Marquis Data Breach: One Bank Vendor, 672,075 People, At Least 80 Institutions
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
You most likely never did business with Marquis Software Solutions. It is a Plano, Texas company that does marketing and compliance work for banks and credit unions, and your records reached it through one of them. A ransomware attack on August 14, 2025 took files with names, Social Security numbers and account information; in a March 2026 filing with Maine's attorney general, Marquis put the total at 672,075 people. The lawsuits sit in one federal court in Texas. As of September 30, 2026, there is no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened, and What the Lawsuits Claim
Marquis describes itself as “a digital and physical marketing and communications vendor for financial institutions.” To do that work it held customer files that banks and credit unions sent it. According to its notice letters, Marquis spotted suspicious activity on its network on August 14, 2025, found that an unauthorized third party had accessed the network and may have copied files, and on October 27, 2025 determined whose personal data was in them. The banks' and credit unions' own systems, the letters say, were not affected.
The lawsuits add how the attackers got in: through Marquis's SonicWall firewall, using configuration files and login credentials — including one-time MFA “scratch codes” — that the plaintiffs say were taken from SonicWall's cloud backup service, which they allege was exposed from at least February 2025 through September 2025. The consolidated complaint pleads negligence, negligent selection of a vendor, unjust enrichment, a California Consumer Privacy Act claim and a declaratory judgment. These are allegations, and no court has ruled on them. Marquis itself blames SonicWall: in its own lawsuit, it says SonicWall's cloud breach had been ongoing since February 2025.
Case Details
The case is In re Marquis Software Solutions, Inc. Data Breach Litigation, No. 4:25-cv-01277, in the U.S. District Court for the Eastern District of Texas (Sherman Division), before Chief District Judge Amos L. Mazzant. The first suit was filed there on November 21, 2025; Marquis is based in Plano. On January 22, 2026 the court consolidated the early cases — several of which also named Norway Savings Bank, CoVantage Credit Union, Suncoast Credit Union, Gesa Credit Union or Maine State Credit Union — and appointed interim class counsel. Later orders folded in more related suits; Yunk v. CoVantage Credit Union, No. 4:26-cv-00108, is now docketed in the lead case. By Marquis's own count it faces more than three dozen consumer class actions, 33 of them consolidated by February 2026. The First Consolidated Class Action Complaint of March 23, 2026 names only two defendants: Marquis and SonicWall. The court combined the suits itself under Federal Rule of Civil Procedure 42(a); we found no multidistrict litigation (MDL).
Status: SonicWall's Motion to Dismiss Pending, No Settlement
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Is My Bank or Credit Union on the List?
The proposed class is everyone in the U.S. whose information was affected, “including all individuals who received a Notice Letter from Marquis or a Client of Marquis.” As of September 30, 2026 we found no class certification, and there is nothing to sign up for. The lists below come from official filings or, where noted, a news compilation of them; none is complete — American Banker counted at least 80 institutions by January 5, 2026.
Named in Marquis's filing with the Washington attorney general (November 26, 2025, supplemented February 11, 2026): 1st Northern California Credit Union, Advantage Federal Credit Union, BayFirst National Bank, Bellwether Community Credit Union, BluPeak Credit Union, Cape Cod Five, Community 1st Credit Union, Discovery Federal Credit Union, Energy Capital Credit Union, Founders Federal Credit Union, Gateway First Bank, Generations Federal Credit Union, Gesa Credit Union, Glendale Federal Credit Union, Interior Federal, iQ Credit Union, Jonestown Bank & Trust Co., Kemba Financial Credit Union, MemberSource Credit Union, Michigan First Credit Union, Nymeo FCU, Pasadena Federal Credit Union, Seneca Savings, Southwest Financial Federal Credit Union, Suncoast Credit Union, Sun East Credit Union, Texoma Community Credit Union, Time Bank, TowneBank, True North FCU, University Credit Union, Valley Strong Credit Union, Westerra Credit Union and Whitefish Credit Union. Washington's list shows a separate notice from Industrial Credit Union of Whatcom County, marked “Go Marquis.”
Named in the court case (as co-defendants in early suits or as a plaintiff's own institution): Norway Savings Bank, CoVantage Credit Union, Maine State Credit Union, Capital City Bank and First National Bank of Pennsylvania.
Also in filings in Maine, Iowa and Texas, as compiled by BleepingComputer on December 3, 2025: Abbott Laboratories Employees Credit Union, Agriculture Federal Credit Union, Alltrust Credit Union, C&N Bank, Central Virginia Federal Credit Union, Clark County Credit Union, Community Bancshares of Mississippi, Cornerstone Community Financial Credit Union, CPM Federal Credit Union, CSE Federal Credit Union, CU Hawaii Federal Credit Union, Earthmover Credit Union, Educators Credit Union, Fidelity Cooperative Bank, First Community Credit Union, First Northern Bank of Dixon, Florida Credit Union, Fort Community Credit Union, Freedom of Maryland Federal Credit Union, Hope Federal Credit Union, IBERIABANK (now First Horizon Bank), Industrial Federal Credit Union, Interra Credit Union, Liberty First Credit Union, Market USA FCU, MIT Federal Credit Union, New Orleans Firemen's Federal Credit Union, New Peoples Bank, Newburyport Five Cents Savings Bank, NIH Federal Credit Union, Pathways Financial Credit Union, Peake Federal Credit Union, Pelican Credit Union, Pentucket Bank, PFCU Credit Union, QNB Bank, Security Credit Union, ServU Credit Union, StonehamBank Cooperative, Thomaston Savings Bank, Ulster Savings Bank and Zing Credit Union.
Not on any list? That proves nothing either way. Marquis told Washington it could not match some people to a customer and notified them on behalf of an “Unidentified Entity,” and its later letters say you can be included because you did a transaction with someone who banks with a Marquis client. Your letter is the proof — keep it and the envelope.
Is There Money for Marquis Breach Victims?
What does exist is free credit monitoring. Marquis's letters offer a 12- or 24-month membership in Epiq Privacy Solutions ID, with one-bureau credit monitoring and alerts; the activation code and the enrollment deadline are printed on each letter. Some institutions wrote with their own offer — Industrial Credit Union, for example, promised a free one-year subscription.
Marquis's separate lawsuit against SonicWall is about Marquis's own losses. Consumers are not parties to it and are paid nothing from it.
Marquis Breach Timeline
- 1
August 14, 2025 — The Attack
Marquis identifies suspicious activity on its network. An unauthorized third party had gotten in and may have copied files; the lawsuits say the way in was Marquis's SonicWall firewall.
- 2
October 27, 2025 — Personal Data Found in the Files
Marquis determines which personal data was in the copied files. Per the consolidated complaint, it told its affected bank and credit union clients between about October 27 and November 25.
- 3
November 2025 — First Lawsuit, First Letters
The first class action is filed in Texas on November 21. On November 26, Marquis starts mailing notices on behalf of the institutions that accepted its offer to notify for them; mailings run in several rounds into 2026.
- 4
January 22, 2026 — Cases Combined
Chief Judge Amos L. Mazzant consolidates the early suits into In re Marquis Software Solutions, Inc. Data Breach Litigation and appoints interim class counsel.
- 5
February–March 2026 — SonicWall Is Sued Twice
On February 23, Marquis sues SonicWall over its own losses. On March 23, the consumers' consolidated complaint adds SonicWall as a second defendant.
- 6
Now — Pretrial, No Settlement
The April 30 mediation ended in impasse. As of September 30, 2026, we found no ruling on SonicWall's July 6 motion to dismiss, and no settlement, fund or claim form.
Three Things to Watch For
Stolen Social Security and account numbers, a lot of press, and no claim form — that is the gap imposters fill:
“Claim your Marquis settlement” pages
There is no settlement, so there is no claims site, administrator or deadline. A page asking for your Social Security or account number to “secure your payment” is collecting data, not filing anything.
Fake credit-monitoring activation
The genuine offer is Epiq Privacy Solutions ID: you enroll yourself at privacysolutionsid.com with the code printed in your letter, and the confirmation comes from noreply@privacysolutions.com. The letters call it completely free — nobody needs to phone you to “activate” it or charge a fee.
Calls “from your bank's fraud team”
Depending on your letter, the stolen files held your name, date of birth, Social Security number and account number — enough for a caller to sound like your bank. The filings say no security or access codes were taken, so anyone asking for your PIN or online-banking password is not your bank. Hang up and call the number on your card or statement.
Marquis Data Breach — Questions People Actually Ask
Why did I get a letter from Marquis Software, a company I've never heard of?
Because your bank or credit union sent it your data. Marquis's own letter explains: “We have your information because it was included in data that one of our customers provided to us.” That can mean you bank there now, banked there before, or “participated in a financial transaction with another party” that did business with the institution. Marquis offered to mail the notices for its clients, so many letters carry Marquis's name rather than your bank's.
How many people were affected by the Marquis data breach?
The count moved. On December 3, 2025, BleepingComputer tallied over 400,000 customers of 74 institutions from filings in Maine, Iowa and Texas. On January 5, 2026, American Banker counted at least 823,548 customers of at least 80 banks and credit unions from attorney-general and institution disclosures. In March 2026, Marquis's own filing with Maine's attorney general listed 672,075 people. SecurityWeek suggested bank-by-bank tallies may count people with accounts at several institutions more than once; an outside estimate of up to 1.6 million (Comparitech, February 2026, per SecurityWeek) sits well above Marquis's own figure.
What information was stolen?
It varies by person. The Maine filing lists names, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, financial account information without security or access codes, and dates of birth; TechCrunch also reported bank account, debit and credit card numbers. Your letter names the exact fields in your record.
Is there a Marquis settlement or a claim form?
No. As of September 30, 2026, we found no settlement, fund, administrator, claim form or deadline. If that changes, class members are notified directly. Cases where a claim form really is open are on our open settlements list.
Can I join the Marquis lawsuit?
There is nothing to join. The proposed class already includes everyone who received a notice letter; if a class is certified or a settlement is reached, a court-approved administrator contacts class members. Law-firm “investigation” ads are advertising. Hiring your own lawyer is a real choice with its own terms — read what you sign.
Why is SonicWall involved, and does Marquis's suit against it help me?
Marquis sued SonicWall on February 23, 2026 (Marquis Software Solutions, Inc. v. SonicWall Inc., No. 4:26-cv-00195, E.D. Tex.) for negligence, gross negligence, unjust enrichment, negligent misrepresentation, contribution and indemnity, alleging a SonicWall cloud breach exposed its firewall credentials. SonicWall asked to move that case to California; the court refused on September 28, 2026. That suit is about Marquis's own losses and pays consumers nothing. Consumers have separately sued SonicWall in the consolidated case; as of September 30, 2026, we found no ruling on its motion to dismiss there.
Why did the letters take months — and why did mine come so late?
Marquis spotted the attack August 14, 2025 and identified the personal data October 27. It then gave clients until November 13 to let it notify for them and began mailing November 26; clients that decided late “necessitated multiple rounds of notifications.” As of February 9, 2026, customers of two institutions were still waiting, and a later letter filed in California in March 2026 says that client reviewed the files on December 10, 2025. The plaintiffs plead the delay as a harm of its own.
What is worth doing right now?
Enroll in the Epiq monitoring before the deadline printed on your letter. Freeze your credit at Equifax, Experian and TransUnion — free and reversible. If your letter lists your account number, ask your bank whether to change it, and watch statements closely. Because Social Security and taxpayer numbers were involved, an IRS Identity Protection PIN is worth getting. Keep the letter.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Data Breach Settlement Calculator
What breach settlements have paid, by type of data exposed
Xsolis Data Breach Lawsuit
Another vendor breach: a letter from a company you never used
Conduent Data Breach Settlement
Vendor breach with a deal reached but no claim form yet
Settlements With Claims Open
Cases where a claim form is actually open right now