FortiBleed Leak Exposes Potentially Valid VPN Credentials for 73,932 Fortinet Devices
Summary
Researchers reported a FortiBleed dataset with credentials for 73,932 Fortinet firewall URLs. Some credentials were verified, but the source of the data and broader claims of compromise remain unconfirmed.
Key points
- Bob Diachenko found an exposed dataset containing Fortinet and FortiGate usernames, email addresses, and passwords.
- Hudson Rock reported 73,932 unique firewall URLs across 194 countries; the data also references 21,632 unique domains.
- Kevin Beaumont independently verified some credentials and said the data appears to come from exported Fortinet configurations; its original source is unknown.
- Diachenko alleged large-scale credential attempts, lateral movement into Active Directory, and compromises at organizations in several countries; those broader claims are not independently confirmed in the article.
- The dataset reportedly includes credentials associated with major companies, government agencies, and critical infrastructure operators.
- Organizations are advised to rotate Fortinet passwords, enforce MFA, review gateway logs, and monitor for exposed employee credentials.
Article Details
- Victim Organization
- Organizations represented in the exposed Fortinet dataset; no single victim organization is identified.
- Incident Type
- Exposure of Fortinet VPN credentials, with a related credential-harvesting and compromise campaign reported by researchers.
- Data Types Exposed
- Usernames
- Email addresses
- Plaintext passwords
- Affected Records
- Hudson Rock reported 73,932 unique firewall URLs across 194 countries and 21,632 unique domains. Kevin Beaumont estimated the dataset covered roughly 75,000 Fortinet devices.
- Operational Impact
- The exposed dataset contained credentials, and Kevin Beaumont said he verified the authenticity of some logins and passwords. Bob Diachenko reported that attackers allegedly used recovered credentials to move laterally into internal Active Directory environments and that multiple organizations were fully compromised. He further alleged that classified documents were stolen from a Turkish NATO defense contractor. These compromise and theft details were not independently confirmed in the article.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsDiachenko alleged that attackers used recovered credentials to move laterally into internal Active Directory environments.T1110 · Brute ForceBob Diachenko reported approximately 1.16 billion credential attempts against FortiGate targets and described a brute-force campaign.T1110.002 · Password CrackingDiachenko alleged that attackers intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis.
People
Kevin BeaumontIndependently reviewed the dataset, said he verified some credentials as authentic, and reported findings about the affected devices.Volodymyr “Bob” DiachenkoDiscovered the exposed server and investigated files found there; he reported the alleged credential-harvesting campaign, compromises, and theft of classified documents.
Vendors
Products
Fortinet FortiGateA newly discovered leak dubbed FortiBleed has exposed what appears to be valid Fortinet and FortiGate VPN credentials for 73,932 firewall URLs across organizations worldwide.FortiOSBeaumont said he verified that multiple organizations listed in the dataset were using valid credentials and observed that many affected devices were running relatively recent FortiOS versions.Microsoft SQL Serverattempts against 320,777 FortiGate targets and an additional 2.1 billion attempts against 163,650 Microsoft SQL Server systems.
Tools
Hashtopolisactors intercepted SSL VPN authentication hashes, cracked them using a 45-GPU cluster managed through Hashtopolis, and used the recovered credentials to move laterally into internal Active Directory environments.ShodanBased on network data from Shodan, Beaumont says the leak contains approximately half of all internet-accessible Fortinet firewalls and said that a majority of the affected devices expose their FortiGate management
Countries
ChileThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.ColombiaThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.IndiaThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.IraqThe researcher also stated that multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedlyJapanThe researcher also stated that multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedlyMalaysiaThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.MexicoThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.TaiwanThe researcher also stated that multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedlyThailandThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.TurkeyThe researcher also stated that multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedlyUnited Arab EmiratesThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.United StatesThe company also released statistics showing that the highest number of affected devices was in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates.VietnamThe researcher also stated that multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly
Industries
Financial ServicesThe most common sectors for the listed companies are telecommunications, IT services, financial services, government organizations, healthcare providers, educational institutions, and manufacturing.GovernmentResearchers say the data may come from exported Fortinet configurations and includes usernames, email addresses, passwords, and details tied to major companies and government entities.HealthcareThe most common sectors for the listed companies are telecommunications, IT services, financial services, government organizations, healthcare providers, educational institutions, and manufacturing.IT servicesThe most common sectors for the listed companies are telecommunications, IT services, financial services, government organizations, healthcare providers, educational institutions, and manufacturing.ManufacturingThe most common sectors for the listed companies are telecommunications, IT services, financial services, government organizations, healthcare providers, educational institutions, and manufacturing.TelecommunicationsThe most common sectors for the listed companies are telecommunications, IT services, financial services, government organizations, healthcare providers, educational institutions, and manufacturing.