Marquis notifies affected business after ransomware breach

Marquis has notified affected banks and credit unions, with reports indicating that at least 74 institutions are involved

Fintech firm Marquis is notifying U.S. banks and credit unions after an August ransomware attack allowed hackers to access files containing customer data, according to a company filing on Tuesday.

The Texas-based digital and physical marketing vendor detected suspicious activity on its network and later confirmed it had been hit by ransomware, the company said in a filing with Maine’s attorney general. The filing confirms the timeline and method of the attack.

An investigation found an intruder exploited Marquis’ SonicWall firewall on August 14 and possibly acquired certain files from its systems, the filing shows.

Marquis, founded in 1987, provides essential tools for customer relationship management, regulatory compliance, and digital marketing to over 800 financial institutions nationwide. Its services are integral to how banks analyse customer data and ensure adherence to federal regulations.

The breach was detected on August 14, when suspicious activity triggered alarms within the company’s network. An investigation revealed that intruders had gained access through a zero-day vulnerability in the SonicWall system, allowing them to exfiltrate files before deploying ransomware to encrypt portions of the network.

The fallout has been swift and far-reaching. Marquis has notified affected banks and credit unions, with reports indicating that at least 74 institutions are involved.

Marquis said it is issuing notices on behalf of current and former business customers whose data it maintained. The review of accessed files found they contained personal information received from certain business customers.

Data potentially exposed include names, addresses, phone numbers, dates of birth, Social Security numbers, taxpayer identification numbers and some financial account information.

Marquis said it has not found evidence of misuse of the data, according to the disclosures.