024 data breach claimed by Medusa, who demanded $120,000 in ransom
- PennantPark Investment Advisers notified 3,655 people of a December 2024 data breach claimed by Akira
Ransomware attacks on financial institutions can both steal data and lock down computer systems. Banks and credit unions must either pay a ransom or face extended downtime, data loss, and putting customers at increased risk of fraud.
About Community Choice Credit Union
Community Choice Credit Union operates two branches in Commerce City and Wheat Ridge, Colorado. According to its website, it handled $59.3 million in assets for 6,167 members as of June 2018.
It should not be confused with another credit union of the same name in Michigan.
