Pelican State Credit Union Data Breach Raises Questions About Third-Party Oversight in Banking

Pelican State Credit Union has revealed that a recent security breach involving a third-party vendor has resulted in the exposure of sensitive user information. The incident is at the forefront of ongoing discussions around the challenges faced by financial institutions regarding the security of sensitive information aligned with their operations and data handling through external vendors.

After Pelican State Credit Union discovered the  Data Breach incident on August 15, 2025, it was reported that Marquis Software Solutions—a vendor providing software services to Pelican State Credit Union—had experienced a compromise of their data security system. An investigation into the incident determined that an unidentified individual may have gained access to or acquired computer files containing private user data. Marquis Software subsequently alerted Pelican State Credit Union in late October of 2025 regarding the likelihood that user's personal information had been compromised, prompting the Credit Union to publicly notify the general public on November 14 and begin to contact adversely impacted individuals.

As stated in the disclosure documents, the compromised data may contain personal details such as full names, birth dates, Social Security numbers (SSNs), tax ID numbers (TINs), bank account numbers and credit/debit card numbers. While neither Pelican nor Marquis has announced any known cases of this data being used for illicit activities, cybersecurity experts consider the extensive nature and sensitivity of this information increases the likelihood that the compromised data could lead to long-term identity theft. The illicit trade in Social Security numbers and bank accounts are among the most sought after commodities in the underground economy; thus, it is virtually impossible to entirely protect one's identity once these items have been compromised.

Pelican has made clear that it did not have a security breach within its own company (internal systems), but rather the breach was created as a result of a vendor participating in an external environment. This difference has raised flags for both regulators and industry consultants. The majority of financial institutions (FIs) today exist within very large digital ecosystems where an outside vendor performs many elements of the FI’s business - e.g., processing transactions, providing analytics - thus allowing for a greater pace/extent of innovation; yet, at the same time, this also creates greater opportunities for attacks on the business model, many of which FIs continue to deal with on a daily basis.

In its proposals, the FTC, NCUA, and federal bank regulators highlight vulnerabilities associated with vendor relationships in conjunction with cybersecurity. These proposals recommend enhanced methodologies for conducting a thorough risk assessment of vendor relationships; ensuring stronger contractual protections for sensitive information of consumers; and conducting ongoing active monitoring of vendor activities as opposed to limited scope, periodic certifications.

Additionally, regulatory experts anticipate that the Pelican breach may elevate the push for increased oversight related to vendor security, particularly since many cybercriminals continue to target smaller businesses that allow them to access multiple financial institutions through one vendor.

Charitable credit unions are especially vulnerable relative to national banks. Compared to national banks, charitable credit unions typically operate with smaller budgets and less technical staffing; however, charitable credit unions still have access to the same sensitive consumer data as national banks, and both rely upon the same category of software vendors. As cybercriminals have shifted strategies toward a supply chain attack method for breaching vendors' systems, regulatory experts recommend that vendor oversight become a primary focus rather than an afterthought for many charitable credit unions.

The Breach Should Serve as a Lesson that Consumers’ Personal Data is Available Beyond Just Banks to All Other Companies Who Supply Financial Services

For consumers affected by this incident, it serves as a reminder that there are many different systems and companies involved in the financial services supply chain where their personal information is shared. The consumers who were notified that their information had been compromised in this incident are being encouraged to monitor their accounts, credit reports, and online financial activities for any unusual activity. Institutions providing customers free credit monitoring may provide some assistance; however, the exposure of an individual’s Social Security number (SSN) for a long period of time will present a continuing risk to that individual.

Pelican State Credit Union has announced that it is reviewing its relationships with its vendors as well as confirming they meet the latest security requirements. Marquis has not made public any additional technical information regarding the event or the potential for any other financial institutions to have been affected.

As the investigation continues, this incident will add to the growing number of cases to illustrate that third-party vulnerability continues to be one of the blind spots of the financial sector. Experts say that improving oversight with third-party vendors will likely require not just regulatory pressure but also restructuring the process of how institutions evaluate, monitor, and audit third-party vendors.

An independent legal review is also underway. My Data Breach Attorney, a law firm focused on data breach matters, has opened an investigation to help individuals understand their rights following the Pelican State Credit Union incident. Check here for more information,
https://mydatabreachattorney.com/case/pelican-state-credit-union-data-breach/