SonicWall Prompts Password Resets After Firewall Configurations Exposed in Breach

SonicWall has prompted some of its customers to reset their passwords after hackers gained access to their backup firewall preference files stored in a cloud service. The compromised backup files contain encrypted credentials, but the information they store could enable attackers to target the related firewalls, according to SonicWall. The company says less than 5% of its customers were affected and that the hackers did not leak the files online, but action is required as a precaution against potential abuse.

To address the risk, SonicWall has provided fresh preferences files to be imported into the firewalls, which include randomized passwords for all local users, reset bindings where TOTP is enabled, and randomized IPSec VPN keys. Importing the new preferences files may cause IPSec VPN disruptions until new keys are configured and the active firewall will reboot with a failover to the peer firewall during the process. Customers may also choose to perform remediation manually, with guidance for resetting credentials across SonicOS features.