SonicWall: 100% of Firewall Backups Were Breached

SonicWall says a breach of its cloud backup service has grown far worse, now affecting 100% of firewall backups after previously being estimated at fewer than 5% of its firewall install base. The incident was first disclosed on 17 September 2025 as a “cloud backup file incident,” with attackers accessing encrypted credentials and firewall configuration files stored in the cloud.

On 8 October 2025, SonicWall updated its knowledge-base article, confirming that an unauthorized party accessed firewall configuration backup files for all customers who used SonicWall’s cloud backup service, and that the breach is being investigated in collaboration with Google Cloud’s Mandiant. Dark Reading reported that the jump from a small initial estimate to full coverage was acknowledged by the company, which declined to comment further beyond the KB details.

The firm emphasised that encrypted credentials and configuration data were involved, that there are no reported in-the-wild follow-on attacks yet, and that affected customers should follow published containment guidance while SonicWall works with partners to notify affected parties and harden its cloud infrastructure. according to Dark Reading