Technology

Data breach exposes 400,000 bank customers’ info

Published

3 weeks ago

December 20, 2025

Data breach exposes 400,000 bank customers’ info

NEWYou can now listen to Fox News articles!

A major data breach tied to U.S. fintech firm Marquis is rippling through banks, credit unions and their customers. Hackers broke into Marquis systems by exploiting a known but unpatched vulnerability in a SonicWall firewall, gaining access to deeply sensitive consumer data.

At least 400,000 people are confirmed to be affected so far across multiple states. Texas has been hit the hardest with more than 354,000 residents affected. That number is expected to rise as additional breach notifications are filed.

Marquis operates as a marketing and compliance provider for financial institutions. The company says it serves more than 700 banks and credit unions nationwide. That role gives Marquis access to centralized pools of customer data, which also makes it a high-value target.

PASSWORD MANAGER FINED AFTER MAJOR DATA BREACH

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

A major data breach tied to fintech firm Marquis exposed sensitive banking and identity data for hundreds of thousands of people. (Kurt “CyberGuy” Knutsson)

What information was stolen in the Marquis cyberattack

According to legally required disclosures filed in Texas, Maine, Iowa, Massachusetts and New Hampshire, hackers accessed a wide range of personal and financial data. Stolen information includes customer names, dates of birth, postal addresses, Social Security numbers and bank account, debit and credit card numbers. The breach dates back to Aug. 14, when attackers gained access through the SonicWall firewall vulnerability. Marquis later confirmed the incident was a ransomware attack.

While Marquis did not publicly name the attackers, the campaign has been widely linked to the Akira ransomware gang. Akira has previously targeted organizations running SonicWall appliances during large-scale exploitation waves. This was not a routine credential leak.

We reached out to Marquis for comment, and a company spokesperson provided CyberGuy with the following statement:

“In August, Marquis Marketing Services experienced a data security incident. Upon discovery, we immediately enacted our response protocols and proactively took the affected systems offline to protect our data and our customers’ information. We engaged leading third-party cybersecurity experts to conduct a comprehensive investigation and notified law enforcement.

“The incident was quickly contained, and our investigation was recently completed. It was determined that an unauthorized third party accessed certain non-public information within our network. However, there is no evidence indicating that any personal information has been used for identity theft or financial fraud. We have notified potentially affected individuals.

“We know our customers place great trust in us, and at Marquis, we take that responsibility seriously by making the protection of their information our highest priority. We are extremely appreciative of the cooperation, understanding, and support of our employees and customers during this time.”

HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

Why the Marquis data breach creates long-term identity risk

When a data breach exposes your full identity, the danger does not disappear after the news cycle ends. Unlike a stolen password, this kind of information cannot be changed, which means the risk can stick around for a long time.

“With a typical credential leak, you reset passwords, rotate tokens and move on,” Ricardo Amper, CEO and Founder of Incode Technologies, a digital identity verification company, tells CyberGuy. “But core identity data is static. You cannot meaningfully change your date of birth or SSN, and once those are exposed, they can circulate on criminal markets for years. The breach is a moment in time, but the exposure it creates can follow people for the rest of their financial lives.”

That is why identity breaches are so dangerous. Criminals can reuse the same stolen data years later to open new accounts, build fake identities or run highly targeted scams that feel personal and convincing. Many attackers now combine this data with AI tools to scale their efforts. As a result, phishing emails, phone calls and even voice impersonations are harder to spot when they reference real details about your bank or account history.

The most likely scams after identity data is stolen

When criminals obtain verified identity data, fraud becomes targeted rather than opportunistic.

“Once criminals get their hands on rich, verified identity data, fraud stops being a guessing game and becomes a targeted execution,” Amper said.

The first major threat is account takeover. With enough personal details, attackers can bypass knowledge-based checks, reset passwords, change contact information and abuse accounts in ways that often look legitimate. The second risk is new account fraud. This includes credit cards, loans, buy now pay later services and even new bank accounts. High-quality data helps these applications pass automated systems and manual reviews.

The fastest-growing threat is synthetic identity fraud. Real data, like a Social Security number, is blended with fabricated details to create a new identity that matures over time before a large financial bust.

“These attacks are hard to catch early because the data being presented is accurate and often reused across multiple institutions,” Amper noted. “If your defenses can’t reliably tell a real human from an AI-generated impersonation, you are starting every decision from a position of disadvantage,” he added.

Why unpatched firewall flaws pose such a serious threat

Ransomware groups like Akira increasingly focus on widely deployed infrastructure to maximize impact. Firewalls sit at the boundary of trusted networks. When one is compromised, everything behind it becomes reachable.

“What we’re seeing with groups like Akira is a focus on maximizing impact by targeting widely used infrastructure. The strategy remains the same: Find a single weak point that gives access to many downstream victims at once,” Amper said.

This approach exposes a persistent blind spot in traditional cybersecurity thinking. Many organizations still assume traffic passing through a firewall is safe.

“When the perimeter device itself is the entry point, static defenses and outdated controls simply can’t keep up,” Amper explained.

Hackers accessed names, Social Security numbers and bank details by exploiting an unpatched firewall vulnerability. (Kurt “CyberGuy” Knutsson)

How long affected consumers should assume risk remains high

Identity data does not expire. Social Security numbers and birth dates stay the same for life.

“When core identity data reaches criminal markets, the risk does not fade quickly,” Amper emphasized. “Fraud rings treat stolen identity data like inventory. They hold it, bundle it, resell it and combine it with information from new breaches.”

Warning signs of misuse can be subtle. These include credit inquiries you did not authorize, account recovery alerts from unfamiliar services or phone calls that convincingly mimic a bank’s verification process using deepfake voice tools.

“The most damaging fraud often starts long after the breach is no longer in the news,” Amper added.

The overlooked impact of identity theft

Financial losses are only part of the damage. Victims often experience a lasting erosion of trust.

Amper says, “The most overlooked consequence is the psychological toll of knowing that you can no longer trust who is contacting you. Deepfake impersonation turns every phone call, video message or urgent request into a potential attack.”

Ways to stay safe after the Marquis data breach

When a breach exposes Social Security numbers, bank details and birth dates, the risk does not end with a password reset. These steps focus on protections that reduce long-term identity misuse and help you detect fraud early.

1) Freeze your credit with all major bureaus

A credit freeze prevents criminals from opening new accounts in your name using stolen identity data. This is critical after the Marquis breach, where full identity profiles were exposed. Freezing credit does not affect your score and can be lifted temporarily when needed. Place a free credit freeze with Equifax, Experian and TransUnion online or by phone. Each bureau must be contacted separately. Once frozen, new credit cannot be opened unless you temporarily lift or remove the freeze using a PIN or account login.

2) Place a fraud alert on your credit file

A fraud alert tells lenders to take extra steps to verify your identity before approving credit. It adds protection if you are not ready to freeze credit everywhere or want an extra layer on top of a freeze. Fraud alerts last for one year and can be renewed. You only need to contact one credit bureau to place a fraud alert. Equifax, Experian or TransUnion will notify the others for you. Fraud alerts are free and last for one year.

3) Enable transaction and account alerts

Turn on alerts for withdrawal, purchase, login attempts and password changes across all financial accounts. Real-time alerts can help you catch account takeovers or unauthorized activity before serious damage occurs.

4) Review bank statements and credit reports regularly

Check statements and credit reports often, even months or years after the breach. Identity data from incidents like this is frequently reused later for delayed fraud. Watch for unfamiliar accounts, hard inquiries or small test charges.

5) Use phishing-resistant two-factor authentication

Text message codes can be intercepted or socially engineered. Where possible, switch to app-based or hardware-backed two-factor authentication. These options are harder for attackers to bypass, even when they know your personal details.

6) Rely on strong device-based biometrics where available

Biometrics tied to your physical device add a layer that criminals cannot easily replicate. Face and fingerprint authentication help block account takeovers driven by stolen identity data or AI-powered impersonation.

7) Use strong antivirus software

Reputable antivirus software helps detect malicious links, fake login pages and follow-up attacks that target breach victims. This adds protection against phishing and ransomware tied to identity-based scams.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

THIRD-PARTY BREACH EXPOSES CHATGPT ACCOUNT DETAILS

8) Consider a data removal service

Data brokers collect and resell personal information that can be combined with breach data to fuel targeted fraud. A data removal service reduces how much of your personal information is publicly available and lowers your exposure over time.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Experts warn this type of identity exposure can fuel fraud and scams for years after the breach is discovered. (Kurt ‘CyberGuy’ Knutsson)

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

9) Add an identity theft protection service

Identity theft services monitor credit files, dark web markets and account activity for signs that your stolen data is being misused. Many also offer recovery assistance in the event of fraud, which can save time and stress when dealing with banks, credit bureaus and government agencies. This monitoring is especially useful after breaches like Marquis, where identity data can resurface long after the initial incident.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

10) Verify unexpected outreach through official channels

Be cautious of urgent calls, emails or texts that reference real banking or personal details. Scammers now use accurate breach data to sound legitimate. Hang up and contact your bank directly using the number on your card or official website.

11) Lock down tax and government accounts

Create or secure online accounts with the IRS, Social Security Administration and your state tax agency. Enable strong authentication and monitor for unexpected notices. Stolen identity data is often used for tax refund fraud or benefit scams long after a breach.

Kurt’s key takeaways

The Marquis data breach highlights how dangerous unpatched infrastructure vulnerabilities have become for the financial sector. When a single vendor holds data for hundreds of institutions, the fallout spreads quickly. For you, identity protection is no longer a one-time response. It is an ongoing necessity that can last years beyond the initial breach.

What questions do you still have about protecting your identity after a major data breach like this one? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:cybercrime Featured Hackers Privacy

Click to comment

Technology

Meta is closing down three VR studios as part of its metaverse cuts

Published

7 hours ago

January 13, 2026

Press Room

Meta is closing down three VR studios as part of its metaverse cuts

Meta is laying off about 10 percent of its Reality Labs metaverse division, and the cuts include closing down some of its VR gaming studios.

Twisted Pixel Games, the developer of Marvel’s Deadpool VR, Sanzaru Games, the developer of the Asgard’s Wrath franchise, and Armature Studio, which worked on the Resident Evil 4 VR port, are all being closed down, according to an internal memo viewed by Bloomberg. The team behind the VR fitness app Supernatural will no longer develop new content or features for it, though the “existing product” will still be supported, Bloomberg says. Meta spokesperson Tracy Clayton confirmed to The Verge that Bloomberg’s reporting is accurate.

Laid off staffers have posted about the closures online.

Meta acquired Supernatural developer Within in 2023 (after a fight with the FTC), Twisted Pixel and Armature in 2022, and Sanzaru in 2020. The company closed Echo VR developer Ready at Dawn, which it also acquired in 2020, in 2024.

In a statement about the broader Reality Labs layoffs, Clayton said that “We said last month that we were shifting some of our investment from Metaverse toward Wearables. This is part of that effort, and we plan to reinvest the savings to support the growth of wearables this year.”

Update, January 13th: Added details from Bloomberg about the studio closures.

Technology

Teen hackers recruited through fake job ads

Published

7 hours ago

January 13, 2026

Press Room

Teen hackers recruited through fake job ads

NEWYou can now listen to Fox News articles!

At first glance, the job posts look completely harmless. They promise fast money, flexible hours and paid training. No experience required. Payment comes in crypto. But these are not tutoring gigs or customer service roles. They are recruiting ads for ransomware operations.

And many of the people responding are middle and high school students. Some posts openly say they prefer inexperienced workers. Others quietly prioritize young women. All of them promise big payouts for “successful calls.”

What they leave out is the risk. Federal charges. Prison time. Permanent records. This underground ecosystem goes by a familiar name. Insiders often refer to it as “The Com,” short for “The Community.”

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

HACKERS ABUSE GOOGLE CLOUD TO SEND TRUSTED PHISHING EMAILS

Fake job ads promising fast cash and flexible hours are quietly recruiting teens into ransomware and extortion schemes, often paying in cryptocurrency to hide criminal activity. (Donato Fasano/Getty Images)

How The Com operates behind the scenes

The Com is not a single organized gang. It functions as a loose network of groups that regularly change names and members. Well-known offshoots tied to this ecosystem include Scattered Spider, Lapsus$, ShinyHunters and related splinter crews. Some groups focus on data theft. Others specialize in phishing or extortion. Collaboration happens when it benefits the operation.

Since 2022, these networks have targeted more than 100 major companies in the U.S. and UK. Victims include well-known brands across retail, telecom, finance, fashion and media, including companies such as T-Mobile, Nike and Instacart. The combined market value of affected companies exceeds one trillion dollars.

Teenagers often take on the riskiest roles within these schemes. Phone calls, access testing and social engineering scripts typically fall to younger participants. More experienced criminals remain in the background, limiting their exposure.

That structure mirrors what identity and fraud experts are seeing across the industry. Ricardo Amper, founder and CEO of Incode Technologies, a digital identity verification company, says fake job ads are effective because they borrow trust from a familiar social contract.

“A job post feels structured, normal and safe, even when the actual behavior being requested is anything but,” Amper said. “A job posting implies a real process – a role, a manager, training and a paycheck. That’s exactly why it works. It lowers skepticism and makes risky requests feel like normal onboarding.”

Amper notes that what’s changed is not just the scale of recruitment, but how criminals package it. “Serious crime is now being sold as ‘work.’”

Why teens excel at social engineering attacks

Teenagers bring a unique mix of skills that make them highly convincing. Fluent English and comfort with modern workplace technology help them sound legitimate. Familiarity with tools like Slack, ticketing systems and cloud platforms makes impersonation easier.

According to Amper, teens don’t need technical expertise to get pulled in. “The on-ramp is usually social, a Discord server, a DM, a ‘quick gig,’” he said. “It can feel like trolling culture, but the targets are real companies and the consequences are real people.”

Risk awareness is often lower. Conversations frequently take place in public chats, where tactics and mistakes are shared quickly. That visibility accelerates learning and increases the likelihood of detection and arrest.

Gaming culture feeds the pipeline

For many teens, it starts small. Pranks in online games turn into account takeovers. Username theft becomes crypto theft. Skills escalate. So do the stakes.

Recruitment often begins in gaming spaces where fast learning and confidence are rewarded. Grooming is common. Sextortion sometimes appears. By the time real money enters the picture, legal consequences feel distant.

Amper compares the progression to gaming itself. “These crews package crime as a ladder,” he said. “Join the group, do small tasks, level up, get paid, get status.”

Why young women are being targeted

Cybercrime remains male-dominated, but recruiters adapt. Young women are increasingly recruited for phone-based attacks. Some use AI tools to alter accents or tone. Others rely on stereotypes. Distress lowers suspicion faster than authority. Researchers say women often succeed because they are underestimated. That same dynamic puts them at risk inside these groups. Leadership remains overwhelmingly male. Girls often perform low-level work. Training stays minimal. Exploitation is frequent.

Red flags that signal fake job scams and ransomware recruitment

These warning signs show up repeatedly in cases involving teen hackers, social engineering crews and ransomware groups.

Crypto-only pay is a major warning sign

Legitimate employers do not pay workers exclusively in cryptocurrency. Crypto-only pay makes transactions hard to trace and protects criminals, not workers.

Per-call or per-task payouts should raise concern

Promises of hundreds of dollars for a single call or quick task often point to illegal activity. Real jobs pay hourly or a salary with documentation.

Recruitment through Telegram or Discord is a red flag

Criminal groups rely on private messaging apps to avoid oversight. Established companies do not recruit employees through gaming chats or encrypted DMs.

Anonymous mentors and vague training are dangerous

Being “trained from scratch” by unnamed individuals is common in ransomware pipelines. These mentors disappear when arrests happen.

Secrecy requests signal manipulation

Any job that asks teens to hide work from parents or employees to hide tasks from employers is crossing a line. Secrecy protects the recruiter, not the recruit.

Amper offers a simple rule of thumb: “If a ‘job’ asks you to pretend to be someone else, obtain access, move money, or share sensitive identifiers before you’ve verified the employer, you’re not in a hiring process. You’re in a crime pipeline.”

He adds that legitimate employers collect sensitive information only after a real offer, through verified HR systems. “The scam version flips the order,” he said. “It asks for the most sensitive details first, before anything is independently verifiable.”

Urgency and emotional pressure are deliberate tactics

Rushing decisions or creating fear lowers judgment. Social engineering depends on speed and emotional reactions.

If you see more than one of these signs, pause immediately. Walking away early can prevent serious legal consequences later.

MICROSOFT TYPOSQUATTING SCAM SWAPS LETTERS TO STEAL LOGINS

Cybercrime recruiters are targeting middle and high school students for risky roles like social engineering calls, exposing them to federal charges and prison time. (Philip Dulian/picture alliance via Getty Images)

Law enforcement is cracking down on teen cybercrime

Since 2024, government indictments and international arrests have shown cybercriminal groups tied to The Com and Scattered Spider are under increasing scrutiny from law enforcement. In Sept. 2025, U.S. prosecutors unsealed a Department of Justice complaint against 19-year-old Thalha Jubair, accusing him of orchestrating at least 120 ransomware and extortion attacks that brought in over $115 million in ransom payments from 47 U.S. companies and organizations, including federal court networks. Prosecutors charged Jubair with computer fraud, wire fraud and money laundering conspiracy.

Across the Atlantic, British authorities charged Jubair and 18-year-old Owen Flowers for their alleged roles in a Transport for London cyberattack in 2024 that compromised travel card data and disrupted live commuter information. Both appeared in court under the U.K.’s Computer Misuse Act. Earlier law enforcement action in the U.S. included criminal charges against five Scattered Spider suspects for mass phishing campaigns that stole login credentials and millions in cryptocurrency, laying out how members of this collective staged coordinated extortion and data theft.

Federal agencies are also issuing advisories about the group’s social engineering techniques, noting how attackers impersonate help desks, abuse multi-factor authentication and harvest credentials to access corporate networks.

Parents often learn the truth late. In many cases, the first warning comes when federal agents arrive at the door. Teens can move from online pranks to serious federal crimes without realizing where the legal line lies.

How parents and teens can avoid ransomware recruitment traps

This type of cybercrime thrives on silence and speed. Slowing things down protects families and futures.

Tips for parents and guardians to spot fake job scams early

Parents play a critical role in spotting early warning signs, especially when online “work” starts happening behind closed doors or moves too fast to explain.

1) Pay attention to how online “jobs” are communicated

Ask which platforms your child uses for work conversations and who they talk to. Legitimate employers do not recruit through Telegram or Discord DMs.

2) Question sudden income with no clear employer

Money appearing quickly, especially in crypto, deserves scrutiny. Real jobs provide paperwork, supervisors and pay records.

3) Treat secrecy as a serious warning sign

If a teen is told to keep work private from parents or teachers, that is not independence. It is manipulation.

4) Talk early about legal consequences online

Many teens do not realize that cybercrime can lead to federal charges. Honest conversations now prevent life-changing outcomes later. Also, monitoring may feel uncomfortable. However, silence creates more risk.

Tips for teens to avoid fake job offers and cybercrime traps

Teenagers with tech skills have real opportunities ahead, but knowing how to spot fake offers can mean the difference between building a career and facing serious legal trouble.

1) Be skeptical of private messages offering fast money

Real companies do not cold-recruit through private chats or gaming servers.

2) Avoid crypto-only payment offers

Being paid only in cryptocurrency is a common tactic used to hide criminal activity.

3) Choose legal paths to build skills and reputation

Bug bounty programs, cybersecurity clubs and internships offer real experience without risking your future. Talent opens doors. Prison closes them.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com

FBI WARNS OF FAKE KIDNAPPING PHOTOS USED IN NEW SCAM

A loose cybercrime network known as “The Com” has been linked to major U.S. and U.K. data breaches affecting companies worth trillions combined. (Photo by Uli Deck/picture alliance via Getty Images)

Kurt’s key takeaways

What makes this trend so unsettling is how ordinary it all looks. The job ads sound harmless. The chats feel friendly. The crypto payouts seem exciting. But underneath that surface is a pipeline pulling teenagers into serious crimes with real consequences. Many kids do not realize how far they have gone until it is too late. What starts as a quick call or a side hustle can turn into federal charges and years of fallout. Cybercrime moves fast. Accountability usually shows up much later. By the time it does, the damage is already done.

If fake job ads can quietly recruit teenagers into ransomware gangs, how confident are you that your family or workplace would spot the warning signs before it is too late? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Technology

Fired Rockstar employees’ plea for interim pay denied

Published

19 hours ago

January 13, 2026

Press Room

Fired Rockstar employees’ plea for interim pay denied

A UK employment tribunal rejected a request from fired Rockstar Games employees to receive interim pay while waiting for a full hearing about their dismissal, according to Bloomberg and IGN. After Rockstar fired 34 employees last year — 31 from the UK and three from Canada — the Independent Workers’ Union of Great Britain (IWGB) accused the company of “union busting.” Rockstar claims that the fired employees were leaking company information in a Discord channel.

The hearing took place over two days last week. “Despite being refused interim relief today, we’ve come out of last week’s hearing more confident than ever that a full and substantive tribunal will find Rockstar’s calculated attempt to crush a union to be not only unjust but unlawful,” IWGB president Alex Marshall says in a statement. “The fact that we were granted this hearing speaks to the strength of our case and, over the course of the two-day hearing, Rockstar consistently failed to back up claims made in the press or to refute that they acted unfairly, maliciously, and in breach of their own procedures.”

“We regret that we were put in a position where dismissals were necessary, but we stand by our course of action as supported by the outcome of this hearing,” a Rockstar Games spokesperson says in statements to Bloomberg and IGN. Rockstar and owner Take-Two didn’t immediately reply to a request for comment.

Rockstar is working on Grand Theft Auto VI, which was recently delayed from a planned May launch to November 19th.