Hackers Access SonicWall Cloud Firewall Backups, Spark Urgent Security Checks

According to SonicWall, on 9 October 2025 an unauthorized party accessed firewall configuration backup files for all customers that used the cloud backup service. The company said the files contain encrypted credentials and configuration data, and while encryption remains in place, possession of these files could increase the risk of targeted attacks.

SonicWall noted it is working to notify all partners and customers and has released tools to assist with device assessment and remediation, urging users to log in to MySonicWall[.]com and check their devices. The development follows SonicWall’s earlier call for customers to reset credentials after backup files were exposed in a security breach affecting MySonicWall accounts.

The company previously stated that threat actors accessed backup firewall preference files stored in the cloud for less than 5% of customers, while emphasising that the credentials were encrypted but could still help attackers exploit the related firewall. Users are advised to verify cloud backups, identify impacted serial numbers, follow containment and remediation guidelines for listed firewalls, and await further guidance for cases with partial or no serial numbers shown.