An unidentified intruder broke into the systems of Mercadien, P.C., CPAs, an accounting firm in Hamilton, New Jersey that audits banks and credit unions. The intruder took personal data that Mercadien's breach report to the Indiana attorney general puts at 402,741 people. American Banker reports that at least nine banks and credit unions have confirmed Mercadien held their customers' data, and customer class actions name seven more institutions. Orrstown Bank, Suffolk Credit Union, FAIRWINDS Credit Union and Orange Bank & Trust are among those that have sent notices. Most of the people affected never dealt with Mercadien. Their bank or credit union gave Mercadien their records for audit or regulatory review work, sometimes years earlier. Some notices went out more than 10 months after Mercadien found the intrusion. None of the sources available for this brief is a primary document such as Mercadien's own filing. The brief relies on American Banker's reporting and on secondary write-ups of state filings and institution notices, and figures are attributed accordingly.
What Happened
Mercadien says it found the intrusion on November 7, 2025, and every source agrees on that date. The sources disagree on how long the intruder was inside:
- September 17 to October 9, 2025: given in a January 3 letter from Mercadien's outside counsel to the New Hampshire Department of Justice (as cited by American Banker), and repeated in Suffolk Credit Union's notice.
- September 17 to October 8, 2025: given in Orange Bank & Trust's notice, according to the law firm Dapeer Law.
- September 7 to November 7, 2025: given in FAIRWINDS Credit Union's sample notice filed with the California attorney general. This wider window runs all the way to the discovery date.
The Mercadien-sourced window (September 17 to October 9) is the best-supported. The FAIRWINDS wording may describe the period investigators reviewed rather than confirmed intruder activity, but the public record does not settle this.
Notifications went out in stages:
- December 2025: Mercadien warned people who had worked with the firm directly about a "potential security incident."
- May 2026: Mercadien began telling its bank and credit union clients, six to nine months after discovery, according to American Banker. In May, Orrstown Financial Services disclosed that a third-party vendor had allowed unauthorized access to some customers' information. It said its own systems were not compromised and that it did not expect a material financial effect.
- August 13, 2026: Mercadien gave review results to FAIRWINDS and Suffolk.
- September 2026: Orange Bank & Trust mailed notices on September 2, Suffolk began on September 11, and FAIRWINDS' sample notice is dated September 23.
Several affected institutions, including Suffolk and FAIRWINDS, describe Mercadien as a former provider. FAIRWINDS says it has ended the relationship.
The lawsuits have been consolidated in federal court in Trenton, New Jersey. American Banker reports that a federal judge recently cleared the plaintiffs to seek discovery into how far the breach reaches.
What Was Taken
The affected-person count is not settled. Mercadien reported 402,741 affected people to Indiana in February, before most of its clients knew their customers were involved. The Indiana report lists 69 Indiana residents within that total. Orrstown Bank alone has since reported 83,938 affected customers, and it is the only confirmed institution known to have published its own total.
The public record does not show whether Orrstown's 83,938 are part of the 402,741. If they are, Orrstown accounts for about a fifth of the breach. If they are not, the total is at least 486,679, a point raised by The Clarity. Readers should treat 402,741 as Mercadien's February figure, not a final count.
The exposed data varies by person. According to Orrstown's notice filed with Massachusetts regulators (as reported by The Money Overview), together with the Suffolk, Orange Bank and FAIRWINDS notices, it may include:
- Full names, home addresses and dates of birth
- Social Security numbers or taxpayer identification numbers
- Financial account numbers
- Government ID numbers, including driver's license and passport numbers
- Other identity verification information (cited in Suffolk's notice)
Records came from audit and advisory work going back as far as 2023. Every institution that has issued a notice says it has no evidence the data has been misused. All of the reported offers are through Experian:
- Orrstown: 24 months of credit monitoring and identity restoration.
- FAIRWINDS: monitoring, identity restoration and identity theft insurance, with enrollment open until December 31.
- Orange Bank & Trust: three-bureau IdentityWorks monitoring.
This combination of SSN, date of birth, government ID and account number is enough for account takeover, synthetic identity fraud and convincing phishing or social engineering aimed at bank customers.
Why It Matters
This is a concentration-risk failure in the financial sector's supply chain:
- One vendor, many institutions. Banks routinely hand customer records to outside auditors for required exams and reviews. A single professional-services firm can therefore hold sensitive data from many otherwise separate institutions, and none of those institutions' own defenses applies to it.
- Exposure outlasts the contract. Auditors usually keep workpapers for five to seven years, according to American Banker. Several affected institutions had stopped using Mercadien years earlier, but their customers' files were still on its systems. On that schedule, a 2023 audit could stay on an auditor's systems until 2028 to 2030.
- Disclosure depends on the vendor. A bank learns of an auditor's breach only when the auditor tells it. Mercadien's six-to-nine-month delay in notifying clients set the earliest date any of them could warn their own customers. "A six-to-nine-month gap seems unlikely to be consistent with what the law expects," Tyler Henry of McDermott Will & Schulte told American Banker.
- Fourth-party exposure. The Clarity notes that fintechs and other bank partners can have customer records on an auditor's systems through a partner bank's audit, even though they never vetted that auditor.
- Legal liability. The consolidated class action, and plaintiffs naming institutions beyond the nine confirmed, show that liability reaches both the vendor and its clients.
The Attack Technique
The sources do not identify a threat actor, ransomware group or initial access method, and no group has publicly claimed the attack. Mercadien's notices describe unauthorized access to "part of its computer environment" and to data that may have been "accessed or acquired."
The only specific technical detail comes from Dapeer Law, a plaintiffs' firm. Citing Orange Bank & Trust's notice, it says the unauthorized activity took place in Mercadien's Box.com environment, the cloud file-sharing platform the firm used to receive bank files. If accurate, this points to a compromised cloud storage tenant or stolen credentials rather than an on-premises network intrusion. No other source confirms the Box.com detail, so treat it as reported, not established. The roughly three-week dwell time before activity stopped, followed by another month before detection, suggests the firm had limited monitoring of activity in its file-sharing environment.
What Organizations Should Do
- Set data-retention and return terms for auditors and consultants. Contracts should cover deletion or return of customer data when an engagement ends, plus attestation that it was done. Where regulatory retention rules allow, keep raw customer data out of auditor workpapers entirely.
- Minimize what you send. Give auditors sampled, masked or tokenized records where possible. Full SSNs, dates of birth and government ID numbers are rarely needed for quality-control or compliance testing.
- Require breach notification within days, not months. Vendor agreements should set a defined deadline (for example, 72 hours from discovery) for telling clients, with obligations to share the affected-record list. This lets institutions meet their own regulatory deadlines.
- Include professional-services firms in third-party risk reviews. Audit firms, law firms and consultants often skip the security review that technology vendors get. Assess how they handle files: cloud file-sharing configuration, MFA, access logging and alerting on bulk downloads.
- Inventory former vendors. Keep a register of past vendors that may still hold your data, and periodically confirm that data was destroyed.
- Prepare customers for follow-on fraud. Affected institutions should watch for account takeover attempts, new-account fraud using exposed identities, and phishing that uses the breach as a lure. They should also strengthen identity checks at the call center and branch for affected customers.
Sources: A cyberattack on bank auditor Mercadien exposed data on 402,741 peo... | Auditor's breach hit at least 9 banks, credit unions American Banker | Mercadien Breach Affected Customers at Nine or More US Depository I... | Mercadien's breach reaches bank audit files from 2023 | FAIRWINDS CU Notifies Members PII May Have Been Accessed in Cyberat... | Fairwinds Credit Union Data Breach Investigation: Edelson Lechtzin... | Orange Bank and Trust Data Breach Lawsuit (September 2026) | Suffolk Credit Union Data Breach: Edelson Lechtzin LLP Launches Inv...