SonicWall Security Incident: Exposed Backups Could Put Your Firewall at Risk

SonicWall has disclosed a security incident involving the exposure of firewall configuration backup files stored within certain MySonicWall accounts, a breach announced on 18 September 2025. The exposed files contained sensitive configuration data that could greatly increase the risk of compromise if accessed by malicious actors; access to these files could make exploitation of firewalls significantly easier for threat actors, according to SonicWall.

Upon detection, the company said it began an investigation, contained the incident by terminating the unauthorized access point, and is working with law enforcement and select cybersecurity agencies globally. The guidance notes that the incident impacts Firewalls with preference files backed up in MySonicWall[.]com, while customers who did not enable cloud backups are not at risk.

SonicWall provides a step‑by‑step process to determine exposure: log into MySonicWall, verify cloud backups, and check for flagged serial numbers in the account; if flagged, the affected firewalls should follow containment and remediation guidelines. Further guidance will be issued in coming days, and remediation documentation is available through SonicWall Support.