Lawsuit Claims SonicWall Cloud Backup Flaw Led to Ransomware Attack Against Marquis
Marquis Software Solutions sued SonicWall for allegedly misrepresenting the scope of the breach of its MySonicWall cloud backup service and causing financial and operational harm.
See Also: Why HSMs Are Critical to Digital Asset Security
The Plano, Texas-based marketing and compliance software provider said an attacker used exposed credentials and configuration data from the February 2025 SonicWall cloud breach to conduct a ransomware attack against Marquis in August 2025 and access sensitive client data. This occurred even though Marquis had multifactor authentication and advanced security controls enabled, the firm said.
“SonicWall had reason to know that using predictable device serial numbers created a foreseeable vulnerability that threat actors could – and did – easily exploit,” Marquis wrote in a 35-page complaint. “SonicWall’s reckless use of easy-to-predict, easy-to-brute-force serial numbers constitutes a marked failure to implement reasonable and appropriate security measures to prevent unauthorized disclosure.”
Marquis counts more than 700 banks and credit unions as customers including Artisans’ Bank, based in Wilmington, Delaware, as well as VeraBank, based in Henderson, Texas. In December, the banks notified tens of thousands of customers that their personal data was stolen due to a ransomware group breaching Marquis’ SonicWall firewall (see: More Banks Issue Breach Notifications Over Supplier Breach).
“We are aware of a claim from Marquis alleging a connection between a SonicWall security incident and subsequent ransomware activity affecting their environment,” a SonicWall spokesperson told Information Security Media Group. “At this time, we have not identified any technical evidence establishing a link between these events. Unfortunately, the customer filed a lawsuit without providing documentation to substantiate its allegations in advance. We are reviewing these claims now and are prepared to vigorously defend any unsubstantiated claims.”
How SonicWall Allegedly Introduced an Exploitable Flaw
SonicWall in February 2025 introduced a vulnerability through a code change to its API that enabled unauthorized actors to download firewall configuration backup files without proper authentication. Anyone possessing a firewall device serial number – which the complaint describes as predictable and algorithmically generatable – could retrieve configuration backups, according to Marquis.
“SonicWall had stored customer MFA scratch codes within the configuration backup files without encrypting them,” Marquis wrote in the complaint. “MFA scratch codes within the stolen configurations could be used to bypass MFA requirements in customer firewalls. Exposure of MFA scratch codes poses a clear and substantial risk to a company using MFA in conjunction with its SonicWall firewall.”
Marquis said it opened a support ticket with SonicWall the day it was hit by a ransomware attack but never received meaningful assistance or critical security information in response. Months later, Marquis said SonicWall confirmed that Marquis’s firewall backup files had been downloaded during the February 2025 cloud incident and that the breach had exposed credentials and MFA scratch codes.
“SonicWall’s failure to encrypt the scratch codes is an egregious departure from the normal standard of care expected of a company in SonicWall’s position,” Marquis wrote in the complaint.
Marquis said SonicWall introduced an exploitable vulnerability through an API code change, allowed predictable device serial numbers to serve as access keys to configuration backups, failed to encrypt sensitive elements of configuration files and failed to detect unauthorized access for several months. As a security provider, Marquis said SonicWall is subject to heightened expectations of professional care.
“SonicWall’s breach was an extreme departure from the ordinary standard of care and gross negligence in that SonicWall, a cybersecurity company whose commercial purpose was to protect its customers’ networks – including by selling and servicing firewalls – stored copies of its customers’ firewall configuration data in the cloud, failed to encrypt critical components of that data,” Marquis wrote.
How SonicWall’s Cloud Backup Breach Allegedly Harmed Marquis
Firewall configuration data is uniquely sensitive and contains detailed blueprints of firewall rules, VPN configurations, credential information, SSL certificates and MFA bypass codes. Marquis alleges that SonicWall failed to encrypt MFA scratch codes, prevent brute-force or predictable serial number exploitation or implement proper authentication controls on backup file access.
“The SonicWall Breach has created astounding financial repercussions for Marquis,” Marquis wrote. “These costs have included, but are not limited to, legal costs and costs associated with the ransom demand, the forensic investigation, breach notifications and remediations. In addition to these costs, Marquis has suffered significant commercial and reputational harm.”
Marquis said clients terminated contracts prematurely, refused to pay outstanding amounts, and in some cases, sought return of prepaid fees. Marquis further alleges that a national trade association disinvited it from a conference and refused to allow it to serve as a lead sponsor due to reputational fallout.
“Marquis has suffered significant commercial and reputational harm as a direct result of the SonicWall Breach,” the company wrote. “Marquis has also been named as a defendant in dozens of putative class actions, which seek millions of dollars in damages in relation to the August 14, 2025, incident.”
Marquis alleged that SonicWall failed to exercise reasonable care in safeguarding customer data and detecting the breach, and retained the financial benefits of Marquis’s payments despite failing to provide secure services. Marquis also seeks reimbursement or equitable allocation of liability with SonicWall if judgments are entered against Marquis in the consumer class action lawsuits it faces.
“The SonicWall Breach has created astounding financial repercussions for Marquis,” Marquis wrote. “These costs have included, but are not limited to, legal costs and costs associated with the ransom demand, the forensic investigation, breach notifications and remediations.”