Two More U.S. Banks Confirm Customer Data Exposure Linked to Marquis Software Ransomware Attack

Threat Summary

Category: Financial Infrastructure Cyberattack
Features: Third-party vendor compromise, downstream bank exposure, sensitive personal data leakage, delayed victim notification
Delivery Method: Firewall vulnerability exploitation followed by ransomware deployment
Threat Actor: Unknown ransomware group (no public attribution)

The scope of the Marquis Software ransomware incident continues to expand as additional U.S. financial institutions confirm that customer data was exposed through the compromised vendor environment. Two banks — one based in Texas and another in Delaware — have now formally notified regulators and affected individuals that sensitive personal information was accessed during the August cyberattack on Marquis Software, a widely used provider of financial analytics, compliance, and customer communication services.

The disclosures reinforce a growing pattern seen across the financial sector: institutions themselves remain technically uncompromised, yet customer data is nonetheless exposed through trusted third-party platforms embedded deep within banking operations.

Core Narrative

The ransomware attack against Marquis Software occurred in mid-August, with the company later confirming that attackers gained unauthorized access through a vulnerability affecting a perimeter firewall device. The intrusion allowed threat actors to access systems used to store and process customer information on behalf of hundreds of banks and credit unions across the United States.

Artisans’ Bank disclosed that it was notified of the incident in October and subsequently determined that the names and Social Security numbers of more than 32,000 individuals were exposed as a result of the vendor breach. VeraBank issued similar notifications, informing customers that Marquis Software functioned as its customer communication and data analysis provider, with access to personal data used to support banking product recommendations and outreach.

Across both institutions, more than 37,000 individuals were confirmed affected in these two disclosures alone. The exact categories of data accessed vary by institution, though previous notifications tied to the same incident indicate exposure of names, addresses, phone numbers, dates of birth, Social Security numbers, taxpayer identification numbers, and certain financial account information lacking authentication credentials.

Both banks emphasized that their internal systems were not breached, framing the exposure as isolated to data maintained within Marquis Software’s environment. This distinction, while technically accurate, does little to mitigate customer impact, as the compromised data remains sufficient for identity theft, fraud, and long-term financial exploitation.

Marquis Software acknowledged the breach publicly and stated that federal law enforcement was notified after the attack was discovered. The company also undertook responsibility for issuing breach notifications on behalf of numerous affected financial institutions, filing disclosures across multiple state regulatory systems over a period spanning late October through late November.

Infrastructure at Risk

The incident highlights structural exposure within financial infrastructure created by centralized service vendors. Marquis Software provides analytics, compliance tooling, and digital marketing capabilities to hundreds of banks and credit unions. A single compromise at the vendor layer resulted in cascading exposure across a broad segment of the U.S. banking ecosystem.

Firewall-level vulnerabilities remain a critical failure point. Once perimeter defenses were bypassed, attackers gained access to aggregated datasets representing multiple institutions, magnifying the blast radius far beyond what a single bank breach would typically produce.

Policy / Allied Pressure

Regulatory scrutiny has intensified as more downstream victims are identified. State regulators continue to receive delayed breach notifications as institutions complete internal assessments. The fragmented disclosure timeline complicates coordinated response efforts and raises questions about the adequacy of vendor oversight requirements imposed on financial institutions.

In parallel, legal exposure is mounting. Class-action litigation remains a likely outcome given the scale of potential victimization and the sensitivity of the exposed data. The absence of timely, consolidated victim counts further fuels concern among regulators and consumer advocates.

Vendor Defense / Reliance

Marquis Software stated that the intrusion originated from exploitation of a firewall vulnerability, underscoring the risks of perimeter-centric security models in environments handling sensitive financial data. Despite layered contractual assurances, banks ultimately relied on the vendor’s internal security posture, incident detection capabilities, and disclosure timelines.

Reports tied to breach notifications suggest that ransom negotiations may have occurred, though no ransomware group publicly claimed responsibility and no confirmation of payment has been issued by the company. The lack of attribution complicates threat intelligence efforts and limits broader sector awareness of attacker tactics and objectives.

Forecast — 30 Days

• Additional banks and credit unions are likely to issue delayed breach notifications as forensic reviews conclude
• Total victim counts may rise significantly as overlapping customer populations are reconciled
• Regulatory inquiries into third-party risk management practices are expected to escalate
• Financial institutions may accelerate vendor audits and firewall replacement programs
• Litigation pressure on both the vendor and affected banks is likely to intensify

TRJ Verdict

The Marquis Software ransomware incident is not a story about two banks. It is a case study in systemic third-party risk embedded across modern financial infrastructure. When a single vendor aggregates sensitive customer data at scale, a single firewall failure becomes a nationwide exposure event.

Claims that bank systems were not breached offer little reassurance to customers whose personal information now exists outside their control. The reality is that trust boundaries in the financial sector no longer align with technical boundaries. Until vendor security accountability carries the same weight as internal controls, incidents like this will continue to propagate silently through institutions that believe themselves insulated.

This was not a breach of one company. It was a breach of dependency.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE