Ransomware Attack 2026: How NIS2 and DORA Compliance Can Prevent Financial Data Breaches

The Rising Threat of Ransomware Targeting Financial Data

In an increasingly digital financial ecosystem, ransomware attacks have evolved from disruptive nuisances to sophisticated threats targeting sensitive personal and financial data. The incidents at Marquis Software Solutions and Brightly Software serve as stark reminders that no organization—whether a direct financial institution or a critical third-party vendor—is immune. These attacks not only compromise data security but also expose significant regulatory compliance gaps, particularly under emerging EU frameworks like the NIS2 Directive and the Digital Operational Resilience Act (DORA). As financial data becomes a prime target for cybercriminals, understanding the intersection of cybersecurity incidents and regulatory obligations is paramount for compliance leaders.

Summary of Recent Incidents: Marquis and Brightly

The ransomware attack on Marquis Software Solutions, a provider of marketing and compliance technology to financial services firms, resulted in the theft of personal and financial information belonging to 672,075 bank customers. This breach underscores the cascading risk posed by third-party vendors in regulated sectors, where a single vulnerability can expose sensitive data across multiple institutions.

Similarly, the data extortion scheme at Brightly Software, a SaaS company acquired by Siemens, involved a former data analyst contractor who stole sensitive employee data—including personally identifiable information (PII) and payroll details—and demanded a $2.5 million ransom. The perpetrator threatened to report the company to the SEC for failing to disclose the breach, highlighting the dual threat of data theft and regulatory exposure. This case, along with a separate breach in May 2023 affecting nearly 3 million SchoolDude customers, illustrates the persistent risk of insider threats and inadequate data security controls.

Regulatory Implications Under NIS2 and DORA

These incidents reveal critical vulnerabilities that fall squarely within the scope of EU cybersecurity regulations. The NIS2 Directive (Directive (EU) 2022/2555), with a member state transposition deadline of 17 October 2024, expands the original NIS Directive to cover "essential" and "important" entities across 18 sectors, including digital infrastructure and ICT service management—categories that likely encompass vendors like Marquis and Brightly. Key requirements under NIS2 include:

• Risk Management Measures: Organizations must implement appropriate technical and organizational measures to manage cybersecurity risks, which the attacks suggest were insufficient at both companies.
• Incident Reporting: NIS2 mandates a 24-hour early warning and a 72-hour notification for significant incidents. The delays in detecting and disclosing these breaches—such as the eight-day discovery gap in Brightly's 2023 incident—could lead to non-compliance penalties of up to EUR 10 million or 2% of global turnover for essential entities.
• Supply Chain Security: The Marquis attack emphasizes the need for robust third-party risk management, a core component of NIS2's focus on securing the digital supply chain.

For financial entities, DORA (Regulation (EU) 2022/2554), applicable from 17 January 2025, imposes even stricter requirements. It applies to banks, insurers, investment firms, and payment institutions, as well as their critical third-party providers like Marquis. DORA mandates:

• ICT Risk Management Framework: Financial entities must establish a comprehensive framework to ensure digital operational resilience, including protocols to prevent and respond to ransomware attacks.
• Incident Reporting: Similar to NIS2, DORA requires timely reporting of major ICT-related incidents, with the Brightly extortion threat underscoring the regulatory risks of non-disclosure.
• Third-Party ICT Risk Management: Financial institutions must ensure that their vendors, such as Marquis, adhere to stringent cybersecurity standards, making vendor due diligence a compliance imperative.

Both regulations emphasize management accountability and proactive risk assessment—areas where these incidents revealed significant gaps. For example, the insider threat at Brightly points to failures in access controls and monitoring, which are addressed under NIS2's risk management measures and DORA's operational resilience requirements.

Practical Steps to Strengthen Cybersecurity Posture

To mitigate risks and ensure compliance with NIS2, DORA, and other frameworks, organizations should adopt a multi-layered approach:

1. Conduct Regular Risk Assessments: Align with NIST Cybersecurity Framework (CSF) 2.0, published 26 February 2024, which introduces a new Govern function to integrate cybersecurity into overall risk management. Regular assessments can identify vulnerabilities like those exploited in the Marquis and Brightly attacks.
2. Implement Robust Incident Response Plans: Develop and test incident response protocols to meet NIS2 and DORA reporting timelines. This includes early detection mechanisms to avoid delays, as seen in Brightly's 2023 breach.
3. Enhance Third-Party Risk Management: Vet vendors thoroughly using frameworks like ISO/IEC 27001:2022, which offers certifiable controls for information security management. Ensure contracts mandate compliance with relevant regulations to prevent cascading breaches.
4. Leverage Advanced Monitoring Tools: Deploy security information and event management (SIEM) systems and endpoint detection and response (EDR) solutions to monitor for suspicious activities, such as insider threats or ransomware indicators.
5. Train Employees on Cybersecurity Awareness: Address insider risks through regular training on data handling and threat recognition, as human error often contributes to breaches.

For financial entities, DORA additionally requires digital operational resilience testing, including threat-led penetration testing, to simulate attacks like ransomware and validate defenses.

Integrating AIGovHub for Real-Time Compliance Intelligence

Navigating the complex landscape of NIS2, DORA, and other cybersecurity regulations requires continuous monitoring and adaptive strategies. AIGovHub's platform offers real-time compliance intelligence and vendor assessments to help organizations stay ahead of threats. Key features include:

• Regulatory Tracking: Stay updated on evolving requirements, such as NIS2 implementation across EU member states or DORA's applicability deadlines.
• Vendor Risk Assessments: Evaluate third-party providers against compliance benchmarks to prevent incidents like the Marquis breach.
• Incident Reporting Tools: Streamline compliance with NIS2 and DORA reporting obligations through automated workflows and documentation.

By integrating AIGovHub's cybersecurity modules, enterprises can proactively manage risks, ensure regulatory adherence, and protect sensitive financial data from emerging threats. Explore our cybersecurity compliance tools to enhance your defense strategy.

Key Takeaways

• Ransomware attacks on vendors like Marquis Software Solutions and insider threats at companies like Brightly Software highlight critical cybersecurity gaps in regulated industries.
• These incidents expose vulnerabilities under EU regulations: NIS2 requires risk management and incident reporting within strict timelines, while DORA mandates digital operational resilience for financial entities and their third-party providers.
• Non-compliance can result in significant penalties—up to EUR 10 million or 2% of global turnover under NIS2—and regulatory scrutiny, as evidenced by the SEC threat in the Brightly case.
• Practical steps include conducting risk assessments, implementing incident response plans, enhancing third-party risk management, and leveraging monitoring tools to prevent breaches.
• AIGovHub's platform provides real-time compliance intelligence and vendor assessments to help organizations meet NIS2, DORA, and other cybersecurity requirements effectively.

Ready to assess your cybersecurity compliance? Request a free compliance audit or schedule a demo of AIGovHub's cybersecurity modules to safeguard your organization against ransomware attacks and data breaches.

This content is for informational purposes only and does not constitute legal advice.