402,760 People. Nine Banks and Credit Unions. Mercadien Told Indiana in February and Fairwinds in August.

2:05 AM Central

At 2:05 AM Central on Monday, October 12, row 389 of the Indiana Attorney General's 2026 breach log read: Fairwinds Credit Union. Notice sent 9/23/2026. Breach occurred 9/7/2025. Indiana residents 223. Total affected 165,054.

Fairwinds is a credit union in Orlando. Its members did not get breached by Fairwinds. They got breached by Fairwinds' auditor, a New Jersey accounting firm called Mercadien, P.C., CPAs, which Fairwinds had hired, in its own words, "to perform an independent assessment as part of routine quality control and regulatory requirements for credit unions." Fairwinds handed over the member data the assessment needed. That data was sitting on Mercadien's side when an unauthorized party came through in the fall of 2025.

Fairwinds found out on August 13, 2026. That is 279 days after Mercadien discovered the intrusion.

Ten weeks earlier, on June 5, a small bank on the Jersey Shore had already learned what it is like to be on the receiving end of this kind of clock. 1st Bank of Sea Isle City posted a notice on its website under the heading "Social Media Ads Targeting 1st Bank Customers." It read: "You may have seen a targeted ad on social media claiming that 1st Bank of Sea Isle City experienced a data breach." The bank explained that its own systems were fine, that the breach was at a vendor, and that the vendor "provided advisory services for 1st Bank of Sea Isle City in early 2024."

Read that sequence again. The bank's customers were seeing social media ads about the breach, most likely placed by plaintiffs' firms, before the bank had said anything, and the data at issue came from an engagement that had ended more than a year before the intrusion.

American Banker's Carter Pape reported on October 8 that the Mercadien breach reached at least nine banks and credit unions. His piece is the best account of the incident published so far, and this one builds on it. What follows adds the documents his story did not have room for, a client count it did not have, and a thread through the regulatory record that explains why nobody's clock started on time.

The breach is not the story. The clock is.

The intrusion itself was ordinary. Somebody got into a file-sharing environment at a regional accounting firm and took files for about three weeks. The firm noticed a month later, reset credentials, replaced its firewalls, and hired forensic experts. That paragraph describes thousands of incidents a year.

The story is what happened after November 7, 2025, and what it reveals about how the U.S. banking system treats the firms that audit it.

Mercadien is not a payments processor or a core provider. It is the kind of firm a community bank or credit union hires to test whether its controls work: internal audit, information technology audit, BSA/AML program review, enterprise risk management. To do that work, the auditor needs samples of the institution's customer files, so the institution sends them. Federal banking guidelines have required banks to oversee exactly this kind of arrangement since 2001, and to make sure customer data is disposed of properly since 2004. Federal guidance since 2005 has said a bank's contract should require its service provider to report unauthorized access "as soon as possible." None of that sets a number of hours, and none of the binding notification clocks written since reaches a firm like this one. In practice, the bank-side clocks start when the vendor decides to call.

So the timeline of the Mercadien breach is not a timeline of the attacker. It is a timeline of a vendor deciding, institution by institution, when to tell each client, and of each client then running its own clock from whatever date it was told. The result, reconstructed below from nine institutions' letters, filings and web notices, is a breach in which the first individuals were notified in December 2025 and the last institution we can identify determined on August 28, 2026 that its files contained personal information.

What we verified, and a number the first report did not have

Every check below was passive and public: state attorney general records, SEC filings, public DNS, registry data, and notices published by the institutions themselves. We did not contact Mercadien's systems beyond an ordinary page request to its public website, and we did not touch any remote-access host. Times are Central on Monday, October 12, 2026.

• 2:00 AM. SEC EDGAR full-text search for "Mercadien" from June 2025 forward returns three filings: an 8-K from SR Bancorp, Inc. (July 10, 2026), and quarterly reports from Orrstown Financial Services and UWM Holdings (August 2026). No other public company has named Mercadien in an SEC filing since June 2025.
• 2:02 AM. The California Attorney General's records for Fairwinds Credit Union and Suffolk Federal Credit Union show different breach windows for the same incident. Suffolk's record lists September 17 and October 9, 2025. Fairwinds' record lists September 7 and November 7, 2025. Fairwinds' letter on file uses the same September 7 to November 7 window.
• 2:02 AM. The ransomware.live index returns no victim posting for Mercadien. No group has publicly claimed the intrusion.
• 2:05 AM. The Indiana Attorney General's year-to-date breach log lists Mercadien at 402,760 total affected, notice sent February 17, 2026. It also lists Fairwinds at 165,054, Orrstown Bank at 83,938 and Bangkok Bank's New York branch at 460, all with the same 2025 breach date. American Banker reported Mercadien's February figure as 402,741 and said Orrstown was the only client that had disclosed a total. The log as of this morning carries a slightly higher Mercadien figure and a Fairwinds total, 165,054, roughly twice Orrstown's. That Fairwinds number has not appeared in press coverage we could find. We cannot tell from the log whether the client totals sit inside Mercadien's 402,760 or on top of it. Nobody has said.
• 2:11 AM. mercadien.com resolves to WP Engine hosting behind Cloudflare. Mail is Microsoft 365. Its published SPF record authorizes, among others, the entire 167.68.0.0/16 network, which ARIN registers to Thomson Reuters (Legal) Inc. That is 65,536 addresses permitted to send mail as the auditor's domain. The record ends in a softfail (~all). DMARC is set to quarantine. More on why that matters below.
• 2:13 AM. The Maine Attorney General's entry for Mercadien, filed by outside counsel, lists the breach as "External system breach (hacking)", the total affected as "TBD", consumer notification on December 1, 2025, and identity theft protection offered: "No."
• 2:13 AM. A second Maine entry shows that The Mercadien Group, LLC, at the same Hamilton, New Jersey street address and represented by the same outside law firm, reported its own "External system breach (hacking)" in June 2025. That intrusion began November 26, 2024, was discovered April 29, 2025, and affected 327 people. It has not been reported in connection with the 2025 incident.
• 2:16 AM. The hostnames vpn.mercadien.com and remote.mercadien.com resolve to two addresses whose ARIN registrations name the customer as Mercadien Group. We did not connect to either. The public record is consistent with the accounting firm and the group sharing network infrastructure, which matters when two entities under one roof report intrusions that began about ten months apart.

What we could not verify: the text of Mercadien's own notice letters to New Hampshire and Massachusetts, which were not retrievable this morning; the reported October 6 court order and December 4 mediation date, which come from American Banker's review of the docket; the identity of the intruder; whether any of the data has been published or sold; and how the file-sharing environment was entered.

One correction to the record as it stood on October 8. American Banker listed United Wholesale Mortgage among institutions named in lawsuits but not confirmed as Mercadien clients, and quoted UWM saying it did not experience a breach and that the claims are without merit. UWM's own quarterly report, filed with the SEC on August 7, describes the lawsuits as concerning "a cyberattack of UWM's vendor, Mercadien, on October 9, 2025." UWM's position that it was not the party breached is accurate. But its filing, in describing the plaintiffs' allegations, refers to Mercadien as UWM's vendor without disputing it.

Mercadien sells the controls it lost

The firm's financial institutions page is headlined "COMPLIANT AND AHEAD OF THE CURVE." It describes Mercadien as "leading auditors and consultants to banks, credit unions and a host of other financial services entities" and lists the services: "Internal Audit (Outsourced or Co-Sourced)," "BSA/AML Program Review and Consulting," "Enterprise Risk Management," "Information Technology Audit," "SOX/FDICIA Consulting," and "SBA Loan Review Services." Its internal audit page is headlined "PROVIDING SAFE, SOUND AND INNOVATIVE SOLUTIONS TO INTERNAL AUDIT PROBLEMS" and says the firm knows internal audit services "inside and out."

Information technology audit is the line item that should stop a board. An IT auditor's job is to test, among other things, whether the client's access controls work, whether its vendors are overseen, and whether customer data is retained only as long as needed and then destroyed. Those are the three controls that appear to have been at issue on the auditor's own side: an outside party reached client files, some of those files belonged to institutions whose engagements had ended, and some institutions did not learn of it for six to nine months.

This is the attestation gap in its purest form. A bank's board receives an internal audit or IT audit report from a firm like Mercadien and treats it as evidence that the bank's controls are tested and sound. Nobody in that chain was attesting to the controls of the firm holding the test files.

Nine institutions, a dozen documents, three different windows

Mercadien itself has said almost nothing in public. A spokesperson told American Banker the firm "promptly took steps to address the incident" and is "currently unaware of any reports of identity theft or financial fraud," and a May 22 joint status report in the litigation, as reported by American Banker, "denies that notice was unreasonably delayed." We could not access or confirm an incident notice on its website; the likely address returned an HTTP 403 from Cloudflare. Its account of the breach therefore lives almost entirely in what its clients wrote. Read side by side, those documents describe the same incident in ways that do not fully agree.

Orrstown Financial Services: a breach inside a bond redemption

Orrstown, a Pennsylvania bank holding company, disclosed the incident in an 8-K filed May 29, 2026. Item 8.01 has two parts. Part (a) announces the redemption of $31 million of subordinated notes. Part (b) says that on May 21, 2026, the company "received notice from a third-party vendor that such vendor had experienced a cybersecurity incident whereby a third-party gained unauthorized access to sensitive personal information of certain of the Company's customers." It adds that Orrstown "is one of a number of organizations that have been affected" and that the incident is not expected to be material. The 8-K does not name the vendor, give a count, or say when the intrusion occurred.

The name arrives ten weeks later, in Note 16 of Orrstown's second-quarter 10-Q, alongside three customer lawsuits and the sentence that "it is not possible at this time to reasonably estimate possible losses, or even a range of reasonably possible losses." The count, 83,938, appears nowhere in Orrstown's SEC filings. It is in Indiana's log.

SR Bancorp: "internal audit-related services"

SR Bancorp, parent of Somerset Regal Bank in New Jersey, filed its 8-K on July 10, 2026, signed by chief executive Christopher J. Pribula. It is the only filing that says plainly what Mercadien did for the bank: "internal audit-related services." It says an unauthorized actor "accessed and acquired certain files on Mercadien's computer servers," lists the data as "the name, social security number, account numbers, identification documents and/or date of birth for certain Bank customers," and says the incident "has not had, and is not expected to have, a material impact." No count. No dates of intrusion.

IRCO Community Federal Credit Union: the Box environment and the firewalls

IRCO's letter, dated July 2, 2026 and filed with Massachusetts regulators, contains the most specific technical description anywhere in the record. Mercadien detected suspicious activity on November 7, 2025, and responded by "resetting credentials, replacing firewall devices, performing additional and continued scans." The letter says "an unauthorized third party accessed certain files within Mercadien's Box environment." Mercadien told IRCO on May 26, 2026, 200 days after discovery. IRCO calls Mercadien "a former IRCO service provider."

Orange Bank & Trust: "secure Managed File Transfer"

Orange Bank's substitute notice, posted to its website on August 31, 2026 according to the server's Last-Modified header, is titled "Orange Bank & Trust Company Notifies Individuals of The Mercadien Group Data Security Incident." It names the group, not the accounting firm, in the headline. It says "the incident involved Box.com data, a third-party data hosting platform utilized by Mercadien" and describes Box as "a commonly used secure Managed File Transfer ('MFT') software." It gives the window as September 17 to October 8, 2025, one day shorter than every other source that states one, and says "unauthorized actors obtained OB&T vendor files transferred via Box.com." The data list is the longest in the record: "name, financial and/or bank account information, passport number, dates of birth, government identification number, taxpayer identification number, and Social Security number."

Two observations. First, nothing in any notice says Box itself was compromised, and we are not suggesting it was. The notices describe access to Mercadien's environment on the platform. Second, the phrase "secure Managed File Transfer" in a breach notice deserves a pause. File-transfer tools are where the largest third-party breaches of the decade have come from, MOVEit and GoAnywhere among them, and in each case the damage scaled with how many files had been left sitting in the tool after the transfer was done.

Pinnacle Financial Partners: "advisory services"

Pinnacle's letter, dated July 16, 2026 and filed in Massachusetts, says "Mercadien previously provided advisory services to Pinnacle" and that an unauthorized person "accessed and acquired certain data between September 17, 2025, and October 9, 2025." Pinnacle determined its customers were involved on June 16, 2026. The data line in the copy on file reads: "The information that may have been involved includes your name, address, <<Variable Text 1: Data>>", followed by a second merge field.

Suffolk Credit Union: "completed results"

Suffolk's letter of September 11 says Mercadien "provided Suffolk Credit Union with the completed results" of its data review on August 13, 2026. It describes Mercadien as "a former service provider" and gives the September 17 to October 9 window.

Fairwinds Credit Union: a different window, and a termination

Fairwinds' letter of September 23, signed by its chief risk officer, is the only one that says why the auditor had the data, and the only one that says it ended the relationship because of the incident: "We have terminated our relationship with Mercadien as a result of this incident." It also says something no other client says: that the unauthorized actor "may have accessed or acquired information within Mercadien's systems between September 7, 2025, and November 7, 2025." That window starts ten days earlier and ends 29 days later than the window in every other source that states one. It ends on the discovery date. Fairwinds reported the same September 7 start date to Indiana. Either Fairwinds was given a different window than the others, or it chose to state the outer bounds of what it was told. Fairwinds and Mercadien could resolve that in a sentence. The data line in Fairwinds' copy on file with California reads "[Data Elements]."

1st Bank of Sea Isle City, Bangkok Bank, and the rest

1st Bank's June 5 post is quoted above. Bangkok Bank's New York branch reported 460 people to Indiana and told Massachusetts it "had utilized Mercadien, P.C." for audit services. American Banker identified Orange Bank, IRCO, Suffolk and Fairwinds' notification dates from regulator filings. Lawsuits name others, including Evolve Bank & Trust, Unity Bank, Community Bank, N.A., Mid Penn Bancorp and Northwest Bank, mostly "upon information and belief." Northwest told American Banker it has not been a Mercadien client since 2023. EarnIn told the outlet it never hired Mercadien, and that Mercadien held its customers' information because of an audit for one of EarnIn's bank partners. EarnIn's account describes the downstream problem exactly: a fintech's customers exposed through its bank's auditor, with no contract between the fintech and the firm that lost the data.

The copies on file do not say what was taken

State breach statutes require notices to tell people what information was involved. The sample letters that institutions file with attorneys general are how regulators, reporters and the public check that they did.

In this incident, at least four of the copies on file do not contain the answer. Fairwinds' California filing says the information involved "may have included: [Data Elements]." Pinnacle's Massachusetts filing says "<<Variable Text 1: Data>>." IRCO's reads "your name, [Extra1]." Suffolk's California copy reads "including your [Extra 1 (Variable text)]." IRCO's also offers "a complimentary ## membership" in credit monitoring, and Fairwinds' offers monitoring "for ## months" under the title "Notice of Data [Compromise / Breach]."

Merge fields in a sample letter are common, and each individual's letter presumably carried the real values. But the regulator's copy is the public's only window into what each population lost, and in these four cases the window is a template. Nobody reviewing the public record can say from these filings whether the 165,054 people in Fairwinds' population lost Social Security numbers or only names and account numbers. The only client filings that answer the question in plain text are SR Bancorp's 8-K, Orange Bank's substitute notice, and Bangkok Bank's Massachusetts letter, which lists name, address, date of birth and Social Security number.

The first lawsuit fills in some of the rest. According to USA Herald's account of the complaint filed February 23, the data potentially exposed included names, addresses, dates of birth, driver's license and government ID numbers, Social Security numbers, financial account information, usernames and passwords, payment card details for a limited number of people, and IRS personal identification numbers. That last item is specific to tax work. If it refers to the Identity Protection PINs the IRS issues so that nobody else can file a return in a taxpayer's name, its presence in an intruder's hands defeats its purpose. These are allegations in a complaint, not findings, and they concern Mercadien's own notified population rather than any particular bank's customers.

Mercadien told Maine "TBD," and "No"

Mercadien's own filing with the Maine Attorney General, submitted by its outside counsel, is the closest thing in the record to a first-person statement. Three entries in it are worth reading against the rest of the timeline.

Total number of persons affected: "TBD." The filing lists consumer notification on December 1, 2025. Eleven weeks later, Indiana's log records a Mercadien notice dated February 17, 2026. American Banker reported the February figure as 402,741; the log now reads 402,760. So by mid-February Mercadien had a number of roughly four hundred thousand people. Orrstown would not hear from Mercadien for another 93 days, and Fairwinds and Suffolk for another 177.

There may be an explanation. Mercadien may have counted and notified its own direct clients first, the individuals and businesses whose tax and accounting work it did, and only later worked through the bank and credit union files, which would mean the 402,760 does not include the bank customers at all and the true total is larger. Or the February figure may already include the bank customers, which would mean Mercadien knew whose data it was months before it told the banks. Either reading is a problem. The first means the public total is understated. The second would suggest the delay was a choice. Mercadien has not said which.

Were identity theft protection services offered: "No." Every client letter we read offered credit monitoring to at least some of the people notified. Mercadien's own December notice, as filed in Maine, did not.

Date of any previous (within 12 months) breach notifications: blank. Which brings us to the other Maine filing.

The Mercadien Group had been breached ten months earlier

On June 13, 2025, The Mercadien Group, LLC notified 327 people of a breach. Its Maine filing lists the same street address as the accounting firm, 3625 Quakerbridge Road in Hamilton, the same outside law firm, and the same description: "External system breach (hacking)." The intrusion began November 26, 2024. It was discovered April 29, 2025, 154 days later. The group offered 24 months of credit monitoring.

Ninety-six days after that notice went out, on September 17, 2025, the intrusion at Mercadien, P.C. began.

The accounting firm and the group are separate legal entities, and the Maine form asks about the filing entity's own prior notices, so a blank answer is defensible on its face. But the two share an address, a name, outside counsel and, on the public record, network address space: the remote-access hostnames on mercadien.com resolve to addresses registered to Mercadien Group. Orange Bank, for its part, titled its notice as an incident of "The Mercadien Group," though its body names Mercadien, P.C. CPAs as the vendor. We do not know whether the two intrusions are connected, whether the 2024 incident involved the same environment, or what changed between them. We do know that the second began less than a year after the first, and that none of the client notices we read mentions the first.

For a bank's vendor-management team, that is the sentence that matters. A prior breach at a vendor's affiliate, under the same roof, is exactly what an annual vendor review exists to surface. If any of these institutions were still sending files to Mercadien in the summer of 2025, the question for their boards is whether anyone asked.

Some of the data was from engagements that had already ended

At least four of the institutions call Mercadien a "former" provider or describe its work in the past tense. 1st Bank of Sea Isle City says the engagement was in "early 2024." Northwest says it has not been a client since 2023. American Banker reported that some of the stolen records came from work dating to 2023, and that auditors typically keep workpapers five to seven years.

That retention period is real, and it exists for good reasons: audit firms have professional and regulatory duties to keep evidence of their work. But there is a difference between keeping a workpaper and keeping a live copy of a bank's customer file in the platform the bank used to send it. Justin Herring, the former head of the New York Department of Financial Services cybersecurity division, now at Mayer Brown, told American Banker that a bank-auditor contract "should absolutely require deletion or return after the retention period expires." The federal banking agencies said the same in their 2023 interagency guidance on third-party relationships, which says contracts should "provide for the timely return or destruction of the banking organization's data."

Orange Bank's own description gives the mechanism away. The files the intruders obtained were "OB&T vendor files transferred via Box.com." Transferred. A file-transfer platform used as an archive is a familiar pattern in third-party data loss, because the files outlive the transfer and nobody owns deleting them.

What the auditor's domain still vouches for

One observation from this morning's checks is not about the breach itself, and we label it accordingly. It is about what comes after.

Fairwinds tells members it will never ask for online banking credentials or a multi-factor code, and to call its official number about any suspicious text, call or email. 1st Bank of Sea Isle City's customers had already seen social media advertising about the breach before the bank said a word. When a breach becomes public and the victim's name becomes a lure, the most valuable asset for a scammer is a sender address that passes authentication.

Mercadien's SPF record, the DNS entry that tells receiving mail servers which machines may send as mercadien.com, includes ip4:167.68.0.1/16. ARIN's registry assigns that entire /16 network, 65,536 addresses, to Thomson Reuters (Legal) Inc. The likeliest explanation is mundane: accounting firms send client mail through Thomson Reuters tax and practice software, and authorizing the vendor's whole network is the quick way to make that mail deliver. The record also ends in a softfail rather than a hard fail. Mercadien's DMARC policy is set to quarantine, which helps against spoofed mail from outside the authorized ranges. It does nothing for mail from inside them, because that mail passes. An SPF record that authorizes an entire third-party network means that any sender inside that network passes the check for the auditor's domain.

We are not saying that range has been abused. We are saying that the vendor-risk question cuts both ways: banks should ask who can send email as their auditor, because their customers have just been told to expect mail about this breach.

The hypothesis, stated as one

Mercadien's response, as IRCO relayed it, included "replacing firewall devices." Replacing firewalls after an intrusion can indicate that the devices or their configurations were no longer trusted, though it can also mean they were simply due for replacement. Nobody has said which firewalls Mercadien replaced or why.

Here is a coincidence of dates that we cannot resolve, and that Mercadien can. On September 17, 2025, SonicWall disclosed that attackers had accessed firewall configuration backup files stored in its MySonicWall cloud backup service, initially saying fewer than five percent of its install base was affected. On October 8, 2025, SonicWall said the attackers had accessed the backup files of all customers who have used the service, according to Help Net Security. Configuration backups of that kind hold the settings and encrypted credentials an attacker would want before targeting a specific firewall.

Orange Bank's notice gives the Mercadien intrusion window as September 17 to October 8, 2025. Those are the same two dates. Orange Bank is the only source that ends the window on October 8; Pinnacle, Suffolk, UWM's 10-Q and Mercadien's counsel, as quoted by American Banker, all say October 9.

We do not know what firewall Mercadien ran. We have not found any public indication that it used SonicWall or its cloud backup service. Disclosure dates are not attack dates, and the start of the Mercadien window could simply be the first day the forensic logs show activity. This could easily be coincidence. We raise it because replacing firewalls is a step a firm may take when it believes devices or their configurations were exposed, and because every bank that relied on Mercadien deserves to know whether the entry point was a device class that thousands of other firms also run. One sentence from Mercadien would close the question.

The behavior the notices describe maps to MITRE ATT&CK technique T1530, Data from Cloud Storage: files taken from a cloud-hosted repository. If the entry was through stolen or reused credentials, which the credential reset suggests but does not establish, it would also map to T1078, Valid Accounts. That second mapping is our inference, not a finding.

No federal clock reached the auditor

The most important thing about the Mercadien breach is that, as far as the public record shows, no federal rule required Mercadien to tell a single bank by any fixed date.

The banking agencies have expected vendor notice for two decades. Their 2005 Interagency Guidance on Response Programs, published as Supplement A to the information security guidelines, says a bank's contract with its service provider should require the provider to address unauthorized access to customer information, "including notification to the institution as soon as possible." That is guidance addressed to the bank. It sets no number of hours, it binds the vendor only through whatever the bank's contract says, and the bank enforces it after the fact.

The federal banking agencies' computer-security incident notification rule, in force since 2022, does contain a vendor clock. Under the FDIC's version at 12 CFR 304.24, a bank service provider must notify its bank customers "as soon as possible when the bank service provider determines that it has experienced a computer-security incident", but only one that has materially disrupted or degraded, or is reasonably likely to disrupt or degrade, covered services for four or more hours. The rule was written for outages. An auditor that quietly loses a folder of customer files disrupts nothing, and the rule says nothing about it.

The NCUA's cyber incident rule at 12 CFR 748.1(c) is broader. It covers "unauthorized access to sensitive data" facilitated through a compromise of "other third-party data hosting provider or by a supply chain compromise," and it requires a federally insured credit union to tell the NCUA within 72 hours. But the clock starts "within 72 hours of being notified by a third-party." For Suffolk and Fairwinds, that was August 13, 2026. The NCUA's rule makes the credit union fast. Nothing in it makes the vendor fast.

The SEC has gone further than the banking agencies. Amendments to Regulation S-P adopted in May 2024 require broker-dealers, investment advisers and other covered institutions to maintain written policies and procedures reasonably designed to ensure that their service providers notify them no later than 72 hours after becoming aware of a breach. Under the SEC's adopting release, larger firms had to comply by December 3, 2025 and smaller ones by June 3, 2026. If Mercadien's clients had been registered investment advisers rather than banks, a fixed 72-hour vendor notice would now be a regulatory expectation. For a community bank sending customer files to its internal auditor, the number of hours is whatever the engagement letter says, if it says one.

And the engagement letter, as the attorneys American Banker interviewed explained, typically limits the audit firm's liability to fraud or gross negligence, and banks rarely negotiate it. The duty to notify customers stays with the bank. The cost of the response falls first on the bank and its cyber insurer. The vendor pays later, through contract limits and its own insurance.

That is the materiality asymmetry in one paragraph. To each bank, the incident is "not expected to have a material impact." To Mercadien, a regional accounting firm, it is more than a dozen federal lawsuits. To the 165,054 people in one credit union's notified population, it may be their Social Security numbers. The only party in the chain with no clock is the one that lost the data.

This failure is a quarter-century old, and so is the fix

The Interagency Guidelines Establishing Information Security Standards, issued under the Gramm-Leach-Bliley Act in 2001 and codified for national banks at 12 CFR Part 30, Appendix B, tell every bank to "exercise appropriate due diligence in selecting its service providers," to "require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines," and, where the risk warrants, to "monitor its service providers to confirm that they have satisfied their obligations." One of the program's objectives, added by a 2004 amendment, is to "ensure the proper disposal of customer information and consumer information."

In 2023 the Federal Reserve, FDIC and OCC replaced their separate third-party guidance with a single document, published in the Federal Register on June 9, 2023. It repeats the point plainly: "the use of third parties does not diminish or remove banking organizations' responsibilities," and contracts should provide for "the timely return or destruction of the banking organization's data, information, and other resources."

Nothing about the Mercadien incident required a new idea to prevent. It required a bank to ask its auditor, at the end of an engagement, whether the customer files had been deleted from the transfer platform, and to get the answer in writing.

The same move, a month earlier

Bank boards have seen this shape recently. In August 2025, Marquis Software Solutions, a Plano, Texas marketing vendor that serves roughly 700 banks and credit unions, detected suspicious activity on its systems. According to the Star Tribune, Marquis first told Minnesota's Blaze Credit Union in mid-August that its members' data appeared safe, then confirmed in October that it had been accessed and copied. Blaze began notifying in December, covering about 235,000 active member accounts, and said it was working to separate from the vendor.

Marquis was a marketing vendor. Mercadien is an auditor. The pattern is the same: customer data copied to a vendor for a narrow purpose, taken from there, and reported to the institution on the vendor's schedule. The Mercadien intrusion began a month after Marquis detected its own.

The plaintiffs are about to get the list nobody else has

The first proposed class action against Mercadien was filed in federal court in New Jersey on February 23, 2026, case 3:26-cv-01773. Law360's headline the next day: "Accounting Firm Slow To Issue Data Breach Notice, Suit Says." The complaint, as USA Herald reported it, says class members "are thus left to speculate as to where their private information ended up." CourtListener's index shows more than a dozen further cases naming Mercadien entities in the District of New Jersey between February 24 and October 2, 2026, most assigned to Judge Michael A. Shipp, plus a related case in the Middle District of Pennsylvania and two suits against UWM in Michigan. Orrstown's 10-Q says two of the New Jersey cases were consolidated as In re Mercadien, P.C., CPAs.

According to American Banker's review of the docket, the court entered an order on October 6 allowing plaintiffs to seek, before a December 4 mediation, a list of every affected Mercadien client, the number of people tied to each, the types of data involved, and Mercadien's contracts with its clients, including indemnification terms. Mercadien did not oppose the request. The contracts will be produced under a protective order.

Think about what that means for a bank board. Plaintiffs' counsel will shortly hold a more complete picture of this breach than any single bank does: which institutions, how many customers each, what data, and what each contract promised. Each bank knows only its own slice, on the date Mercadien chose to tell it. Some boards may learn the full scope of their own vendor's breach the way 1st Bank of Sea Isle City's customers apparently did, from the plaintiffs' side.

What Mercadien should have done by now

Measured against the standard Mercadien sells, which is the standard of a firm that audits banks' controls for a living:

1. Told every client within days of November 7, 2025, not when its data review was finished. A bank does not need a completed file review to start its own regulatory clock, check its own contract, or prepare its customers. It needs to know its files were in the environment. Some clients waited 279 days for that sentence.
2. Published a single, consistent account of the intrusion. The record holds three windows: September 17 to October 9, September 17 to October 8, and September 7 to November 7. A forensic investigation produces one. Mercadien should state it, and explain why Fairwinds' letter describes a different one.
3. Published its own count and reconciled it. Mercadien told Maine "TBD" and Indiana 402,760. Fairwinds alone reported 165,054. The public needs to know whether the bank customers are inside the 402,760 or outside it.
4. Deleted client files at the end of each engagement. Some data from engagements that ended in 2023 and early 2024 was in a file-transfer environment in the fall of 2025. Workpaper retention does not require keeping a live copy of a bank's customer file on a transfer platform.
5. Disclosed the affiliate's earlier breach to clients. The Mercadien Group's 2024 intrusion was reported to Maine in June 2025. None of the client letters we read mentions it.
6. Named the entry point. "Replacing firewall devices" and "Box environment" are the only technical details in the record, and both came from clients, not from Mercadien. If the entry point was a device class or credential pattern other firms share, every one of them needs to know.
7. Offered identity protection to its own notified individuals. Its Maine filing says it did not. Every client letter we read did, for at least some recipients.

Mercadien has not responded to any of these points in public. If it does, this page will be updated.

What boards should be asking this week

For the board of any bank, credit union or fintech that sends customer data to an auditor, examiner-prep firm or consultant:

• Which of our auditors and advisors hold copies of our customer files right now, on what platform, and from which engagements?
• Does each engagement letter require deletion or return of customer data at the end of the engagement, and have we ever received a certificate of destruction?
• Does each contract require the firm to notify us of a security incident within a fixed number of hours, regardless of whether its review is complete? If not, what is our notice period, in practice?
• Does the engagement letter cap the auditor's liability at fraud or gross negligence, and did anyone on our side read that clause before signing?
• Have any of our audit and advisory firms, or their affiliates, reported a breach to any state attorney general in the past three years? Who checked?
• For credit unions: when a third party notifies us, who starts the NCUA 72-hour clock, and has that path been tested?
• Who can send email as our auditor's domain, and have we told customers how to verify mail about this incident?

For sponsors and acquirers

For private equity sponsors and acquirers, the Mercadien breach is a diligence item in three places.

First, in bank and credit union targets. The vendor inventory a target produces in diligence usually lists its core processor, its payments vendors and its cloud providers. It rarely lists its internal auditor, its loan review firm or its BSA consultant as data processors, even though each one receives customer files. Ask for the list of every third party that has received customer data in the past five years, and ask which of them have been breached.

Second, in professional-services platforms. Accounting and advisory roll-ups have drawn heavy private equity investment. An acquired firm's breach history, including affiliates under the same roof, its data retention practices, and the breach-notice provisions in its client engagement letters are all liabilities that transfer at close. A seller's representation that it has had no material incidents does not tell you whether its affiliate filed with the Maine Attorney General.

Third, in contingent liability. The October 6 order means indemnification terms will be produced in discovery. Where a bank's engagement letter caps the auditor's liability, the bank and its insurer carry the response cost. For a target with a Mercadien-type exposure, the exposure is not limited to the vendor's breach. It is whatever the target agreed to absorb when it signed the engagement letter.

What we are not saying

We are not saying Mercadien's breach was caused by a SonicWall device or by the SonicWall cloud backup incident; we do not know what firewall it ran, the matching dates may be coincidence, and the October 8 end date appears in only one source. We are not saying Box was compromised; the notices describe access to Mercadien's environment on the platform. We are not saying the 2024 Mercadien Group incident and the 2025 Mercadien, P.C. incident are connected. We are not saying the Thomson Reuters network authorized in Mercadien's SPF record has been used to send malicious mail. We are not saying any data from this incident has been published, sold or misused; Mercadien and every client say there is no evidence of misuse, and no group has claimed it. We are not saying that the institutions named in lawsuits but absent from regulator filings were Mercadien clients. We are not saying any bank or credit union violated a notification rule; each one appears to have notified after it was told.

We are saying that a firm that sells internal audit and IT audit to banks held customer files, some from finished engagements, in a file-transfer environment, lost them, told regulators a count in February, and told some of its bank clients in August. We are saying that federal guidelines since 2001 told banks to control exactly this, that federal guidance since 2005 asks only for vendor notice "as soon as possible," and that none of the binding clocks written since 2022 reaches the auditor. If Mercadien or any institution named here would like to correct the record, this page will be updated the same day.

Our record of these incidents

• Mercadien, P.C., CPAs Breach, the verified timeline, document list and running list of unknowns
• Three Breaches, Three Years. Client Tax Records in a Hacker's Hands. EY Still Won't Name the Platform That Failed., the Big Four version of the same problem: client tax records in a support platform outside the attestation boundary
• Frost Bank and the New Vendor-Risk Reality, on bank exposure through vendors
• Drift. Gainsight. Now Klue., on third-party access as the side door
• Law Firms Are the Names in the Ledger. Deal Data Is the Product., on professional-services firms as the soft target in deal data

Sources

• Carter Pape, American Banker, Auditor's breach hit at least 9 banks, credit unions, October 8, 2026
• Indiana Attorney General, Data Breach Year-to-Date Report 2026, rows 110, 389, 733, 852, accessed October 12, 2026
• Maine Attorney General, Data Breach Notification: Mercadien PC Certified Public Accountants, consumer notice December 1, 2025
• Maine Attorney General, Data Breach Notification: The Mercadien Group, LLC, consumer notice June 13, 2025
• Fairwinds Credit Union, Notice of Data Event (filed with the California Attorney General), September 23, 2026
• Suffolk Credit Union, Notice of Data Breach (filed with the California Attorney General), September 11, 2026, and Mercadien incident notice
• IRCO Community Federal Credit Union, Notice 2026-1077 (Massachusetts OCABR), July 2, 2026
• Pinnacle Financial Partners, Notice 2026-1157 (Massachusetts OCABR), July 16, 2026
• Bangkok Bank PCL New York Branch, Notice 2026-1526 (Massachusetts OCABR), 2026
• Orange Bank & Trust Company, Substitute Notice: The Mercadien Group Data Security Incident, August 31, 2026
• 1st Bank of Sea Isle City, Social Media Ads Targeting 1st Bank Customers, June 5, 2026
• SR Bancorp, Inc., Form 8-K, Item 8.01, July 10, 2026
• Orrstown Financial Services, Form 8-K, Item 8.01, May 29, 2026, and Form 10-Q, Note 16, August 6, 2026
• UWM Holdings Corp., Form 10-Q, legal proceedings, August 7, 2026
• Mercadien, Financial Institutions and Internal Audit Services pages, accessed October 12, 2026
• Rihem Akkouche, USA Herald, New Jersey Accounting Firm Mercadien PC Hit With Proposed Class Action Over September Cyberattack That Exposed Thousands' Private Information, February 24, 2026
• Law360, Case 3:26-cv-01773 (D.N.J.), case page, and Law360, "Accounting Firm Slow To Issue Data Breach Notice, Suit Says," February 24, 2026
• Help Net Security, Attackers compromised ALL SonicWall firewall configuration backup files, October 9, 2025
• Star Tribune, 235K members of Minnesota-based credit union notified of data breach after cyberattack, December 31, 2025
• FDIC, 12 CFR 304.24, Bank service provider notification
• NCUA, 12 CFR 748.1(c), Cyber incident notification
• OCC, 12 CFR Part 30, Appendix B, Interagency Guidelines Establishing Information Security Standards, including Supplement A, Interagency Guidance on Response Programs (2005)
• Board of Governors, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920, June 9, 2023
• Securities and Exchange Commission, Regulation S-P adopting release, 89 FR 47688, June 3, 2024; Simpson Thacher, SEC Adopts Significant Amendments to Regulation S-P, May 22, 2024
• MITRE ATT&CK, T1530 Data from Cloud Storage and T1078 Valid Accounts

Request for comment: Cloudskope will update this post with any response from Mercadien or the institutions named. Cloudskope's first-hand checks, with times and methods, are logged on the companion Breach Library page.