Skip to content
OriginalSign in
Image: DataBreaches

DataBreachesDissent

FortiBleed exposes 75,000 FortiGate firewalls to credential theft

Part of the FortiBleed story · since 18 Jun

Quiet for 18 weekslast report 2 Jul21 articles9 outlets
18 Jun · SecurityOnline first28 Aug21 SepNowThis article4th of 21
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft. This article, 4th of 21.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
  • Thu 2 Jul, 11:11 UTC. Security Affairs. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.

In mid-June 2026, researchers uncovered the FortiBleed campaign, affecting Fortinet FortiGate firewalls, with an estimated 30,000 to 75,000 devices compromised across 194 countries. Threat actors extracted configuration files and cracked credential hashes, obtaining verified administrator credentials. SOCRadar's research revealed operational infrastructures of the threat group, including databases of validated credentials organized by various factors.

Beaumont and Hudson Rock's analysis indicated that up to 75,000 devices may be impacted, likely due to existing administrator passwords stored with outdated SHA-256 hashes before upgrades to more secure PBKDF2-based mechanisms. This exposes the vulnerability primarily to poor password management rather than flaws in Fortinet's systems.

How the story developed

All 21 articles
Quiet for 18 weekslast report 2 Jul21 articles9 outlets

21 articles from 9 outlets since 18 Jun. Quiet since 2 Jul. This was the 4th report, 10 hours after the first.

Now18 Jun202224262830234First reportSecurityOnline · 18 Jun, 02:30This article4th of 21 · day 0Picked up againafter 8 days quiet
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft. This article, 4th of 21.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
  • Thu 2 Jul, 11:11 UTC. Security Affairs. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Thu 18 JunDay 04
    1. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries02:30 · SecurityOnline · First report
    2. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak07:01 · SOCRadar
    3. FortiBleed leak exposes 75k Fortinet admin passwords online08:10 · Security Affairs
    4. FortiBleed exposes 75,000 FortiGate firewalls to credential theft12:50 · DataBreaches · This article, 4th of 21
  2. Fri 19 JunDay 13
    1. CISA urges action after FortiBleed hits 86k firewalls11:10 · SecurityWeek
    2. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices14:01 · SOCRadar
    3. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns15:06 · The Hacker News
  3. Sat 20 JunDay 23
    1. FortiBleed campaign hits Fortinet devices with password spraying02:20 · Unit 42
    2. FortiBleed attack targets FortiGate SSL VPN worldwide09:31 · Security Affairs
    3. CISA warns of FortiBleed credential leak exposing 74,000 devices09:31 · Security Affairs
  4. Sun 21 JunDay 31
    1. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge18:31 · Security Affairs
  5. Mon 22 JunDay 44
    1. NCSC urges Fortinet users to act after FortiBleed leak08:40 · Infosecurity
    2. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims08:41 · SOCRadar
    3. Fortinet Alerts Users to Massive Credential Harvesting Campaign09:50 · SecurityWeek
    4. Russian hackers steal 110M credentials from 430k FortiGate devices11:30 · Security Affairs
  6. Tue 23 JunDay 53
    1. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab10:32 · SecurityWeek
    2. FortiBleed hits 430k firewalls, stealing 110m credentials13:32 · Dark Reading
    3. FortiBleed steals 110m credentials from FortiGate firewalls20:10 · The Hacker News
  7. Wed 24 JunDay 61
    1. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak10:31 · Security Affairs

  8. Quiet for 8 days

    Thu 2 JulDay 142
    1. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge09:21 · The Hacker News · Picked up again
    2. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices11:11 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in