Fintech company Marquis notifies numerous US banks and credit unions about a data breach following a ransomware incident

Marquis Data Breach Impacts Hundreds of Thousands of Banking Customers

Marquis, a financial technology firm, has begun alerting numerous banks and credit unions across the United States after a cyberattack earlier this year resulted in the theft of sensitive customer information.

The incident came to light this week as Marquis submitted data breach notifications to several U.S. states, confirming that the August 14 security event was a ransomware attack.

Based in Texas, Marquis specializes in marketing and compliance solutions for financial institutions, enabling them to aggregate and analyze customer data. The company serves over 700 banks and credit unions nationwide, giving it access to substantial amounts of personal and financial information from banking customers throughout the country.

According to official disclosures reviewed by TechCrunch and filed in Iowa, Maine, Texas, Massachusetts, and New Hampshire, at least 400,000 individuals have been confirmed as victims of the breach so far.

Texas residents have been hit the hardest, with at least 354,000 people in the state affected by the data theft.

In a notice to Maine’s attorney general, Marquis revealed that most of the notifications in Maine were related to customers of Maine State Credit Union, representing about one in nine of those impacted in the state.

The total number of affected individuals is expected to increase as additional states report their own breach notifications.

Marquis disclosed that the attackers accessed names, birth dates, mailing addresses, and financial details such as bank account, debit, and credit card numbers. Social Security numbers were also among the compromised data.

The company’s latest statements attribute the ransomware attack to cybercriminals who exploited a previously unknown vulnerability—known as a zero-day—in Marquis’s SonicWall firewall. This flaw had not been identified by SonicWall or its users before being targeted by the hackers.

While Marquis has not officially named the group responsible, reports suggest the Akira ransomware gang was behind a series of attacks on SonicWall users during that period.

TechCrunch reached out to Marquis for clarification on the total number of affected customers, whether the company received any demands from the attackers, or if a ransom was paid, but did not receive a response before publication.

Sponsored: Experience AWS re:Invent 2025 Live

Discover the latest advancements in AI, cloud technology, security, and more from Amazon Web Services’ premier event in Las Vegas. This video is presented in collaboration with AWS.