Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

Threat actors stole firewall configuration backups from SonicWall’s MySonicWall cloud backup service, impacting all SonicWall Cloud Backup users. The breach occurred in early September, when SonicWall urged customers to reset credentials after backup files linked to MySonicWall accounts were exposed, and the company later said attackers had gained access but initially claimed under 5% of customers were affected with no files leaked.

On 8 October, SonicWall disclosed that threat actors accessed the preference files of all firewalls using its cloud backup service, and the stolen files contain encrypted credentials and configurations that could assist attacks. The firm has since notified affected users and released assessment tools, with updated device lists classifying impacted devices by priority to guide remediation.

SonicWall said it is working with cybersecurity experts and law enforcement agencies, and that the investigation, conducted in collaboration with leading IR Firm Mandiant, confirmed unauthorized access to firewall configuration backup files for all customers. Users are advised to check their MySonicWall accounts for flagged devices and to reconfigure VPN keys and TOTP as part of remediation, ideally during maintenance windows. According to Mandiant, SonicWall has strengthened security and is continuing monitoring across its cloud infrastructure.