Marquis Discloses Ransomware Breach Affecting 672,000 Banking Customers

Marquis, a Texas-based fintech and services provider to hundreds of U.S. banks, disclosed that an August 2025 ransomware attack exposed the personal and financial data of 672,075 individuals. Stolen information included names, dates of birth, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, and bank, debit, and credit card details. The company said the intrusion disrupted operations at 74 banks, while maintaining that the incident was limited to Marquis systems and did not directly impact customer bank environments.

Reporting indicates the attackers gained access after compromising a SonicWall firewall, and Marquis has alleged in litigation that weaknesses tied to SonicWall allowed threat actors to obtain firewall configuration backup files and use them to breach its network, steal data, and deploy ransomware. The newly filed breach notices provide the clearest accounting so far of the scale of the incident, with a large share of affected individuals located in Texas, and connect the attack to broader concerns around credential and token exposure following SonicWall's earlier security disclosure.