Marquis Software Solutions Data Breach Analysis

Marquis Software Solutions Breach Exposes 672,000 Banking Customers Through Third-Party Vendor Compromise

A data breach at Marquis Software Solutions, a marketing and communications vendor serving financial institutions, has exposed the personal information of over 672,000 individuals whose data was processed on behalf of the company's banking clients. The incident, which began in August 2025 but was only disclosed this week, highlights the persistent vulnerability of financial sector supply chains to targeted cyberattacks.

What Happened

Marquis Software Solutions detected suspicious activity on its network on August 14, 2025. The company's subsequent investigation, conducted with assistance from external cybersecurity experts, confirmed that an unauthorized third party had gained access to the network and potentially copied files containing customer data.

The breach was contained to Marquis's own systems and did not directly compromise its financial institution clients' infrastructure. However, because Marquis processes data on behalf of these institutions for marketing and customer communications purposes, the stolen files contained personal information belonging to hundreds of thousands of banking customers.

Law enforcement was notified promptly, though no details have been released regarding any ongoing criminal investigation or whether the perpetrators have been identified.

Timeline of Events

The extended timeline between initial detection and public notification raises questions about the breach response process:

• August 14, 2025: Marquis identifies suspicious network activity
• August 2025: Investigation launched with cybersecurity experts; law enforcement notified
• December 10, 2025: Affected financial institution client completes review of compromised files
• December 2025 - March 2026: Address validation and notification preparation
• March 17, 2026: Public breach notification filed

The seven-month gap between detection and disclosure appears to stem from the complexity of determining whose data was affected and obtaining current contact information for notification purposes. While this extended timeline is not uncommon for breaches involving third-party processors, it does mean affected individuals went months without knowing their data may have been compromised.

Data Exposed

The notification letter indicates that compromised data varies by individual, with specific Breached Elements to be filled in per recipient. Based on the nature of Marquis's business as a marketing vendor for financial institutions, exposed information likely includes:

• Full names
• Mailing addresses
• Account information used for marketing communications
• Potentially Social Security numbers (given the SSN monitoring offered in remediation)
• Transaction data related to banking relationships

The company's decision to offer comprehensive identity protection services, including SSN monitoring and dark web surveillance, suggests that sensitive identifying information was among the compromised data. The 24-month monitoring period offered exceeds the typical 12-month coverage, indicating Marquis and its clients view the exposure as significant.

Attack Vector Analysis

The notification describes the incident as resulting from an unauthorized third party accessing the network and copying files—a description consistent with a targeted intrusion rather than opportunistic ransomware or automated exploitation.

The "hacking" classification suggests several possible attack methodologies:

Credential Compromise: Attackers may have obtained valid credentials through phishing, credential stuffing, or purchasing stolen credentials on dark web marketplaces. Marketing vendors often have numerous employee accounts with access to customer data.

Exploitation of Vulnerabilities: Unpatched systems or misconfigurations in internet-facing infrastructure could have provided initial access. Marketing and communications vendors frequently operate web applications and APIs that can serve as entry points.

Supply Chain Attack: Given Marquis's position as a vendor to financial institutions, the company itself may have been specifically targeted as a means to access banking customer data without directly attacking the more heavily defended financial institutions.

The fact that attackers were able to access and exfiltrate data without triggering immediate detection suggests either sophisticated operational security by the threat actors or gaps in Marquis's monitoring capabilities.

Impact Analysis

Affected Individuals

The 672,075 affected individuals face potential risks including:

• Identity Theft: Stolen personal information can be used to open fraudulent accounts, file false tax returns, or commit other forms of identity fraud
• Targeted Phishing: With knowledge of banking relationships, attackers can craft convincing phishing campaigns impersonating specific financial institutions
• Account Takeover: If account numbers or other banking details were exposed, customers may face attempts to access their financial accounts

Financial Institution Clients

Marquis's banking clients face their own set of consequences:

• Regulatory Scrutiny: Financial regulators including the OCC, FDIC, and state banking departments have increasingly focused on third-party vendor risk management
• Customer Trust: Banks must now communicate with affected customers about a breach that occurred outside their own systems
• Vendor Review: This incident will likely trigger enhanced due diligence on all marketing and communications vendors

Broader Industry Implications

This breach exemplifies the "aggregation problem" in financial services vendor relationships. A single marketing vendor may process data for dozens of financial institutions, creating a concentrated target that, when compromised, affects customers across multiple banks, credit unions, and other institutions.

Regulatory Considerations

Financial institutions are subject to extensive requirements around vendor risk management:

OCC Guidance (OCC 2013-29): Requires banks to conduct due diligence on third-party relationships and ensure vendors maintain appropriate security controls

FDIC FIL-44-2008: Mandates risk management programs for technology service providers

Interagency Guidance on Third-Party Relationships: Updated in 2023 to strengthen expectations around ongoing monitoring of vendor security postures

NYDFS Cybersecurity Regulation (23 NYCRR 500): Requires covered entities to implement policies governing third-party service provider security, including requiring vendors to meet minimum cybersecurity requirements

Financial institutions whose customers were affected by the Marquis breach will need to document their vendor oversight practices and may face questions from examiners about the adequacy of their third-party risk management programs.

Lessons for the Industry

For Financial Institutions

1. Vendor Data Inventory: Banks must maintain clear visibility into what customer data is shared with each vendor and for what purposes. Many institutions struggle to answer basic questions about data flows to marketing and communications vendors.

2. Contractual Protections: Vendor agreements should specify security requirements, breach notification timelines, and liability provisions. The seven-month notification delay in this case highlights the importance of contractual notification deadlines.

3. Ongoing Monitoring: Initial vendor due diligence is insufficient. Continuous monitoring through security questionnaires, SOC 2 report reviews, and potentially technical assessments should be standard practice.

4. Data Minimization: Providing vendors only the data necessary for their specific function reduces breach impact. Marketing campaigns rarely require Social Security numbers.

For Vendors

1. Detection Capabilities: The ability to detect unauthorized access promptly is essential. Investment in security monitoring, endpoint detection, and network analysis can reduce dwell time.

2. Data Segmentation: Storing client data in segregated environments limits the scope of potential breaches and simplifies impact assessment.

3. Incident Response Planning: Having tested response procedures enables faster containment and notification. The months-long process of identifying affected individuals suggests opportunities for improvement in data mapping and classification.

For the Sector

The Marquis breach reinforces that financial sector cybersecurity extends well beyond the institutions themselves. The interconnected ecosystem of vendors, service providers, and partners creates numerous potential entry points for attackers seeking financial data.

Regulatory focus on third-party risk will likely intensify, with potential for more prescriptive requirements around vendor security assessments and data handling practices. Financial institutions should anticipate increased examiner attention to vendor oversight programs in upcoming supervisory cycles.

Looking Forward

Affected individuals should take advantage of the offered credit monitoring services and remain vigilant for signs of identity misuse. The 24-month monitoring period provides meaningful protection, but customers should consider placing fraud alerts or credit freezes for additional security.

For the financial services industry, this incident serves as another reminder that security investments must encompass the full supply chain. The most robust internal controls provide limited protection when customer data is compromised through a vendor relationship.

Marquis Software Solutions has indicated it is implementing additional security measures to prevent similar incidents. The true test will be whether the company and its financial institution clients can rebuild trust with the hundreds of thousands of customers whose data was exposed through this breach.