SonicWall Says All Firewall Backups Were Accessed by Hackers

According to HackRead, SonicWall disclosed in September 2025 a data breach of its cloud backup service, with fewer than 5% of customers affected at the time. The situation escalated when SonicWall and incident response firm Mandiant confirmed that attackers had accessed backup configuration files for every customer using the service. The breach began with a brute force attack targeting the MySonicWall cloud backup API, which stores encrypted firewall configuration files.

These files include detailed network rules, credentials and routing data used to restore or replicate SonicWall firewalls. While the passwords and keys remain encrypted, possession of these files could increase the risk of targeted attacks, according to the investigation. “The investigation confirmed that an unauthorised party accessed firewall configuration backup files for all customers who have used SonicWall’s cloud backup service.

The files contain encrypted credentials and configuration data; while encryption remains in place, possession of these files could increase the risk of targeted attacks.”