Pinnacle Financial Partners has begun notifying individuals that their personal information may have been compromised as a result of a data breach that occurred not on its own network, but on the network of a third-party service provider. The breach originated at Mercadien, P.C., CPAs, an accounting firm that provided advisory services to Pinnacle and, in that capacity, maintained records containing personal information belonging to Pinnacle’s clients. Companies that share sensitive client data with outside vendors have a responsibility to ensure those vendors protect it just as carefully as they would themselves, and when a third party’s security fails, the company whose customers are affected still owes those customers a clear and timely explanation.
Pinnacle Financial Partners’s Data Breach Investigation
According to the notification letter sent to affected individuals, Mercadien discovered possible unauthorized access to its systems on or around November 7, 2025. Following that discovery, Mercadien engaged cybersecurity specialists, notified law enforcement, and began an investigation to determine the scope of the incident. That investigation determined that an unauthorized person had accessed and acquired certain data between September 17, 2025, and October 9, 2025. Pinnacle has stated that the incident occurred entirely within Mercadien’s network and did not affect Pinnacle’s own systems or files directly.
After Pinnacle was informed of the breach, its team worked with Mercadien to receive the affected data set and cross-reference it against its own client records. On June 16, 2026, Pinnacle determined that personal information belonging to its clients was included among the data Mercadien reported as compromised. Notification letters to affected individuals went out on July 16, 2026, more than eight months after the underlying unauthorized access was first discovered by Mercadien. Mercadien has stated it is not aware of any actual or attempted misuse of the compromised information to date.
Third-party vendor breaches like this one have become an increasingly common way for sensitive financial and personal data to leak, precisely because attackers understand that a single compromised vendor can expose the data of many different client companies at once. Financial institutions in particular route large volumes of client records through accounting firms, payment processors, and other service providers for entirely legitimate business reasons, but each additional party that touches that data is another potential point of failure. Regulators and industry groups have increasingly pushed banks and financial firms to conduct more rigorous oversight of vendor security practices for exactly this reason.
The multi-month gap between Mercadien’s initial detection of unauthorized access in November 2025 and Pinnacle’s confirmation that client data was affected in June 2026 is not unusual in incidents involving forensic review of large, unstructured data sets shared between multiple organizations. Investigators typically need to catalog every file accessed, cross-reference records against each affected company’s own customer database, and legally validate findings before notification can begin, a process that commonly takes many months for complex breaches involving several organizations. That lag, however, means individuals may go a long time without knowing their information has been exposed, during which fraudsters can potentially exploit stolen data undetected.
When Did This Breach Occur?
The underlying unauthorized access to Mercadien’s systems occurred between September 17, 2025, and October 9, 2025. Mercadien discovered the intrusion around November 7, 2025. Pinnacle determined that its client data was involved on June 16, 2026, and notification letters were mailed to affected individuals on July 16, 2026.
What Information Was Breached?
Pinnacle’s notification letter states that the information that may have been involved includes affected individuals’ names and addresses, along with additional personal information that Mercadien maintained in connection with the advisory services it provided to Pinnacle. Pinnacle is offering 12 to 24 months of complimentary credit monitoring and identity protection services through IDX to affected individuals, which suggests the exposed data set may include more sensitive identifiers beyond name and address, though the letter does not specify every data category involved.
What You Can Do
If you received a notification letter from Pinnacle Financial Partners, there are several steps you can take to protect yourself:
- Enroll in the complimentary IDX credit monitoring and identity protection services offered in the notification letter before the enrollment deadline.
- Regularly review your credit reports and account statements for unfamiliar activity.
- Consider placing a fraud alert or security freeze on your credit files with Equifax, Experian, and TransUnion.
- Report any suspicious account activity immediately to your financial institution and to the Federal Trade Commission.
File a Data Breach Lawsuit Against Pinnacle Financial Partners
When a company entrusts your personal information to a third-party vendor, it does not get to walk away from responsibility for keeping that information safe. If you received a notice that your data was exposed through the Pinnacle Financial Partners and Mercadien breach, you may have legal options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
