SonicWall Confirms Breach Exposing All Customer Firewall Configuration Backups

SonicWall confirms that an unknown party gained access to all firewall configuration backup files for customers using the MySonicWall cloud backup feature, following a cloud backup security incident. The files contain encoded configuration settings and encrypted credentials, with the credentials themselves protected by AES-256 encryption, though the intruder’s access could aid in crafting targeted attacks against affected networks, according to SonicWall.

The company has updated final lists of impacted devices within the MySonicWall portal, showing entries with an Active-High Priority for internet-facing units, Active-Lower Priority for non-internet-facing units, and Inactive for devices not checking in for over 90 days. SonicWall is notifying impacted partners and customers and providing tools to assess and remediate exposed devices, and all customers are urged to log into MySonicWall to verify whether cloud backups exist for their registered firewalls.

If backup details are present, users should check the Issue List for flagged serial numbers and prioritise remediation starting with Active – High Priority devices, then proceed to Active – Lower Priority devices. A remediation playbook and credential-reset guidance are also available to help containment and recovery.