A data security breach at accounting firm Mercadien affected customers of at least nine US banks and credit unions, according to American Banker. An Indiana breach report lists 402,741 people as affected. Mercadien said an unauthorised party may have accessed data between 17 September and 9 October 2025. The firm detected the intrusion on 7 November 2025.
The incident occurred in Mercadien's systems rather than the systems of the financial institutions that used its services. Suffolk Credit Union said the former provider gave it completed review results on 13 August 2026. Potentially exposed data varied by person and could include names, addresses, dates of birth, Social Security numbers, driving-licence numbers and financial-account numbers. Suffolk said it had no evidence that the information had been misused.
A VENDOR INCIDENT ACROSS MULTIPLE INSTITUTIONS
American Banker identified the incident as affecting at least nine banks and credit unions, showing how one professional-services supplier can concentrate data risk across otherwise separate institutions. The Indiana attorney-general report records 69 affected state residents within the total of 402,741 people. Suffolk began mailing notices to potentially affected people on 11 September and offered identity-theft protection where Social Security numbers may have been involved.
Orrstown Financial Services disclosed in May that a third-party vendor had allowed unauthorised access to sensitive information concerning some customers. It said its own systems and networks had not been accessed or compromised. Orrstown also said the incident had not had, and was not expected to have, a material effect on its operations, financial condition or results.
COURT PROCESS MAY CLARIFY THE FULL REACH
The incident has produced federal litigation involving Mercadien and several financial institutions. American Banker reported that a federal judge allowed plaintiffs to pursue discovery into the breach's full reach. Public dockets name banks and credit unions alongside Mercadien, while individual institutions have issued their own notices as reviews were completed.
The case highlights the disclosure and oversight burden created when banks share customer information with outside professional firms. The key unresolved question is whether additional institutions or affected customers will be identified through discovery. The next concrete milestone is a mediation scheduled for 4 December, after the court-ordered information exchange.