SonicWall Breached, Firewall Backup Data Exposed

Security vendor SonicWall confirmed that threat actors breached its cloud backup service for firewalls and accessed backup firewall preference files belonging to fewer than 5% of its install base, exposing encrypted credentials and configuration files that could aid exploitation, according to SonicWall.

Unidentified threat actors were able to access these files via the API service for cloud backup, with SonicWall stating there is no evidence these files have been leaked online or used against impacted customers yet. The breach was described as a “cloud backup file incident” and not a ransomware event, and SonicWall said it immediately disabled access to the backup feature, instituted security improvements, and began a comprehensive investigation with a leading third-party IR and Consulting Firm.

Customers with MySonicWall cloud backups are advised to check their accounts to verify backups and impacted serial numbers, and to follow the dedicated containment, remediation, and monitoring guidance issued by SonicWall. The disclosure was published on 17 September 2025, with the spokesperson noting that impacted customers and partners have been notified. according to SonicWall