SonicWall Firewall Backups Stolen by Nation-State Actor

The SonicWall breach centered on the MySonicWall cloud backup service, with attackers stealing firewall configuration files and, later, access expanding to all customers who used the cloud backup. The company had previously described the incident as the result of a series of brute-force attacks affecting fewer than 5% of customers, but an incident response investigation with Google Cloud’s Mandiant later found that firewall configuration backup files were accessed for all customers of the cloud backup service.

SonicWall said the intrusion was carried out via an API call and that the attack was limited to the cloud backup service, with no impact on other products, production networks, customer data, or the broader SonicWall environment. The firm also stressed that the breach is unrelated to ongoing Akira ransomware campaigns and that, according to the spokesperson, there is no evidence that the stolen data has been used by threat actors.

The company noted that the attack vector was “immediately mitigated” and that Mandiant’s findings confirmed the state-sponsored nature of the activity, though some questions about how the breach occurred remain. SonicWall has since launched two security initiatives and emphasised a commitment to a zero-trust architecture to bolster its defenses.