Marquis Software Solutions data breach: why your bank or credit union's vendor wrote to you

Why did I get a letter from Marquis Software Solutions?

Marquis says it has your information because one of its customers, a financial institution, gave it data for marketing and communications work. That customer had your information because you bank with it now, banked with it before, or were party to a transaction involving it. Marquis says the incident was limited to its own systems and did not affect the customer's.

Washington's attorney general lists one Marquis notice naming more than 30 institutions, among them Gesa Credit Union, Suncoast Credit Union, TowneBank, Michigan First Credit Union, Cape Cod Five and Valley Strong Credit Union. A separate Washington notice comes from Industrial Credit Union of Whatcom County. The guide to letters from companies you never dealt with explains how vendor breaches reach customers.

What happened at Marquis?

Marquis says it began an investigation with cybersecurity experts and notified law enforcement promptly. The December 2025 letter says Marquis found on October 27, 2025 which people's data was in the copied files. The March 2026 letter says one customer reviewed the affected files itself on December 10, 2025, then confirmed the people involved and found their current addresses.

Date	What the letters and the regulators' records say
August 14, 2025	Suspicious activity found on Marquis's network
October 27, 2025	Marquis identifies whose data was in the copied files
November 26, 2025	Washington notices (269,773 and 24,526 residents); Indiana 2025 report records 34,805 Indiana residents
December 2, 2025	First notice recorded by California; posted by Texas (354,289 Texans)
December 10, 2025	One customer reviews the affected files
February 11, 2026	Second notice recorded by California
March 16, 2026	Third notice recorded by California; Old National Bank's notice to Indiana (672,075 total)
March 17, 2026	Logged in Massachusetts (376 residents)

What information was involved?

Each letter fills in the reader's own items. The state records give the categories:

Regulator	Information it records
Washington attorney general	Name; Social Security number; financial and banking information; full date of birth
Texas attorney general	Name; address; Social Security number; financial information; date of birth
Massachusetts consumer affairs office	Social Security numbers and driver's licenses marked as breached; financial accounts, medical records and payment cards not

Marquis says it has no evidence that anyone's information has been misused.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Old National Bank notice, total affected	672,075
Texas attorney general	Texans	354,289
Indiana attorney general	Old National Bank notice, Indiana residents	296,283
Washington attorney general	Washingtonians (multi-institution notice)	269,773
Indiana attorney general	1st MidAmerica Credit Union notice, total affected	131,070
Indiana attorney general	2025 Marquis notice, Indiana residents (no total given)	34,805
Washington attorney general	Washingtonians (Industrial Credit Union of Whatcom County)	24,526
Massachusetts consumer affairs office	Massachusetts residents	376

Old National Bank's notice counts 296,283 Indiana residents, the second largest of the 1,361 notices sent in 2026 in Indiana's report (Indiana ranking).

No record gives a total for the whole incident. Old National's 672,075 is the 18th largest notice in Indiana's 2026 report, and it covers only one client.

The second largest client total is 1st MidAmerica Credit Union's 131,070, filed with Indiana on January 22, 2026 with the same August 14, 2025 breach date; Vermont's attorney general posted that letter under the credit union's name.

What is Marquis offering?

A complimentary membership in Epiq Privacy Solutions ID, for the number of months printed on each letter.

Item	Detail from the March 2026 letter
Provider	Epiq, Privacy Solutions ID
Enrollment	www.privacysolutionsid.com, with the code on the letter
Marquis response line	844-425-3645, 9:00 a.m. to 9:00 p.m. Eastern Time, Monday to Friday
Epiq help	866.675.2006, Monday to Friday, 9:00 a.m. to 5:30 p.m. ET

The guide to bank, brokerage and mortgage breach notices compares letters from other financial firms and their vendors.

What the documents leave open

• How the third party got into Marquis's network.
• The full list of client institutions, and the total number of people.
• Why some clients' customers got letters months after others.