A credential exposure event of extraordinary scale is unfolding across the global network security landscape. Researchers have confirmed the leak of valid authentication data tied to approximately 74,000 Fortinet firewall and VPN gateway deployments — a dataset so broad it reportedly covers nearly half of all Fortinet devices currently exposed to the public internet. Federal authorities have responded with urgency, and the window for defensive action is narrowing fast.
What Happened: A Leak Unlike Anything Before It
The incident, now widely referred to as FortiBleed, came to light when a security researcher discovered an unsecured internet-facing server hosting what appeared to be a trove of working Fortinet VPN credentials — plaintext passwords, usernames, and email addresses belonging to tens of thousands of organizations across 194 countries. The find was quickly validated by independent researchers and cross-referenced with live infrastructure, producing a disturbing conclusion: the credentials work, the devices are largely still online, and attackers are already using them.
The U.S. Cybersecurity and Infrastructure Security Agency moved swiftly, publishing an emergency advisory confirming that malicious actors had been observed leveraging the compromised credentials to target internet-accessible Fortinet appliances across both government and private-sector environments.
"This activity involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network gateways," CISA stated in its advisory, urging immediate remediation across all affected sectors.
What separates FortiBleed from prior Fortinet-related incidents is the nature and depth of the data itself. The leaked information does not appear to be the product of simple credential interception or phishing. Researchers who examined the dataset found evidence that the records were sourced from full device configuration exports — files that can only be generated from within the device itself. That distinction is critical: it implies the threat actors had, at some point, actual administrative access to these appliances.
Scale and Scope: A Who's Who of Global Enterprise
The dataset spans nearly 74,000 unique firewall URLs across 21,600-plus unique domains. The names reportedly embedded in the collection read like a Fortune 500 index — major technology firms, multinational manufacturers, Big Four consulting houses, energy conglomerates, and scores of government agencies and critical infrastructure operators. Multiple NATO-adjacent defense contractors are also alleged to appear, with researchers noting that classified documents may have been exfiltrated from at least one compromised organization.
Shodan analysis suggests the affected IP addresses represent roughly 50 percent of all Fortinet firewall devices currently facing the internet — a staggering proportion that underscores how broadly this threat is distributed.
Compounding the concern, researchers who investigated further discovered that the attackers inadvertently exposed their own operational infrastructure. Inside an open directory, investigators found scripts, tooling, connection strings, and logging data that painted a picture of a sophisticated, likely Russian-speaking multi-operator group running an industrialized credential exploitation pipeline. Estimated activity from that infrastructure includes approximately 1.16 billion credential attempts against over 320,000 FortiGate targets, alongside more than 2 billion attempts against Microsoft SQL Server systems.
The Technical Mechanics: GPU Cracking at Scale
The FortiBleed operation does not rely on brute-force guessing alone. According to technical analysis, the group intercepted SSL VPN authentication hashes and submitted them to a 45-GPU cracking cluster managed through Hashtopolis — a distributed hash-cracking framework commonly used by both penetration testers and criminal operators. This approach allows attackers to recover plaintext passwords from hashed credentials at a speed and scale that makes many legacy password policies effectively useless.
Each record in the dataset reportedly includes structured business intelligence metadata: the target organization's industry vertical, annual revenue, employee count, and geography. This level of enrichment suggests the operation was not opportunistic mass exploitation but a deliberately profiled, commercially motivated campaign — with victims selected, sorted, and prioritized for downstream monetization or sale.
How This Differs from the 2025 Belsen Group Leak
Cybersecurity professionals may recall a 2025 credential dump attributed to the Belsen Group that exposed data from roughly 15,000 Fortinet devices. That earlier leak was retrospective — stale data tied to a 2022 zero-day vulnerability that had since been patched. FortiBleed is materially different. The IP addresses overlap minimally with the earlier dataset, the credentials have been independently verified as current and functional, and the infrastructure involved suggests an active, ongoing operation rather than the release of archival spoils.
How the attackers initially obtained configuration-level access to these devices remains unconfirmed. The breadth of known Fortinet CVEs provides ample candidate vulnerabilities, but researchers have not ruled out the possibility that an undisclosed flaw was exploited — making patch status alone an insufficient defense posture.
What You Should Do
The Bigger Picture
FortiBleed is not a story about a single unpatched CVE or a one-time data dump. It represents the industrialization of network perimeter exploitation — a professional criminal operation with GPU infrastructure, business intelligence enrichment, and multi-country targeting running at a scale that challenges conventional assumptions about credential security. For security leaders, the message is unambiguous: perimeter appliances are not passive gatekeepers. They are high-value targets, and they demand the same continuous monitoring, hardening, and zero-trust skepticism applied to any other critical system.
