Marquis

Summary

Marquis, a fintech firm that supplies data analytics tools to banks and credit unions, experienced a ransomware attack after attackers obtained firewall configuration details from a breach at its security provider, using that information to infiltrate the company’s network and exfiltrate personal and financial data belonging to over 672,000 individuals. The compromised data included names, dates of birth, addresses, Social Security numbers, bank account information, and debit and credit card numbers, enabling potential identity fraud and financial theft. The company subsequently sued the firewall provider, alleging that the exposure of configuration files and delayed disclosure of the breach facilitated the attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Marquis, a fintech company headquartered in Plano, Texas, provides data analytics and marketing services to hundreds of banks and credit unions across the United States, giving it access to extensive personal and financial information belonging to the customers of those institutions. In August 2025, threat actors gained unauthorized access to Marquis’ internal networks and deployed ransomware, an event that the company later identified as a data security incident. Upon discovery, Marquis immediately activated its incident response protocols, which included taking the affected systems offline to prevent further unauthorized access and to preserve evidence for investigation. The company engaged leading third‑party cybersecurity experts to conduct a thorough forensic analysis of the breach and simultaneously notified appropriate law‑enforcement agencies of the incident. Marquis began notifying affected individuals in December 2025, informing them that their personal data had been compromised during the August attack, and it stated that the notification process would continue as additional information became available from state attorney‑general filings. The company emphasized that the intrusion was confined to its own environment and did not extend to the systems of its banking or credit‑union clients.

The data exfiltrated by the attackers included a broad range of personally identifiable and financial details such as full names, dates of birth, residential addresses, telephone numbers, Social Security numbers, taxpayer identification numbers, bank account numbers, debit and credit card numbers, and other financial account information that lacked security or access codes. Marquis disclosed that more than half of the approximately 672,075 individuals whose information was compromised resided in Texas, while the remainder were spread across multiple other states. Specific state filings, such as the submission to the Maine Attorney General’s Office, outlined that the compromised data for Maine residents could include names, addresses, phone numbers, Social Security numbers, taxpayer identification numbers, financial account information without security or access codes, and dates of birth. The stolen information was described as sufficient to enable identity fraud, including the opening of new credit accounts, the acquisition of loans, and the unauthorized use of existing financial accounts. No ransomware group publicly claimed responsibility for the attack, although contemporaneous reporting noted increased activity by the Akira ransomware group targeting SonicWall firewall vulnerabilities around the same period.

Marquis asserted that the breach was facilitated by a prior compromise of its firewall provider, SonicWall, and that the attackers obtained critical firewall configuration files from SonicWall’s cloud backup service, which they then used to map Marquis’ network defenses and bypass security controls. According to Marquis, the attackers accessed encrypted credentials, detailed network architecture, and configuration data tied to customer environments, effectively obtaining a blueprint of the company’s security posture. Marquis claimed that SonicWall had failed to adequately secure its cloud backup infrastructure, allowing the threat actor to exfiltrate firewall configuration files and associated credentials without proper authentication. The company further alleged that SonicWall initially disclosed that fewer than five percent of its customers were affected by the cloud backup breach, but later revised this statement in October 2025 to acknowledge that all customers using the service, including Marquis, had their firewall backup data accessed. Marquis said that this delayed and incomplete disclosure hindered its ability to take timely protective measures after learning of the potential exposure.

In response to the alleged failures of its firewall provider, Marquis filed a lawsuit against SonicWall in February 2026 in the U.S. District Court for the Eastern District of Texas, seeking a jury trial and asserting that SonicWall’s security shortcomings directly enabled the ransomware attack on Marquis’ network. The complaint contended that SonicWall’s alleged vulnerability allowed threat actors to guess predictable firewall serial numbers and gain unauthorized access to customer firewall configuration backup files, including those belonging to Marquis. Marquis’ chief executive stated that the breach caused significant reputational, operational, and financial harm to the company, and that the litigation aimed to recover expenses incurred during the incident response and recovery efforts. SonicWall responded to the lawsuit by requesting evidence from Marquis to substantiate the claimed connection between the SonicWall breach and the ransomware incident, and indicated that it would continue to engage with its customer while maintaining that no new evidence linked the two events.

Throughout the aftermath, Marquis continued to work with external investigators to validate the scope of the breach, review the compromised files, and identify specific individuals whose information had been affected. The company reported that it collaborated with its banking and credit‑union customers to verify mailing addresses and to ensure that notifications reached the appropriate recipients. Marquis maintained that the incident did not affect the systems of its clients, but acknowledged that the stolen data could be used by criminals to commit fraud and identity theft against the individuals whose information had been exfiltrated. The company noted that the total number of affected individuals might increase as additional data breach notices are filed with various state attorneys general, and it indicated that it would continue to update its notifications accordingly. Marquis also disclosed that it had examined whether a missing patch on its own systems could have contributed to the breach, but concluded after third‑party analysis that the specific patch was not exploitable in a manner that would have allowed attackers to access its data. The ongoing legal proceedings and the continued dissemination of breach notices represent the primary developments following the August 2025 ransomware attack on Marquis.

Sources

Sources available to members: 7 sources.