Industrial Credit Union of Whatcom County recently experienced a significant cybersecurity event involving one of it's third-party partners, Marquis Software Solutions ("Go Marquis"). The compromised data included personally identifiable information (PII) of at least 24,526 Washington residents.
The Marquis Software Solutions data breach was first detected on Aug. 14, 2025. The incident originated when the vendor’s systems were infiltrated, resulting in unauthorized access to files containing member information. Forensic teams determined the scope of the breach, confirming that Industrial Credit Union member data was part of the compromised records.
The compromised data included personally identifiable information (PII) such as names, full dates of birth, Social Security numbers and non-transactional account references (including member numbers and account suffixes). The exposure of PII puts individuals at risk of identity theft and financial fraud.
The data breach was reported to the Washington Attorney General's office on Nov. 26, 2025.
Industrial Credit Union of Whatcom County (Go Marquis)'s response
Upon learning of the breach, Industrial Credit Union of Whatcom County immediately terminated its relationship with the affected communication delivery partner. The credit union also notified law enforcement and regulatory agencies, and engaged cybersecurity experts to assess the situation. The credit union is offering a free one-year subscription to a credit monitoring s
Source: https://www.claimdepot.com/data-breach/industrial-credit-union-2025
Industrial Credit Union cybersecurity rating report: https://www.rankiteo.com/company/industrial-credit-union
"id": "IND1764878606",
"linkid": "industrial-credit-union",
"type": "Breach",
"date": "8/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'incident': {'affected_entities': [{'customers_affected': '24,526',
'industry': 'Financial Services',
'location': 'Washington, USA',
'name': 'Industrial Credit Union of '
'Whatcom County',
'size': None,
'type': 'Credit Union'},
{'customers_affected': None,
'industry': 'Software Solutions',
'location': None,
'name': 'Marquis Software Solutions (Go '
'Marquis)',
'size': None,
'type': 'Third-party vendor'}],
'attack_vector': 'Third-party vendor compromise',
'customer_advisories': 'Notification to affected individuals '
'about the breach and credit monitoring '
'services',
'data_breach': {'data_encryption': None,
'data_exfiltration': None,
'file_types_exposed': None,
'number_of_records_exposed': '24,526',
'personally_identifiable_information': ['Names',
'Full '
'dates '
'of '
'birth',
'Social '
'Security '
'numbers',
'Member '
'numbers',
'Account '
'suffixes'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally '
'identifiable '
'information (PII)'},
'date_detected': '2025-08-14',
'date_publicly_disclosed': '2025-11-26',
'description': 'Industrial Credit Union of Whatcom County '
'experienced a significant cybersecurity event '
'involving a third-party partner, Marquis '
"Software Solutions ('Go Marquis'), resulting in "
'the compromise of personally identifiable '
'information (PII) of at least 24,526 Washington '
'residents.',
'impact': {'brand_reputation_impact': None,
'conversion_rate_impact': None,
'customer_complaints': None,
'data_compromised': 'Personally identifiable '
'information (PII)',
'downtime': None,
'financial_loss': None,
'identity_theft_risk': 'High',
'legal_liabilities': None,
'operational_impact': None,
'payment_information_risk': None,
'revenue_loss': None,
'systems_affected': 'Marquis Software Solutions '
'systems'},
'initial_access_broker': {'backdoors_established': None,
'data_sold_on_dark_web': None,
'entry_point': None,
'high_value_targets': None,
'reconnaissance_period': None},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': 'Terminated '
'relationship '
'with affected '
'partner, '
'engaged '
'cybersecurity '
'experts',
'root_causes': 'Third-party vendor '
'system infiltration'},
'ransomware': {'data_encryption': None,
'data_exfiltration': None,
'ransom_demanded': None,
'ransom_paid': None,
'ransomware_strain': None},
'recommendations': 'Offering free one-year subscription to '
'credit monitoring services for affected '
'individuals',
'references': [{'date_accessed': None,
'source': "Washington Attorney General's office",
'url': None}],
'regulatory_compliance': {'fines_imposed': None,
'legal_actions': None,
'regulations_violated': None,
'regulatory_notifications': ['Washington '
'Attorney '
"General's "
'office']},
'response': {'adaptive_behavioral_waf': None,
'communication_strategy': 'Notification to affected '
'individuals, regulatory '
'agencies',
'containment_measures': 'Terminated relationship '
'with affected partner',
'enhanced_monitoring': None,
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes',
'network_segmentation': None,
'on_demand_scrubbing_services': None,
'recovery_measures': None,
'remediation_measures': None,
'third_party_assistance': 'Cybersecurity experts'},
'title': 'Industrial Credit Union of Whatcom County Third-Party '
'Data Breach',
'type': 'Data Breach'}}