SonicWall warns customers to reset credentials after MySonicWall backups were exposed

SonicWall has urged customers to reset credentials after backup files for MySonicWall were exposed, with the company saying it blocked attackers’ access and is working with cybersecurity experts and law enforcement to determine the breach’s scope. In its statement, SonicWall said threat actors accessed cloud backup files for fewer than 5% of its firewall install base, and that while credentials within the files were encrypted, the information could still help attackers exploit the related firewall.

The incident affected SonicWall Firewalls with preference files backed up in MySonicWall[.]com, and SonicWall advised affected customers to log into their MySonicWall accounts to check if cloud backups are enabled; if not, there is no risk, but if yes, they should look for flagged serial numbers indicating affected devices. Importing newer preference files was suggested, though doing so can disrupt IPSec VPNs, TOTP bindings, and user access, so SonicWall recommends performing the import during maintenance windows.

For remediation, customers must manually reset credentials in SonicOS, following the guidance provided by the company. This update was published on 18 September 2025.