---
title: "Mercadien client-data incident"
description: "Suffolk Credit Union disclosed possible exposure of member information at former accounting provider Mercadien following a 2025 incident."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-14"
canonical_url: "https://www.ally.security/incidents/mercadien-client-data-incident-2025"
markdown_url: "https://www.ally.security/incidents/mercadien-client-data-incident-2025.md"
stix_url: "https://www.ally.security/incidents/mercadien-client-data-incident-2025/stix.json"
---

# Mercadien client-data incident

Suffolk reported possible access to data at its former provider and began notifying affected people in September 2026.

Last modified Oct 14, 2026 · 1 source

## Summary

- **Environment:** Mercadien environment containing client-related information
- **Operational impact:** Suffolk said its own computer systems were not compromised
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Suffolk Credit Union](https://www.suffolkcu.org/) disclosed a data-security incident at former provider [Mercadien](https://www.mercadien.com/). Its [notice](https://www.suffolkcu.org/ops/mercadien) says Mercadien detected unauthorized access around November 7, 2025, with possible data access between September 17 and October 9. [1](#source-1)

## Impact

Suffolk said its own systems were not compromised. Potentially involved fields varied by person: names, addresses, birth dates, Social Security numbers, driver’s-license numbers and financial-account numbers. The notice gives no affected-person count. [1](#source-1)

## Timeline

### August 13, 2026 — Review results delivered

Mercadien provided Suffolk with the completed review results. [1](#source-1)

### September 11, 2026 — Individual notices begin

Suffolk began mailing notices to potentially affected people with valid postal addresses. [1](#source-1)

### October 14, 2026 — Briefing updated

This briefing was last reviewed and updated on October 14, 2026.

## Threat Group & Attack Vector

Suffolk’s notice does not establish an entry method, affected platform or attacker. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Suffolk arranged identity-theft protection for people whose Social Security numbers may have been involved. At notice time, it reported no evidence of misuse. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/mercadien-client-data-incident-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Notice of Mercadien Data Security Incident

official · Suffolk Credit Union

<https://www.suffolkcu.org/ops/mercadien>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Potentially affected Suffolk-related information varied by person and included names, addresses, birth dates, Social Security numbers, driver’s-license numbers and financial-account numbers.
2. **Occurred At · 100% confidence · current**  
   Suffolk begins notices: 2026-09-11
3. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Suffolk Credit Union reported that Mercadien detected unauthorized access on or about November 7, 2025 and that data may have been accessed between September 17 and October 9, 2025.
4. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Suffolk said the incident was confined to Mercadien’s environment and did not involve unauthorized access to Suffolk computer systems.
5. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Suffolk begins notices
6. **Affected Organization · 100% confidence · current**  
   Mercadien client-data incident: Mercadien, P.C., CPAs
7. **Occurred At · 100% confidence · current**  
   Supplier review delivered: 2026-08-13
8. **Resulted In · 100% confidence · current**  
   Suffolk begins notices: Suffolk began mailing letters to potentially affected people with valid postal addresses.
9. **Resulted In · 100% confidence · current**  
   Supplier review delivered: Mercadien provided Suffolk with completed review results.
10. **Vendor Of · 100% confidence · current**  
   Mercadien, P.C., CPAs: Suffolk Credit Union
11. **Affected Organization · 100% confidence · current**  
   Mercadien client-data incident: Suffolk Credit Union
12. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Supplier review delivered
13. **Resulted In · 100% confidence · current**  
   Mercadien client-data incident: Suffolk arranged complimentary identity-theft protection for people whose Social Security numbers may have been involved; it reported no evidence of misuse at the time of its notice.

</details>