Marquis Software Data Breach
A cybersecurity incident at Marquis Software Solutions last year compromised the personal and financial information of more than 800,000 credit union and bank customers across the United States. The August 2025 ransomware attack on this Texas-based financial technology vendor has created a crisis affecting at least 80 financial institutions that entrusted their customers’ most sensitive data to the company. Contact our data breach lawyers to investigate your claim.
How the Breach Occurred
On August 14, 2025, Marquis Software Solutions—a provider of marketing and compliance software to over 700 banks and credit unions—discovered cybercriminals had infiltrated its network through a SonicWall firewall vulnerability. The attackers executed a ransomware attack, stealing customer data files before encrypting systems.
This third-party vendor breach is particularly dangerous because when Marquis was compromised, customer information from dozens of financial institutions was exposed simultaneously—a growing supply chain threat as companies increasingly rely on outside vendors for sensitive data processing.
What Information Was Stolen?
State attorney general filings reveal the breach exposed comprehensive personal and financial details, including full names, addresses, Social Security numbers, Taxpayer Identification Numbers, dates of birth, phone numbers, and financial account information. This combination provides cybercriminals with everything needed for identity theft, fraudulent account openings, tax fraud, and sophisticated phishing campaigns. The following banks and credit unions have been publicly identified as affected by the breach:
Banks
- Artisans’ Bank
- BayFirst National Bank
- C&N Bank
- Cape Cod Five
- Capital City Bank Group
- Community Bancshares of Mississippi, Inc.
- Fidelity Cooperative Bank
- First Northern Bank of Dixon
- Gateway First Bank
- IBERIABANK
- Jonestown Bank & Trust Co.
- New Peoples Bank
- Newburyport Five Cents Savings Bank
- Norway Savings Bank
- Pentucket Bank
- QNB Bank
- Seneca Savings
- StonehamBank Cooperative
- Thomaston Savings Bank
- Time Bank
- TowneBank
- Ulster Savings Bank
- VeraBank
Credit Unions
- 1st Northern California Credit Union
- Abbott Laboratories Employees Credit Union
- Advantage Federal Credit Union
- Agriculture Federal Credit Union
- Alltrust Credit Union
- Bellwether Community Credit Union
- Blaze Credit Union
- Central Virginia Federal Credit Union
- Clark County Credit Union
- Community 1st Credit Union
- Cornerstone Community Financial Credit Union
- CoVantage Credit Union
- CPM Federal Credit Union
- CSE Federal Credit Union
- CU Hawaii Federal Credit Union
- Discovery Federal Credit Union
- Earthmover Credit Union
- Educators Credit Union
- Energy Capital Credit Union
- First Community Credit Union
- Florida Credit Union
- Fort Community Credit Union
- Founders Federal Credit Union
- Freedom of Maryland Federal Credit Union
- Generations Federal Credit Union
- Gesa Credit Union
- Glendale Federal Credit Union
- Hope Federal Credit Union
- Industrial Federal Credit Union
- Interior Federal Credit Union
- Interra Credit Union
- Kemba Financial Credit Union
- Liberty First Credit Union
- Maine State Credit Union
- Market USA FCU
- MemberSource Credit Union
- Michigan First Credit Union
- MACU
- MIT Federal Credit Union
- New Orleans Firemen’s Federal Credit Union
- NIH Federal Credit Union
- Pasadena Federal Credit Union
- Pathways Financial Credit Union
- Peake Federal Credit Union
- Pelican Credit Union
- PFCU Credit Union
- Security Credit Union
- ServU Credit Union
- Suncoast Credit Union
- Texoma Community Credit Union
- University Credit Union
- Valley Strong Credit Union
- Westerra Credit Union
- Whitefish Credit Union
- Zing Credit Union
The Four-Month Delay
Marquis didn’t notify affected financial institutions until late October—over two months after the August 14 breach. Individual consumers received notification letters in early December, nearly four months post-compromise.
This delay likely violates federal and state data breach laws requiring notification “without unreasonable delay.” The extended timeline prevented victims from taking timely protective action when stolen data is most vulnerable to exploitation, potentially exposing Marquis to regulatory penalties and civil liability.
Nationwide Impact
The breach affected consumers across multiple states: Texas (354,000 individuals), Washington (269,773), Massachusetts (280,375), and significant numbers in South Carolina, Maine, and New Hampshire. Affected institutions include CoVantage Credit Union (160,000 members), Maine State Credit Union (38,334), and Norway Savings Bank (51,000). With Marquis serving over 700 financial institutions, the final victim count continues rising.
Your Legal Rights
If you received a breach notification, you may be entitled to compensation for time and expenses addressing the breach, out-of-pocket losses from identity theft, loss of privacy, diminished value of personal information, emotional distress, and statutory damages.
We are investigating a class action lawsuit against Marquis. Class actions allow affected individuals to combine claims, making it feasible to hold companies accountable. A successful lawsuit could provide monetary compensation while forcing stronger security practices.
Protect Your Rights: Contact The Lyon Firm
If you received a data breach notification from Marquis Software Solutions or your financial institution, you may be entitled to significant compensation. The experienced data breach attorneys at The Lyon Firm are investigating claims on behalf of affected individuals and can help you understand your legal options at no cost.
Time limits apply to data breach claims—contact us today for a free, confidential consultation.