Marquis Sues SonicWall, Alleging Stolen Firewall Backups Enabled Ransomware Attack
Summary
Marquis sued SonicWall, alleging a 2025 cloud-backup breach exposed firewall configurations and scratch codes used in a ransomware attack that accessed customer PII. SonicWall later said backups from all customers were exfiltrated.
Key points
- Marquis filed suit in the U.S. District Court for the Eastern District of Texas, alleging SonicWall’s 2025 cloud-backup breach contributed to a ransomware attack on its network.
- The complaint alleges a February 2025 change to a SonicWall API created a flaw that let attackers access firewall backups without proper authentication by guessing serial numbers.
- According to the complaint, attackers used emergency “scratch codes” in the backups to bypass defenses and enter Marquis’ network.
- Marquis says attackers deployed ransomware, disrupted operations, and accessed PII belonging to customers of some of its financial-institution clients, including financial details and Social Security numbers.
- SonicWall initially said fewer than 5% of customer firewall backup files were stolen, then revised its statement to say backups from every customer were exfiltrated.
- Marquis has not confirmed the number of people affected; a Texas attorney general listing indicates at least 400,000 individuals were impacted.
Article Details
- Victim Organization
- Marquis
- Incident Type
- Alleged ransomware attack and data breach after attackers reportedly used firewall configuration backups stolen from SonicWall's cloud backup service to access Marquis' network.
- Data Types Exposed
- Names
- Dates of birth
- Postal addresses
- Bank account numbers
- Debit and credit card numbers
- Social Security numbers
- Affected Records
- At least 400,000 individuals are indicated as impacted in a Texas attorney general listing; Marquis has not confirmed the total.
- Operational Impact
- The alleged ransomware attack disrupted Marquis' operations and involved unauthorized access to its internal network.
- Ransom Or Extortion
- Unknown
- Claim Status
- alleged