A sprawling credential exposure campaign targeting Fortinet firewall infrastructure has surfaced with alarming scale and precision. Verified login data for approximately 75,000 FortiGate devices — representing nearly half of all such appliances currently visible on the public internet — has been confirmed in circulation, complete with plaintext passwords, usernames, email addresses, and detailed business intelligence profiles on each victim organization.
This is not a routine credential dump. The sophistication of the operation, the volume of targets, and the structured commercial formatting of the stolen data point toward a well-resourced, multi-operator threat group operating at industrial scale — and almost certainly selling access to the highest bidder.
What Was Exposed — and How Bad Is It?
Independent researchers who obtained and analyzed the dataset confirmed that the credentials are current, that the affected devices are predominantly still online, and that the data originated from exported device configurations rather than intercepted login traffic. That distinction carries significant weight.
Config exports contain information that cannot be retrieved merely by sniffing authentication sessions. Their presence in this dataset implies that threat actors achieved actual device access at some point during the campaign — not just network observation.
The dataset spans 73,932 unique firewall URLs across 194 countries and more than 21,600 unique domains. Named organizations reportedly appearing in the data include major multinational technology firms, global consulting practices, industrial conglomerates, energy companies, and multiple government agencies and critical infrastructure operators. Perhaps most striking: one file within the collection listed over 21,000 domain names — including at least one NATO-affiliated defense contractor from which classified materials were allegedly exfiltrated.
The Attack Infrastructure Behind the Campaign
The threat group behind this campaign appears to have made an operational security error: researchers discovered an inadvertently exposed directory containing the attackers' own tooling, scripts, logs, analytics, and connection strings. What that directory revealed paints a picture of a highly organized, technically capable operation.
Communications and linguistic patterns within the exposed tooling suggest a Russian-speaking operator or group of operators. The infrastructure reflects a level of investment and operational discipline far beyond opportunistic scanning — this was a deliberate, sustained enterprise.
A Criminal Marketplace, Not a Personal Toolkit
One of the most telling aspects of this dataset is what it includes beyond credentials. Each entry is annotated with the target company's industry vertical, annual revenue, employee count, and country of operation. That metadata is not useful to a single attacker conducting their own intrusions — it is, however, exactly what a broker needs to price and sell initial access to downstream buyers.
This dataset was not built for personal use. It was built for sale. The annotations read less like a hacker's notes and more like a commercial catalog for initial access brokers operating inside ransomware affiliate ecosystems.
An attacker leveraging these credentials can authenticate remotely to the firewall management interface, pivot directly into the network behind it, alter security policies, and silently create persistent backdoor administrator accounts — all without triggering conventional intrusion detection that monitors internal traffic rather than administrative sessions.
The Cryptographic Weakness That Made This Possible
Part of what made large-scale password recovery feasible is a firmware-level cryptographic issue. Fortinet transitioned to PBKDF2-based credential storage in early 2025 firmware updates — a significantly more resistant hashing approach. However, the upgrade only takes effect on devices where an administrator actively logs in after applying the patch. Devices that were updated but never re-authenticated continued storing passwords as salted SHA-256 hashes, which remain vulnerable to brute-force recovery when a configuration file is stolen. Many devices in this dataset appear to fall into exactly that category.
This also distinguishes the current exposure from a 2025 incident involving a separate threat group that leaked data on roughly 15,000 Fortinet devices. That earlier dataset was traced to a 2022 zero-day and contained largely stale credentials. The current collection is recent, verified, and actively exploitable.
What You Should Do Now
If your organization operates Fortinet firewall infrastructure, the following actions are not optional — they are urgent:
- Rotate all administrative credentials immediately, including service accounts and any accounts with firewall management access
- Audit and restrict management interface exposure. FortiGate management interfaces should never be reachable from the public internet. Restrict access to trusted internal IP ranges or out-of-band management networks
- Apply current firmware and re-authenticate. Simply patching to the latest firmware is insufficient — an administrator must log in post-update for the stronger PBKDF2 credential storage to activate
- Review admin accounts for unauthorized additions. Look specifically for recently created accounts with elevated privileges that cannot be attributed to known administrative activity
- Check your exposure using available lookup tools. Hudson Rock has published a lookup service at hudsonrock.com/fortinet where organizations can verify whether their infrastructure appears in the dataset
- Treat your network as potentially compromised. If your device or credentials appear in the dataset, begin incident response procedures — not just remediation. Assume lateral movement may have already occurred
- Enable multi-factor authentication on all firewall management interfaces where supported, and audit VPN user accounts for anomalous access patterns
The Broader Implication
FortiBleed is a reminder that perimeter security appliances — the very devices organizations deploy to protect their networks — have themselves become primary targets for sophisticated adversaries. Firewalls sit at the intersection of administrative access, network visibility, and authentication infrastructure, making them uniquely valuable entry points. When they are compromised, the attacker does not merely see traffic passing through; they hold the keys to the kingdom.
The scale of this campaign, the commercial structure of the stolen data, and the confirmed presence of NATO and critical infrastructure targets all suggest this will not remain a passive credential market for long. Downstream exploitation — likely through ransomware affiliates or state-aligned actors purchasing access — should be considered a near-term probability for organizations identified in this dataset who have not yet acted.
