SonicWall cloud backup theft and Marquis downstream intrusion

**SonicWall** said a **state-sponsored threat actor** stole **firewall configuration backup files** from its **MySonicWall cloud backup service** in a **September** security breach. The exposed **.EXP** backups contained **AES-256-encrypted credentials** and configuration data, and SonicWall said the incident was isolated to an **API call** in a specific cloud environment. The company completed its investigation with **Mandiant**, notified impacted customers and partners, and said the breach was **unrelated to Akira ransomware** and did **not impact SonicWall products or firmware**.

**Marquis Software Solutions** disclosed that its **August 14, 2025** ransomware attack exposed personal data tied to **74 U.S. banks and credit unions** and affected **over 400,000 customers**. The company says attackers breached its network through a **SonicWall firewall** and stole files containing information received from business customers. Marquis says there is **no evidence of misuse or publication** of the data at this time. The incident remains centered on a victim-focused breach of a financial software provider and the downstream impact on its banking and credit union customers.

**SonicWall** said a **state-sponsored threat actor** was behind the **September** compromise of its **MySonicWall cloud backup service**, where firewall configuration backup files were stolen. SonicWall said the activity was **isolated to an API call** against a specific cloud environment, and that the stolen files contained **encrypted credentials and configuration data** that could help attackers launch targeted attacks against related firewalls. The company said the incident was **not linked to Akira ransomware**, did **not impact SonicWall products or firmware**, and Mandiant completed the investigation.