HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDHighContained

Artisans' Bank

bd_5b0f74c39e7a94df · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 28, 2025

Filed

Dec 23, 2025

To disclose

8 weeks

Affected · nationwide

32,3447 in this filing

Linked

4 filings

Confidence

65%

Full breach record for Artisans' Bank →2 incidents on file

Artisans' Bank reported a data breach involving a third-party vendor, Marquis Software Solutions. Unauthorized access occurred on or about August 14, 2025, affecting customer names and Social Security numbers. Artisans' discovered the incident on October 28, 2025, and notified 32,344 individuals (including 7 Maine residents) on December 23, 2025. Credit monitoring services were provided.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 28, 2025 → Filed with AG Dec 23, 202556d ⏱ ME AG >30d8 weeks discovery → filing

Incident timeline

undetected · 75 days

discovery → filing · 8 weeks / 56 days

Aug 14, 2025

Begins

Oct 28, 2025

Discovered

Dec 23, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Part of Marquis Software Solutions, Inc. supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2a028181c0b189162025-12-23Verified
Vermont State AGbd_dc44dcc822fb6cf42025-12-23Verified
Indiana State AGbd_f6b46bd1d66115d02025-12-23Verified

Name: Artisans' Bank
norm: artisans bank
Domain: artisansbank.com
Industry: Financial Services

Name: Artisans' Bank
norm: artisans bank
Domain: artisansbank.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Oct 28, 2025
Breach occurred: Aug 14, 2025
Undetected for: 75 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 23, 2025
Affected individuals: 32,344state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion.
Third party: via Marquis Software Solutions
Initial access: supply_chain

During the incident: Providing access to credit monitoring services for one (1) year, through IDX, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals.
Providing impacted individuals with guidance on how to better protect against identity theft and fraud.
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion.
Changes made: Providing impacted individuals with guidance on how to better protect against identity theft and fraud, including advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank.
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file, information on protecting against tax fraud, the contact details for the national consumer reporting agencies, information on how to obtain a free credit report, a reminder to remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports, and encouragement to contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: ME AG >30d · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 28, 2025
→ Filed with AG: Dec 23, 2025
56d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 28, 2025 → Filed with AG: Dec 23, 2025	56d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGDec 23 · first

Vermont State AGDec 23 · first

Indiana State AGDec 23 · first

Maine State AGDec 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a29d7339-3d2f-45ad-ac42-c397e318d21f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2025
Raw hash: afdc6fd7cc73affaff8c3cb5ebd61e948e48519d2e3fe23f7612242fd1f993e4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityArtisans' Bank

Victim entityArtisans' Bank

Incidentdiscovered Oct 28, 2025

Stated responseProviding access to credit monitoring services for one (1) year, through IDX, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals.

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov