State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack

SecurityWeek reports that SonicWall disclosed a September breach in which a state-sponsored threat actor stole firewall configuration files from its cloud backup service. Initially, the company said exfiltration affected less than 5% of customers, but in an October update it revised the figure to all firewall preference files stored in the cloud backup being stolen.

The stolen files reportedly contained encrypted credentials and configuration data that could enable targeted attacks, prompting SonicWall to urge customers to check their MySonicWall accounts and reset passwords, with containment and remediation guidance issued. SonicWall engaged Mandiant to investigate, and the firm said the incident did not impact SonicWall products or firmware, nor customer networks beyond the cloud backup data.

Mid-October, Huntress warned of a broader campaign targeting SonicWall SSL VPN accounts, using valid credentials in several businesses, though SecurityWeek notes these attacks did not appear linked to the cloud backup incident. The company announced the investigation’s completion in a recent update, and the disclosures were made on 6 November 2025.