SonicWall blames state-sponsored hackers for September security breach

SonicWall has attributed the September security breach to state-sponsored hackers, with the incident involving cloud backup files tied to its MySonicWall service. In September the company urged customers to reset credentials after firewall backup files were exposed, and said attackers’ access had been blocked while it worked with cybersecurity experts and law enforcement to determine the scope.

It previously said under 5% of customers were impacted and that no files were leaked; however, on 8 October SonicWall confirmed that threat actors accessed the preference files of all firewalls using its cloud backup service. The company says the stolen files contain encrypted credentials and configurations that could aid attacks, and it is notifying affected users while providing assessment tools.

According to the announcement by SonicWall, Mandiant’s findings indicate the malicious activity – carried out by a state-sponsored threat actor – was isolated to the unauthorized access of cloud backup files via an API call, and the incident is unrelated to ongoing Akira ransomware attacks on firewalls and other edge devices.