Marquis Ransomware: 672K Affected
Fintech firm Marquis disclosed a ransomware attack that exposed personal and financial data for roughly 672,000 people — another large breach feeding downstream fraud and identity reuse. The scale adds fuel to SIU and onboarding risk models that already face pressure from mass breaches and credential leaks. (techcrunch.com)
The intrusion on Marquis’s network was traced to activity on August 14, 2025, according to company and industry disclosures that place the initial compromise in mid‑August 2025. (govinfosecurity.com) Multiple state breach notices and vendor filings list at least 74 banks and credit unions whose customer records were accessed through the incident. (bleepingcomputer.com) Marquis filed suit against SonicWall in the U.S. District Court for the Eastern District of Texas in late February 2026, alleging a cloud backup breach at SonicWall exposed firewall configurations that enabled the August ransomware operation (Case No. referenced in filings). (cyberpress.org) Separately, more than 30 consumer class‑action complaints and investigations were initiated against Marquis and some client institutions in the months after the breach, with law firms soliciting plaintiffs and multiple federal cases filed in Texas. (netcrook.com) Security researchers and U.S. cybersecurity trackers linked exploitation activity to a known SonicWall flaw tracked as CVE‑2024‑40766, and reporting flagged Akira‑style ransomware campaigns as leveraging that weakness in 2024–2025. (thehackernews.com) Marquis began sending regulatory notifications in late 2025, offered complimentary credit‑monitoring and identity‑theft protection through third‑party providers such as Epiq/IDX, and documented remediation steps including firewall patching, enforcing multifactor authentication, geo‑IP filtering, account rotation and deployment of endpoint detection and response tools. (claimdepot.com)
