2025 Marquis Software Solutions — ransomware; 672K people across 74 banks (SonicWall vector)
Data compromised
Names, DOB, addresses, phones, SSNs, TINs, and financial account data without access codes
Technical writeup
Marquis Software Solutions, a Texas fintech serving more than 700 U.S. banks and credit unions, disclosed that a ransomware gang stole data belonging to 672,075 individuals in an August 14, 2025 attack that disrupted operations at 74 client institutions. Notification letters filed with state attorneys general in March 2026 confirmed names, dates of birth, addresses, phone numbers, Social Security numbers, taxpayer IDs, and financial account information (without security/access codes) were taken after attackers compromised a SonicWall firewall. Marquis attributed the intrusion to SonicWall’s September 2025 MySonicWall/cloud-backup breach and later sued SonicWall for gross negligence while defending more than 36 consumer class actions.
Root cause
Ransomware after SonicWall MySonicWall/cloud-backup compromise; SonicWall firewall entry point per company notices
References
- https://www.bleepingcomputer.com/news/security/marquis-ransomware-gang-stole-data-of-672-000-people-in-2025-cyberattack/
- https://www.bleepingcomputer.com/news/security/marquis-data-breach-impacts-over-74-us-banks-credit-unions/
- https://www.bleepingcomputer.com/news/security/marquis-blames-ransomware-breach-on-sonicwall-cloud-backup-hack/