Incident BriefingsMercadien client-data incident

Mercadien client-data incident

Suffolk reported possible access to data at its former provider and began notifying affected people in September 2026.

Last modified

Summary

  • Environment: Mercadien environment containing client-related information
  • Operational impact: Suffolk said its own computer systems were not compromised
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 14, 2026; updated as evidence emerges.

What happened

Suffolk Credit Union disclosed a data-security incident at former provider Mercadien. Its notice says Mercadien detected unauthorized access around November 7, 2025, with possible data access between September 17 and October 9. [1]

Impact

Suffolk said its own systems were not compromised. Potentially involved fields varied by person: names, addresses, birth dates, Social Security numbers, driver’s-license numbers and financial-account numbers. The notice gives no affected-person count. [1]

Timeline

  1. Review results delivered

    Mercadien provided Suffolk with the completed review results.

    [1]

  2. Individual notices begin

    Suffolk began mailing notices to potentially affected people with valid postal addresses.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on October 14, 2026.

Threat Group & Attack Vector

Suffolk’s notice does not establish an entry method, affected platform or attacker. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Suffolk arranged identity-theft protection for people whose Social Security numbers may have been involved. At notice time, it reported no evidence of misuse. [1]