Marquis sues SonicWall over ransomware attack

Marquis, a fintech giant based in Plano, Texas, has filed a lawsuit in the U.S. District Court for the Eastern District of Texas against its firewall provider, SonicWall. The lawsuit, filed on Monday, alleges that security failings at SonicWall led to a ransomware attack on Marquis’ network. According to the complaint, a 2025 breach at SonicWall exposed critical security information for Marquis and its customers, allowing unauthorized access to sensitive systems.

The complaint claims that a code change made by SonicWall to one of its APIs in February 2025 created a vulnerability. Marquis alleges that hackers exploited this bug to steal firewall configuration files—the data files defining how a firewall is set up—and emergency “scratch codes,” which are emergency passcodes used to access internal networks. The lawsuit states that “SonicWall allowed a threat actor to obtain the keys to bypass that line of defense and walk right into Marquis’s internal network, the very thing that SonicWall’s firewall was supposed to prevent.”

The timeline of the breach reveals cascading failures. SonicWall first admitted a breach of its systems in mid-September, initially stating that fewer than 5% of its customer firewall configuration backup files were exfiltrated from its storage servers, which are hosted on Amazon’s cloud. However, in October, the firewall maker conceded that every customer had their firewall backup files stolen. Marquis, whose networks were breached in August, began notifying affected individuals in December 2025. According to a listing with the Texas attorney general, at least 400,000 people across the U.S. are known to be affected by the resulting data breach at Marquis.

Satin Mirchandani, the chief executive of Marquis, stated that SonicWall allegedly failed to secure its backup service, which caused the company to suffer “significant reputational, operational, and financial harm.” Mirchandani added that while Marquis secured its network quickly, “our investigation revealed that our exposure to threat actors was due to SonicWall’s network breach and failure to notify us that our firewall protection was potentially compromised.”

Why it matters

This case highlights the systemic risk of third-party security vendors, where a single vulnerability in a firewall provider can cascade into massive data breaches for downstream enterprise clients.