Marquis links its ransomware breach to stolen SonicWall cloud firewall backups

Texas-based financial services provider Marquis Software Solutions told customers that its August 2025 ransomware incident—impacting Marquis systems used by dozens of U.S. banks and credit unions—was enabled by a prior compromise of SonicWall’s cloud services. Marquis said its third-party investigation concluded attackers obtained sensitive firewall information from SonicWall and used it to circumvent Marquis’ firewall, leading to theft of customers’ personal and financial data.

Marquis stated it had stored a backup of its firewall configuration in SonicWall’s cloud, and that the stolen configuration/backup data provided the credentials or details needed to facilitate the intrusion. SonicWall had publicly disclosed unauthorized access to its MySonicWall online customer portal / cloud backup service and initially reported that fewer than 5% of customers were affected, later updating that the exposure was broader (including firewall configuration data and related credentials/tokens). Marquis said it is evaluating options with its firewall provider, including seeking recoupment/compensation for incident-response costs incurred by Marquis and its customers.