Merchants Bank Data Breach — Class Action Review

Merchants Bank operates as a trusted financial institution, providing essential banking services, commercial loans, mortgages, and wealth management solutions to individuals, families, and businesses throughout Indiana and the surrounding region. Because of their central role in the financial lives of their customers, banks and lending institutions maintain vast repositories of deeply sensitive personal and economic information. To open accounts, process loan applications, and facilitate daily transactions, Merchants Bank necessarily collects and stores confidential financial records, government-issued identification details, and private communications, making their digital infrastructure a high-value target for malicious actors seeking to monetize stolen data.

In 2025, Merchants Bank formally reported a significant data security incident to the Indiana Attorney General, alerting account holders and regulatory authorities that unauthorized parties had infiltrated their network environment. While the exact vector of the compromise—whether driven by a sophisticated ransomware deployment, an exploited software vulnerability, or a third-party vendor failure—remains part of ongoing investigations, breaches impacting financial institutions typically involve unauthorized exfiltration of internal databases containing confidential customer files. These incidents expose structural vulnerabilities in how financial entities monitor their networks, isolate critical databases, and maintain adequate safeguards against modern, persistent cybercriminal syndicates.

The data exposed in a financial institution breach frequently includes full names, Social Security numbers, dates of birth, bank account and routing numbers, credit scores, loan application details, and login credentials. The exposure of this combination of data creates severe, immediate risks for victims, extending far beyond simple annoyance. Cybercriminals can leverage compromised Social Security numbers and financial account details to execute unauthorized wire transfers, open fraudulent lines of credit in the victim's name, take over existing bank accounts, and intercept tax refunds. This level of exposure leaves individuals vulnerable to multi-faceted financial fraud that can take years, and significant emotional distress, to fully resolve.

As a regulated financial institution handling non-public personal information, Merchants Bank was bound by rigorous legal and regulatory mandates, most notably the Gramm-Leach-Bliley Act (GLBA) and the Federal Trade Commission (FTC) Act. The GLBA explicitly requires financial institutions to implement comprehensive administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records. A data breach of this magnitude serves as prima facie evidence that the institution failed to maintain reasonable security measures, potentially violating statutory duties to encrypt sensitive data, maintain robust access controls, and continuously monitor network traffic for suspicious activity.

Receiving an official data breach notification letter from Merchants Bank is a formal admission that your private financial information was compromised due to inadequate security practices, and it establishes the legal standing necessary to participate in a class action lawsuit. Affected individuals should know that under modern data privacy jurisprudence, the increased and imminent risk of identity theft constitutes a compensable injury, meaning you do not have to wait until unauthorized charges appear on your statement to take legal action. Our firm evaluates these cases on a strict contingency fee basis, ensuring that victims can hold Merchants Bank accountable without paying any out-of-pocket costs or legal fees unless we successfully recover compensation on your behalf.