Fintech company Marquis has initiated legal action against firewall provider SonicWall, alleging serious security failures that led to a significant ransomware attack. The lawsuit, filed in the U.S. District Court for the Eastern District of Texas, claims that a 2025 breach of SonicWall’s cloud backup service compromised critical firewall configuration files and emergency passcodes. This breach allegedly enabled hackers to exploit Marquis’ firewall, resulting in malware deployment on its network in August 2025.
The attack impacted at least 400,000 individuals, exposing sensitive personal information including names, birth dates, addresses, Social Security numbers, and financial account details of customers from Marquis’ associated banks and credit unions. Marquis asserts that SonicWall introduced an API vulnerability in February 2025 that permitted unauthorized access to backup files through predictable serial numbers. Initially, SonicWall reportedly downplayed the breach’s scope before subsequently confirming that all customer backup files were accessed.
This case highlights an emerging trend where enterprises are holding their cybersecurity vendors accountable for security lapses, as opposed to solely bearing the financial and reputational damages themselves. Legal experts suggest this could significantly alter the risk dynamics within the industry, prompting increased scrutiny over the vendor selection process, contract terms, and due diligence practices.

Collections

Fintech company Marquis has sued firewall provider SonicWall in U.S. District Court over a 2025 ransomware attack traced to a breach of SonicWall's cloud backup service. The breach, allegedly caused by an API vulnerability introduced in February 2025 that allowed unauthorized access via predictable serial numbers, exposed firewall configuration files and emergency passcodes. Hackers subsequently deployed malware on Marquis' network in August 2025, compromising sensitive data of at least 400,000 individuals. SonicWall initially downplayed the breach before confirming all customer backup files were accessed. Legal experts note this case reflects a growing trend of enterprises holding cybersecurity vendors legally accountable for security failures, which could reshape vendor risk dynamics, contract terms, and due diligence standards across the industry.

Marquis Files Lawsuit Against SonicWall Over Ransomware Breach