SR Bancorp Vendor Mercadien Suffers Data Breach Exposing Somerset Regal Bank Customer Data

Overview

SR Bancorp, the holding company for Somerset Regal Bank, disclosed a data security incident on July 10, 2026, stemming from a compromise at one of its key vendors, Mercadien, P.C. CPAs. Mercadien, which serves as SR Bancorp’s internal audit vendor, experienced unauthorized access to files on its servers containing sensitive customer data belonging to Somerset Regal Bank. The exposed information is highly critical, including names, Social Security numbers (SSNs), account numbers, identification documents, and dates of birth. While SR Bancorp confirmed that its own operational, payment, and core IT systems were not directly involved or disrupted, this third-party breach poses significant risks for affected customers and introduces substantial legal, regulatory, and reputational challenges for SR Bancorp.

Technical Details

The data security incident occurred on Mercadien’s servers, indicating that the threat actor gained unauthorized access to the vendor’s IT environment. The specifics of how this unauthorized access was achieved (e.g., exploitation of a vulnerability, phishing, misconfiguration) have not been publicly detailed. However, the compromise of an internal audit vendor suggests a targeted attack or a significant lapse in Mercadien’s security posture. Internal audit firms often handle highly sensitive client data, including financial records and personally identifiable information, making them attractive targets for cybercriminals. The unauthorized access allowed the exfiltration or exposure of a comprehensive set of customer data, including names, SSNs, account numbers, identification documents, and dates of birth. The fact that the breach originated with a third-party vendor underscores the complex and interconnected nature of modern cybersecurity risks, where an organization’s security is only as strong as its weakest link in the supply chain.

Real-World Impact

The real-world impact of the Mercadien data breach on Somerset Regal Bank customers is considerable. The exposure of Social Security numbers, account numbers, and identification documents places affected individuals at a high risk of identity theft, financial fraud, and other sophisticated scams. Cybercriminals can leverage this combination of data to open new accounts, file fraudulent tax returns, or engage in various forms of impersonation. For SR Bancorp, despite its internal systems remaining uncompromised, the incident carries significant legal and regulatory implications, including potential fines under data protection laws and the cost of responding to numerous customer inquiries and potential lawsuits. The reputational damage to both Somerset Regal Bank and Mercadien is also substantial, as trust in their ability to protect sensitive data is undermined. The bank has currently assessed the financial impact as immaterial, but this could change if the data is widely misused or if extensive legal actions arise.

Threat Landscape

The incident highlights the critical and growing threat of supply chain attacks, where a compromise at a third-party vendor can directly impact an organization’s customers and operations. Financial institutions, in particular, rely on a vast ecosystem of vendors for various services, and each vendor represents a potential entry point for attackers. Cybercriminals frequently target smaller, potentially less-resourced vendors as an easier path to access the more fortified systems of their larger clients. The motivation behind such attacks is typically financial, with the exfiltrated sensitive data being highly marketable on dark web forums. This incident underscores the necessity for robust vendor risk management programs, which include thorough security assessments, continuous monitoring, and clear contractual obligations for data protection and incident response.

Remediation

SR Bancorp is coordinating customer notifications through Mercadien, as required by applicable laws and guidance. For affected Somerset Regal Bank customers, recommended protective steps include:

• Credit Monitoring and Fraud Alerts: Enroll in credit monitoring services and place fraud alerts or security freezes on credit reports to detect and prevent unauthorized activity.
• Account Review: Closely monitor all bank accounts, credit card statements, and other financial accounts for suspicious transactions.
• Identity Theft Vigilance: Be highly vigilant for any signs of identity theft, such as unexpected mail, calls, or attempts to open new accounts in their name.
• Password Hygiene: Change passwords for online banking and other critical financial accounts, and enable multi-factor authentication wherever possible. For SR Bancorp and Mercadien, comprehensive remediation will involve:
• Forensic Investigation: A detailed forensic analysis of Mercadien’s systems to understand the full scope of the breach, the attack vector, and to ensure complete eradication of the threat.
• Security Posture Review: A thorough review and enhancement of Mercadien’s cybersecurity controls, including access management, network security, data encryption, and employee training.
• Vendor Risk Management: SR Bancorp should re-evaluate and strengthen its vendor risk management framework, including more stringent security requirements and regular audits for all third-party service providers.
• Incident Response Plan Activation: Both organizations must effectively execute their incident response plans, focusing on transparent communication with affected customers and regulatory bodies.