Anderson Brothers Bank Customers Exposed in Third-Party Vendor Breach at Marquis Software Solutions

A data breach at Marquis Software Solutions has compromised the personal and financial information of 3,272 customers of Anderson Bancshares, Inc., the parent company of Anderson Brothers Bank. The incident, which began at least as early as August 2025, highlights the persistent and growing threat that third-party vendors pose to financial institutions and their customers.

Breach Summary

Anderson Brothers Bank, a community bank headquartered in Mullins, South Carolina, disclosed on December 5, 2025 that an unauthorized third party had gained access to customer data maintained by Marquis Software Solutions, a vendor providing services to the bank. The breach did not involve direct access to Anderson Brothers Bank's own systems, but rather exploited vulnerabilities in the vendor's infrastructure.

The compromised information includes highly sensitive data: names, dates of birth, Social Security numbers, and financial account information. This combination of personally identifiable information (PII) and financial data creates significant identity theft and fraud risks for affected individuals.

Timeline of Events

The breach unfolded over several months before affected customers were notified:

• August 14, 2025 (or earlier): An unauthorized third party gains access to personal information on Marquis Software Solutions systems. The actual initial compromise may have occurred before this date.

• October 28, 2025: Marquis completes its investigation and notifies Anderson Brothers Bank that customer information may have been impacted.

• December 5, 2025: Anderson Brothers Bank provides written notice to affected individuals and files notification with the Maine Attorney General's office.

The gap between the initial compromise in mid-August and customer notification in early December represents approximately 113 days—a timeline that, while not unusual for complex third-party breaches requiring forensic investigation, nonetheless leaves affected individuals vulnerable to identity theft during this window.

Data Exposure Analysis

The breach exposed a particularly dangerous combination of personal and financial information:

• Names: Basic identifier enabling targeted phishing and social engineering
• Dates of Birth: Key verification element used by financial institutions and government agencies
• Social Security Numbers: The most valuable single piece of PII for identity thieves
• Financial Account Information: Direct access vector for fraudulent transactions

This data package represents a near-complete identity theft toolkit. Criminals can use these elements to open new credit accounts, file fraudulent tax returns, access existing financial accounts, or sell complete identity profiles on dark web marketplaces. The inclusion of both SSNs and financial account information is particularly concerning, as it enables both new account fraud and existing account takeover.

Attack Vector: The Third-Party Risk Problem

The breach occurred entirely within Marquis Software Solutions' environment, not Anderson Brothers Bank's own systems. This distinction is critical for understanding both the nature of the attack and the broader implications for the financial services industry.

Third-party vendors have become an increasingly attractive target for threat actors. Rather than attacking a single financial institution, compromising a vendor that serves multiple banks provides access to customer data from numerous organizations through a single intrusion. Marquis, as a software solutions provider to financial institutions, likely maintains access to sensitive customer data as part of its service delivery.

The notification letter indicates that Marquis "initiated its critical incident response process" and "engaged external cybersecurity specialists" upon discovering the breach. However, the specific technical details of how the unauthorized access was achieved—whether through phishing, vulnerability exploitation, credential compromise, or other means—have not been publicly disclosed.

Impact on Affected Customers

Anderson Brothers Bank is offering affected individuals one year of complimentary credit monitoring through Epiq, accessible via a dedicated portal at privacysolutionsid.com. While credit monitoring provides some protection, security experts generally recommend that individuals whose SSNs have been compromised consider more robust protective measures.

Affected customers should consider:

• Credit Freezes: Placing security freezes with all three major credit bureaus (Equifax, Experian, and TransUnion) prevents new accounts from being opened without explicit authorization
• Fraud Alerts: One-year fraud alerts require creditors to verify identity before extending credit
• IRS Identity Protection PIN: Given that SSNs were exposed, enrolling in the IRS IP PIN program can prevent tax-related identity theft
• Account Monitoring: Regular review of bank statements and credit reports for unauthorized activity

The bank's notification encourages vigilance for 12 to 24 months, though identity theft risks from SSN exposure can persist indefinitely.

Regulatory and Compliance Implications

Anderson Brothers Bank's notification to the Maine Attorney General represents one component of an increasingly complex regulatory landscape for data breach disclosure. The bank indicated it is "providing written notice of this incident to relevant state regulators, as necessary," acknowledging the patchwork of state notification requirements.

For banks and their vendors, this incident reinforces several regulatory considerations:

Federal Banking Regulators: The OCC, FDIC, and Federal Reserve have intensified their focus on third-party risk management. Guidance such as the interagency guidance on third-party relationships (finalized in 2023) establishes clear expectations for due diligence, ongoing monitoring, and contractual provisions with vendors.

State Privacy Laws: Beyond notification requirements, states increasingly impose substantive data security obligations. Banks must ensure their vendor contracts address compliance with these requirements.

SEC Cybersecurity Disclosure Rules: For public company banks, the SEC's 2023 cybersecurity disclosure rules create additional reporting obligations for material incidents, including those originating at third parties.

The incident also raises questions about Marquis Software Solutions' own compliance posture and the contractual provisions governing data security between the vendor and its financial institution clients.

Lessons for the Financial Services Industry

This breach offers several takeaways for banks, credit unions, and other financial institutions:

1. Vendor Due Diligence Must Be Continuous: Initial security assessments of vendors are necessary but insufficient. Financial institutions should implement ongoing monitoring of vendor security posture, including regular security assessments, SOC 2 report reviews, and contractual rights to audit.

2. Data Minimization Matters: The breach affected customer data maintained by the vendor. Financial institutions should critically evaluate what data vendors actually need to perform their services and limit data sharing accordingly.

3. Incident Response Coordination: The 75-day gap between Marquis learning of the breach and notifying Anderson highlights the importance of clear contractual provisions requiring prompt notification of security incidents. Many regulators expect notification within 24-72 hours.

4. Fourth-Party Risk Is Real: Vendors often rely on their own subcontractors and service providers. Financial institutions should understand their vendors' supply chains and assess risks accordingly.

5. Insurance and Contractual Protections: Cyber insurance policies and vendor contracts should address third-party breach scenarios, including coverage for notification costs, credit monitoring, and potential regulatory penalties.

Looking Forward

The Marquis Software Solutions breach affecting Anderson Brothers Bank is not an isolated incident. Third-party compromises have become one of the most significant vectors for data breaches in financial services, as threat actors recognize the efficiency of attacking shared infrastructure rather than individual institutions.

For community banks like Anderson Brothers Bank, which often lack the resources of larger institutions, managing third-party risk presents particular challenges. These institutions must balance the operational benefits of outsourcing technology functions against the security risks inherent in extending their data perimeter to vendor environments.

As regulatory scrutiny of third-party relationships intensifies and attackers continue to target the financial services supply chain, institutions of all sizes must treat vendor security management as a core competency rather than a compliance checkbox. The 3,272 individuals whose personal and financial information was exposed in this breach are a reminder that the consequences of third-party security failures are borne not by the vendors themselves, but by the customers who trusted their financial institutions with their most sensitive information.