SonicWall Urges Password Resets After Cloud Backup Breach Affecting Under 5% of Customers

SonicWall is urging customers to reset credentials after a cloud backup breach that affected MySonicWall accounts and involved less than 5% of its customers. The company said suspicious activity targeted the cloud backup service for firewalls, with unknown threat actors accessing backup firewall preference files stored in the cloud.

Although credentials within the files were encrypted, the files also included information that could make it easier for attackers to potentially exploit the related firewall, according to SonicWall. The organisation stressed that it is not aware of any of these files being leaked online and said the incident was not a ransomware event targeting its network, but rather a series of brute-force attempts.

Affected customers have been advised to reset passwords and TOTPs saved on the firewall, import fresh preferences files, and to follow containment steps such as limiting WAN access and disabling management interfaces. The disclosure notes that threat actors affiliated with the Akira ransomware group have continued to target unpatched SonicWall devices by exploiting CVE-2024-40766 (CVSS score: 9.3).