Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarYağmur Ernalbant

SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak

Part of the FortiBleed story · since 18 Jun

Quiet for 19 weekslast report 24 Jun19 articles9 outlets
18 Jun · SecurityOnline first28 Aug21 SepNowThis article2nd of 19
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak. This article, 2nd of 19.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.

SOCRadar has launched a free FortiBleed Exposure Checker, allowing organizations to verify if their IP addresses or domains are part of the FortiBleed dataset, which contains possibly compromised Fortinet credentials. The leak is unprecedented, affecting over 26,000 unique Fortinet devices and involving 105 million credentials. SOCRadar emphasizes the need for accurate data interpretation, advising affected organizations to rotate credentials and enforce multi-factor authentication.

An open call has been made to government cybersecurity agencies to collaborate in notifying affected entities. The tool is publicly accessible without signup, promoting transparency and community effort in cybersecurity.

How the story developed

All 19 articles
Quiet for 19 weekslast report 24 Jun19 articles9 outlets

19 articles from 9 outlets since 18 Jun. Quiet since 24 Jun. This was the 2nd report, 5 hours after the first.

Now18 Jun19202122232425261 NovFirst reportSecurityOnline · 18 Jun, 02:30This article2nd of 19 · day 0
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak. This article, 2nd of 19.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Thu 18 JunDay 04
    1. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries02:30 · SecurityOnline · First report
    2. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak07:01 · SOCRadar · This article, 2nd of 19
    3. FortiBleed leak exposes 75k Fortinet admin passwords online08:10 · Security Affairs
    4. FortiBleed exposes 75,000 FortiGate firewalls to credential theft12:50 · DataBreaches
  2. Fri 19 JunDay 13
    1. CISA urges action after FortiBleed hits 86k firewalls11:10 · SecurityWeek
    2. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices14:01 · SOCRadar
    3. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns15:06 · The Hacker News
  3. Sat 20 JunDay 23
    1. FortiBleed campaign hits Fortinet devices with password spraying02:20 · Unit 42
    2. FortiBleed attack targets FortiGate SSL VPN worldwide09:31 · Security Affairs
    3. CISA warns of FortiBleed credential leak exposing 74,000 devices09:31 · Security Affairs
  4. Sun 21 JunDay 31
    1. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge18:31 · Security Affairs
  5. Mon 22 JunDay 44
    1. NCSC urges Fortinet users to act after FortiBleed leak08:40 · Infosecurity
    2. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims08:41 · SOCRadar
    3. Fortinet Alerts Users to Massive Credential Harvesting Campaign09:50 · SecurityWeek
    4. Russian hackers steal 110M credentials from 430k FortiGate devices11:30 · Security Affairs
  6. Tue 23 JunDay 53
    1. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab10:32 · SecurityWeek
    2. FortiBleed hits 430k firewalls, stealing 110m credentials13:32 · Dark Reading
    3. FortiBleed steals 110m credentials from FortiGate firewalls20:10 · The Hacker News
  7. Wed 24 JunDay 61
    1. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak10:31 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in