CISA Urges Fortinet Users to Secure Devices After FortiBleed Credential Leak
Summary
CISA urged Fortinet customers to secure devices after a leak exposed credentials associated with about 74,000 firewalls and VPN gateways. Some credentials were independently validated, but the data source and exposure method remain unknown.
Key points
- The FortiBleed dataset reportedly contained usernames, email addresses, plaintext passwords, and organization details for 73,932 Fortinet firewall URLs.
- CISA said threat actors used compromised credentials to target internet-accessible Fortinet devices across government and private-sector organizations.
- Security expert Kevin Beaumont independently confirmed some credentials; he said most affected devices remained online.
- The source of the configuration data is unknown, and it is unclear whether it came from exploitation, another security flaw, or a different method.
- CISA advised terminating SSL VPN and administrative sessions, resetting passwords, enabling phishing-resistant MFA, and reviewing logs for unauthorized access or lateral movement.
- CISA also recommended using PBKDF2 for administrator credentials, restricting public access to management interfaces, and removing unauthorized accounts.
Article Details
- Victim Organization
- Fortinet customers and organizations with affected Fortinet devices worldwide; no single victim organization was identified.
- Incident Type
- Exposure of Fortinet device credentials, followed by reported targeting of internet-accessible devices using compromised credentials.
- Data Types Exposed
- Usernames
- Email addresses
- Plaintext passwords
- Organization industry, revenue, and employee count
- Affected Records
- Credentials associated with 73,932 firewall URLs; CISA described approximately 74,000 Fortinet devices.
- Operational Impact
- The leaked credentials were reportedly used to target internet-accessible Fortinet devices. Kevin Beaumont said most affected devices remained online. No specific service disruption was reported.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Kevin BeaumontCybersecurity expert who independently confirmed the authenticity of some credentials and said most affected devices remained online.Volodymyr “Bob” DiachenkoSecurity researcher who discovered an exposed server containing what appeared to be valid Fortinet VPN credentials and reported details about the dataset.
Vendors
Products
Countries
ChileThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.ColombiaThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.IndiaThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.MalaysiaThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.MexicoThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.TaiwanThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.ThailandThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.TurkeyThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.United Arab EmiratesThe highest number of affected devices were from India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers to secure their devices after nearly 74,000 firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed.”
Industries
Critical infrastructureFoxconn, Chevron, Comcast, AT&T, and Toyota, along with many government agencies and critical infrastructure operators across telecommunications, healthcare, financial services, and manufacturing industryFinancial Servicesgovernment agencies and critical infrastructure operators across telecommunications, healthcare, financial services, and manufacturing industry sectors.GovernmentThis warning comes after threat actors used compromised credentials to target internet-accessible Fortinet devices across government and private-sector organizations worldwide.Healthcarealong with many government agencies and critical infrastructure operators across telecommunications, healthcare, financial services, and manufacturing industry sectors.Manufacturingand critical infrastructure operators across telecommunications, healthcare, financial services, and manufacturing industry sectors.TelecommunicationsAT&T, and Toyota, along with many government agencies and critical infrastructure operators across telecommunications, healthcare, financial services, and manufacturing industry sectors.