More Banks Issue Breach Notifications Over Supplier Breach

More financial services firms are reporting breaches of customer data that trace to a ransomware attack against Marquis Software Solutions.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The Texas company develops marketing and compliance software and counts more than 700 banks and credit unions as customers.

They include Artisans’ Bank, based in Wilmington, Delaware, and VeraBank, based in Henderson, Texas, which last week each notified tens of thousands of customers that their personal data was stolen.

The culprit: a hack attack and data breach on Aug. 14 involving a ransomware group breaching Marquis’ SonicWall firewall (see: Marketing and Compliance Software Vendor to Banks Breached).

Third-party digital forensic investigators hired to probe the incident found the attacker may have accessed files containing data stored by Marquis Software on behalf of “present and former business customers,” pertaining to their own customers, and that “the incident was limited to Marquis’ environment,” the company told regulators.

Exposed information being held on behalf of its business customers included names, addresses, phone numbers, Social Security numbers, financial account information without security or access codes, and dates of birth, it said.

The security incident against Marquis first came to light publicly when the company told Iowa data protection regulators in a Nov. 26 breach notification that it “detected suspicious activity on its network and determined that it was the victim of a ransomware attack,” on Aug. 14.

No ransomware group has listed the software vendor as a victim. It’s unclear if Marquis may have paid a ransom.

Marquis Software hasn’t attributed the attack to a specific ransomware operation. But this past summer, affiliates of the Akira ransomware-as-a-service operation compromised numerous SonicWall SSL VPNs, reported cybersecurity firm Rapid7 in September.

Marquis business customers include Artisans’ Bank, which told regulators last week it’s notifying 32,344 individuals that their personal data was exposed in the attack.

Marquis first notified the bank on Oct. 28 that customer information was exposed, after which investigators reviewed the exposed files to identify affected individuals. “We are notifying you as quickly as possible,” Artisans’ Bank told customers.

Also last week, VeraBank told regulators it’s notifying 37,318 customers that their personal data was exposed. It’s offering customers 24 months of credit monitoring and fraud assistance.

VeraBank told customers in its written breach notification that a review of files stolen in the breach, to identify individuals whose personal details were exposed, only concluded on Dec. 12.

The bank’s resulting notification to affected customers says it shared customer data with Marquis “to analyze what bank products and services may best fit your needs” and only did so “after they had contractually agreed to secure and protect the same.”

Based on breach notifications that have so far come to light due to the Marquis breach, more than 1.4 million individuals’ personal details appear to have been stolen in the attack, reported consumer technology news site Comparitech.