Significant Ransomware & Firewall Misconfiguration Breach

The post describes a ransomware attack and data breach at financial-technology provider Marquis in February 2026, attributed to exposed firewall configurations and backup data from legacy SonicWall systems; attackers leveraged accessible configuration artifacts and insufficient monitoring to obtain administrative-like access, map the environment, and deploy ransomware while bypassing traditional alerts. The report emphasizes that set-and-forget perimeter security and unprotected configuration/backups enable patient attackers, and advocates continuous behavioral correlation of firewall, endpoint, and identity signals to detect such compromises earlier.