
- SonicWall confirms state-sponsored actor accessed cloud backups via API in a targeted breach
- Initially downplayed, the breach ultimately affected all SonicWall customers globally
- No product or firmware compromise occurred; Mandiant is assisting with remediation and hardening
SonicWall has blamed “state-sponsored threat actors” for the cloud backup security breach which hit its services in September 2025.