Norway Savings Bank, a mutual banking institution serving over 38,000 households in Maine, suffered a ransomware attack on Marquis Software Solutions, its third-party vendor, on August 14, 2025. An unauthorized external actor breached Marquis’s data environment, exposing sensitive personally identifiable information (PII) of 51,000 U.S. individuals, including 44,259 in Maine alone. Compromised data included names, addresses, dates of birth, Social Security numbers, Tax ID numbers, and financial account details. Marquis paid a ransom to contain the incident, but stolen data later surfaced on criminal marketplaces, indicating a failure to fully mitigate the breach. The incident was reported to Maine’s Attorney General on November 21, 2025, with affected individuals notified via mail. The breach did not directly impact Norway Savings Bank’s internal systems but exposed customer data managed by Marquis, triggering potential identity theft, financial fraud, and legal repercussions. Affected individuals were offered free identity theft protection (IDX) and advised to monitor accounts, place fraud alerts, and seek legal compensation through class-action lawsuits.