Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

FortiBleed leak exposes 75k Fortinet admin passwords online

Part of the FortiBleed story · since 18 Jun

Quiet for 19 weekslast report 24 Jun19 articles9 outlets
18 Jun · SecurityOnline first28 Aug21 SepNowThis article3rd of 19
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online. This article, 3rd of 19.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.

A significant cybersecurity breach, dubbed 'FortiBleed,' has revealed admin passwords for approximately 75,000 Fortinet firewalls exposed on the internet. Security researcher Bob Diachenko discovered access to valid Fortinet VPN credentials, which included usernames and plaintext passwords. Kevin Beaumont confirmed the legitimacy of the dataset, indicating that nearly 50% of internet-facing Fortinet devices are affected.

The data, allegedly compiled by a Russian-speaking threat group, suggests systematic exploitation, with over a billion credential attempts recorded. The highlighted risk includes potential remote access to networks, necessitating immediate action from organizations to secure their devices.

How the story developed

All 19 articles
Quiet for 19 weekslast report 24 Jun19 articles9 outlets

19 articles from 9 outlets since 18 Jun. Quiet since 24 Jun. This was the 3rd report, 6 hours after the first.

Now18 Jun19202122232425261 NovFirst reportSecurityOnline · 18 Jun, 02:30
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online. This article, 3rd of 19.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Thu 18 JunDay 04
    1. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries02:30 · SecurityOnline · First report
    2. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak07:01 · SOCRadar
    3. FortiBleed leak exposes 75k Fortinet admin passwords online08:10 · Security Affairs · This article, 3rd of 19
    4. FortiBleed exposes 75,000 FortiGate firewalls to credential theft12:50 · DataBreaches
  2. Fri 19 JunDay 13
    1. CISA urges action after FortiBleed hits 86k firewalls11:10 · SecurityWeek
    2. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices14:01 · SOCRadar
    3. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns15:06 · The Hacker News
  3. Sat 20 JunDay 23
    1. FortiBleed campaign hits Fortinet devices with password spraying02:20 · Unit 42
    2. FortiBleed attack targets FortiGate SSL VPN worldwide09:31 · Security Affairs
    3. CISA warns of FortiBleed credential leak exposing 74,000 devices09:31 · Security Affairs
  4. Sun 21 JunDay 31
    1. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge18:31 · Security Affairs
  5. Mon 22 JunDay 44
    1. NCSC urges Fortinet users to act after FortiBleed leak08:40 · Infosecurity
    2. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims08:41 · SOCRadar
    3. Fortinet Alerts Users to Massive Credential Harvesting Campaign09:50 · SecurityWeek
    4. Russian hackers steal 110M credentials from 430k FortiGate devices11:30 · Security Affairs
  6. Tue 23 JunDay 53
    1. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab10:32 · SecurityWeek
    2. FortiBleed hits 430k firewalls, stealing 110m credentials13:32 · Dark Reading
    3. FortiBleed steals 110m credentials from FortiGate firewalls20:10 · The Hacker News
  7. Wed 24 JunDay 61
    1. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak10:31 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in