Marquis Fintech Suffers Massive Ransomware Breach, Exposing 672,000 Customers’ Data Fintech firm Marquis has notified over 672,000 individuals that their personal and financial data was stolen in a ransomware attack, marking one of the largest fintech breaches of 2026. The compromised information includes Social Security numbers, banking details, and other sensitive records, heightening risks of identity theft and financial fraud for affected customers. The company disclosed the incident in recent regulatory filings but has not clarified when the breach occurred or how long attackers maintained access to its systems. The scale of the exposure equivalent to the population of Washington, D.C. underscores the severity of the attack, particularly given the inclusion of Social Security numbers, which are highly prized by cybercriminals for long-term exploitation. This breach reflects the evolving tactics of ransomware groups, which now routinely exfiltrate data before encrypting systems a dual-extortion strategy that maximizes leverage over victims. The incident adds Marquis to a growing list of high-profile data breach victims in 2026, highlighting persistent vulnerabilities in financial sector cybersecurity.

Massive Ransomware Attack on Fintech Firm Exposes 1.35 Million Bank Customers A ransomware attack on U.S.-based fintech provider Marquis, which serves over 700 banks and credit unions, has compromised the personal and financial data of nearly 1.35 million customers—far exceeding initial estimates of 400,000. The breach, disclosed between October 27 and November 25, exposed sensitive details, including bank account numbers, debit and credit card information, across at least 74 of Marquis’s clients. The incident underscores a critical vulnerability in the financial sector’s supply chain security, particularly the often-overlooked risk posed by "fourth-party" vendors—the suppliers of a bank’s third-party providers. The attack exploited a vulnerability in a SonicWall firewall used by Marquis, highlighting gaps in due diligence. While 95% of bank directors assess third-party security, only 40% extend scrutiny to fourth parties, according to cybersecurity firm Qualys. The fallout is expected to reshape risk management practices. Banks are likely to tighten vendor contracts, demand continuous vulnerability scanning, and face higher cyber insurance premiums—which have already surged 30-50% post-breach. Regulators may also intervene, with U.S. agencies (FDIC/OCC) and UK authorities (FCA/PRA) poised to impose stricter controls, including mandatory monitoring and shared encryption responsibilities. Beyond financial penalties, the breach could lead to brand damage, executive liability, and even judicial consequences for institutions failing to secure their supply chains. The attack aligns with broader trends: a Semperis report reveals that 52% of ransomware incidents occur on weekends or holidays, while attackers increasingly use regulatory complaints and physical threats as extortion tactics. The incident serves as a stark reminder of the escalating sophistication of cybercriminals targeting financial infrastructure.

CIRO Data Breach Exposes Personal Information of 750,000 Individuals The Canadian Investment Regulatory Organization (CIRO) disclosed a data breach on August 18, 2025, revealing that hackers accessed the personal information of approximately 750,000 individuals in an August cyberattack. The breach stemmed from a sophisticated phishing incident, which led to temporary system shutdowns, though CIRO confirmed its critical regulatory functions remained unaffected. According to CIRO, the compromised data includes sensitive details such as annual income, dates of birth, government-issued ID numbers, phone numbers, investment account numbers, social insurance numbers, and account statements information collected during routine regulatory and compliance activities. The organization clarified that passwords, PINs, and security questions were not exposed, as CIRO does not store such data. While CIRO reported no evidence of data misuse or dark web exposure, it continues to monitor for malicious activity. Impacted individuals clients and former clients of CIRO dealer members are being notified and offered two years of free credit monitoring and identity theft protection services. An FAQ page has also been published to provide further details. CIRO, a pan-Canadian self-regulatory body overseeing investment and mutual fund dealers, stated that the incident is contained with no active threat remaining in its environment. The breach follows a series of recent cybersecurity incidents affecting financial and healthcare sectors globally.

Hackers stole the personal and financial information of more than 780,000 individuals after hacking into the network of fintech firm Marquis. The incident was discovered on August 14, but the investigation into the stolen information took until the end of October to complete. Last week, Marquis started sending written notification letters to the affected individuals and filed data breach notices with Attorney General’s Offices in several US states. “Our investigation determined that an unauthorized third party accessed our network and may have accessed and acquired certain files from our systems,” the notification letter filed with the Maine AGO reads. According to Marquis, the hackers stole personal information such as names, addresses, Social Security numbers, dates of birth, and taxpayer identification numbers. Additionally, they compromised financial information, including account numbers and credit/debit card numbers. “At this time, we have no evidence of the misuse, or attempted misuse, of personal information as a result of this incident,” the notification letter reads. Based on filings with Iowa, Maine, Massachusetts, New Hampshire, South Carolina, Texas, and Washington authorities, roughly 788,000 individuals have been affected by the Marquis data breach. Advertisement. Scroll to continue reading. Marquis is providing them with free credit monitoring and identity protection services for one or two years. The company says the hackers gained access to its env

1st MidAmerica Credit Union Customers Hit by Vendor Data Breach Affecting 130,000 A data breach at Marquis, a third-party vendor for 1st MidAmerica Credit Union, has exposed sensitive personal information belonging to over 130,000 customers. The credit union confirmed the incident, though details on the exact timeline, scope of compromised data, and the cause of the breach remain limited. The breach highlights the growing risks of supply chain attacks, where cybercriminals target vendors to gain access to larger organizations’ data. While 1st MidAmerica has not disclosed whether the breach was the result of a cyberattack, human error, or system vulnerability, the incident underscores the need for stricter vendor security oversight in financial services. No further information on potential misuse of the exposed data or remediation efforts has been released. The breach follows a pattern of recent high-profile incidents involving third-party service providers, raising concerns about the security practices of vendors handling sensitive financial information.