BreachWatch™: Blaze Credit Union | Third-Party Vendor Breach (Marquis)

TL;DR

Blaze Credit Union reports a third-party breach tied to Marquis Software Solutions (marketing services). Data including SSNs may have been accessed, impacting ~235,000 members. A multi-month gap between detection and confirmed impact highlights how vendor incidents can expand risk beyond your internal perimeter.

What happened

• Mid-August: Suspicious activity was detected on the vendor’s system.
• ~2+ months later: Impact to Blaze was confirmed.
• Early December: Member notifications were issued.

Why this matters

This is a familiar pattern in third-party incidents:

• A non-“core” vendor can still handle high-risk data (e.g., SSNs) and materially increase exposure.
• Delays in confirmation/disclosure compound downstream work: internal escalation, member comms, remediation, and oversight.
• Vendor self-reporting isn’t enough when timelines are unclear and facts are still emerging.

Key details at a glance

• Incident type: Third-party vendor breach
• Vendor: Marquis Software Solutions (marketing services)
• Data exposed: Names, addresses, dates of birth, Social Security numbers
• Potentially affected: ~235,000 Blaze members
• Notable gap: ~2+ months from detection to confirmed impact
• Aftermath: Member notifications, credit monitoring offered, lawsuits filed, vendor relationship being severed

What teams should do now (fast checklist)

If you have vendors with access to sensitive customer data:

1. Confirm access scope: what data they can access, where it lives, and who can reach it.
2. Re-tier the vendor based on actual data sensitivity (not the vendor’s “category”).
3. Require evidence, not reassurance: timelines, indicators, affected systems, and containment steps.
4. Track communications and decisions in one place for audit-ready defensibility.
5. Pre-plan offboarding so revoking access and collecting attestations isn’t improvised during an incident.

How Perimeter helps (mapped to this scenario)

• Monitor: Continuous vendor signals so you’re not waiting on vendor updates to detect elevated risk.
• Assess: Align vendor tiering and review depth to real access/criticality (especially when SSNs are in play).
• Verify: Validate vendor claims against independent signals and evidence – surface gaps faster.
• Extract + Share: Centralize requests and supporting documentation, reduce back-and-forth, and keep everything searchable.
• Respond: Run structured incident outreach and tracking so time-to-clarity doesn’t drag on.

Bottom line

Blaze’s incident shows how quickly third-party events can become “your” problem – especially when confirmation takes time and sensitive identifiers are involved. The goal isn’t panic. It’s continuous visibility, verified answers, and a faster path to clarity when a vendor situation changes.