Old National Bank (see 2025 Report for Marquis Software Solutions) Data Breach — Class Action Review

Old National Bank operates as a prominent financial institution, providing comprehensive banking, wealth management, and lending services to individuals and businesses across multiple states, with a significant operational presence in Indiana. Because of its core function in handling personal finances, mortgages, loans, and investment portfolios, the bank necessarily collects and retains vast repositories of highly sensitive consumer information. This includes government-issued identification numbers, intricate financial account details, credit histories, and deeply personal demographic data required to process transactions, underwrite loans, and comply with strict federal banking regulations. The sheer volume and intrinsic value of the financial data entrusted to Old National Bank make it a prime target for cybercriminals and sophisticated threat actors seeking to monetize stolen identities.

In 2026, Old National Bank reported a security incident to the Indiana Attorney General, highlighting vulnerabilities that potentially compromised the digital infrastructure safeguarding customer data. While exact technical methodologies continue to be evaluated, incidents affecting major financial institutions frequently involve unauthorized access to internal databases, compromise of third-party software vendors such as Marquis Software Solutions, or coordinated cyberattacks exploiting zero-day vulnerabilities. In the financial sector, these breaches often manifest as external threat actors breaching network perimeters or exploiting inadequate encryption protocols, thereby gaining unauthorized entry into environments where sensitive consumer files are stored.

The exposure resulting from this incident encompasses critical categories of personally identifiable and financial information, each carrying severe and long-term risks for affected individuals. Compromised data typically includes full names, Social Security numbers, banking account and routing numbers, dates of birth, and potentially credit or transaction histories. When malicious actors obtain Social Security numbers paired with financial account details, the immediate danger escalates beyond simple phishing to direct financial account takeover, unauthorized wire transfers, fraudulent credit card applications, and complex tax identity theft. This type of exposure strips victims of their financial privacy and forces them to spend countless hours monitoring credit reports, disputing fraudulent charges, and attempting to secure compromised accounts.

As a regulated financial institution, Old National Bank is bound by stringent legal and statutory mandates to safeguard customer data against unauthorized disclosure and cyber threats. Under the Gramm-Leach-Bliley Act (GLBA) and applicable state data protection laws, financial entities must implement robust administrative, technical, and physical safeguards to protect non-public personal information. The occurrence of a data breach of this magnitude serves as a strong indicator of potential systemic failures in maintaining adequate network security, failing to properly vet third-party vendor integrations, or neglecting to deploy timely security patches. Such oversights directly breach the legal duty of care owed to account holders and customers who rely on the institution to protect their most sensitive assets.

Receiving an official data breach notification letter from Old National Bank is both a formal acknowledgment that your private information was compromised and a crucial trigger for legal rights. Under modern legal standards, affected consumers do not need to wait until they experience actual financial loss or identity theft to seek legal recourse; the mere exposure and increased risk of future harm created by the institution's negligence provides the standing necessary to join a class action lawsuit. Our firm is actively investigating potential claims on behalf of individuals impacted by this incident. We evaluate these cases on a contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only recover fees if we successfully secure a financial recovery or settlement on your behalf.